Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been thinking of using http://tunlr.net/ for accessing "geo-IP banned websites" like netflix.

However, I have my concerns about safety of using some third party DNS server for everything. So, my question is. Let's suppose I use something like tunlr.net or some other third party DNS server. What "evil" they can and can't do?

Let's also add these assumptions.

  • I access mails, facebooks and most importantly bank accounts only through https, but I don't check the certificates by hand, but let my browser do it for me
  • I generally disallow any third party plugins in browser as much as I can (flash, java, Acrobat)
  • I am smart enough not to fall for completely obvious phishing
  • I install actualization, but I don't use antivirus (since I use OS X and Ubuntu)

With all this said - if I use some third party DNS server and it becomes malicious, what can they do?

share|improve this question
add comment

migrated from superuser.com Jun 20 '13 at 18:45

This question came from our site for computer enthusiasts and power users.

4 Answers

Malicious DNS alteration usually drives people to phishing sites instead of the legitimate site they want, but it can also be used to prevent machines from retrieving updates for their OS/Security software, or route your connections through a proxy where an adversary can intercept communications.

share|improve this answer
    
Hm. But if I access those sites by https, it shouldn't matter - it can't show me their version of a website and the communication will be encrypted anyway, no? –  Karel Bílek Jun 20 '13 at 16:23
    
true, which is why phishing is less popular these days, but as the post you highlighted in your answer says, a sufficiently advanced adversary is capable of performing MITM attacks and interception on SSL streams. ISPs in particular have a disturbing capacity to insert themselves into an https stream. zdnet.com/… –  Frank Thomas Jun 20 '13 at 18:08
    
@FrankThomas That article makes some grand assumptions which are false. It is actually very difficult to MITM attack an SSL connection. The NSA could potentially do it, but that would require them to gag-order one of the root CA to sign a wildcard signing key. Otherwise, if you can trust the root CAs in your browser (i.e., not your work computer), then you can trust the SSL connection. Certificate pinning will even stop the NSA from doing a MITM attack. –  Darth Android Jun 20 '13 at 18:40
    
@DarthAndroid - Certificate pinning will not necessarily stop the NSA; if the NSA wanted to MitM https traffic to example.com for anti-terror work, they could potentially force by court order that example.com (or the CA example uses) to give the original private certificate used by example.com to the NSA. (I agree that certificate pinning raises the bar, as you can't change the certificate if an attacker manages to successfully attack one certificate authority). –  dr jimbob Jun 20 '13 at 19:14
1  
....if I am attacked by NSA that can forge certificates, it doesn't matter if I have or haven't the right DNS in the first place since the NSA can just use the actual server –  Karel Bílek Jun 20 '13 at 21:37
add comment

Say you go to https://www.facebook.com but using an attacker-controlled DNS entry www.facebook.com points to an attacker controlled IP address. What can they do? On the face of it, not too much unless they control or can fool a certificate authority that your browser trusts and can get a signed private certificate for www.facebook.com (or simply steal the private certificate for www.facebook.com. They should not be able to re-direct you to http://www.facebook.com without your browser popping up a huge warning that the certificate is not for www.facebook.com and some social engineering to explain it away.

Granted if you just type in facebook.com / www.facebook.com in your browser, your browser may first go to http://www.facebook.com and normally redirect you to https://www.facebook.com. With malicious DNS entry they could intercept the request to http://www.facebook.com and not redirect you to the HTTPS version. Then they can complete eavesdrop, intercept your passwords, and perform a Man-in-the-Middle attack.

share|improve this answer
add comment

If you are using the same computer for your banking, checking emails, I would strongly suggest not to change your DNS settings. In case you forget to change it back to your ISP's DNS server and try to access your email or banking site, you maybe redirected to one of their sites to enter the information.

share|improve this answer
add comment

I found out this answer sufficient

http://security.stackexchange.com/questions/3857/can-a-https-connection-be-compromised-because-of-a-rogue-dns-server

Also, tunlr has this amazing page about privacy and safety

http://tunlr.net/faq/#privacy

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.