3

Whenever I do nmap scans, it seems that the information related to port 53 is altered by my ISP router as follows:

$ nmap -T4 -A -v stackoverflow.com

PORT     STATE SERVICE  VERSION
53/tcp   open  domain   MikroTik RouterOS named or OpenDNS Updater
.... // Ports related to the actual stackoverflow.com scan: 21, 22, 25, 80...

This happens for every target IP or hostname: scanme.nmap.org, google.org, etc

However, if I do a scan using an online scanner such as https://hackertarget.com/nmap-online-port-scanner/, it shows the exact details and doesn't show this 53 service.

Starting Nmap 6.46 ( http://nmap.org ) at 2015-12-26 22:11 CST
Nmap scan report for stackoverflow.com (104.16.37.249)
Host is up (0.00093s latency).
Other addresses for stackoverflow.com (not scanned): 104.16.35.249 104.16.34.249 104.16.33.249 104.16.36.249
PORT     STATE    SERVICE       VERSION
21/tcp   filtered ftp
22/tcp   filtered ssh
25/tcp   filtered smtp
80/tcp   open     http          cloudflare-nginx
443/tcp  open     ssl/https     cloudflare-nginx
3389/tcp filtered ms-wbt-server

How do I avoid this.

Important: Off topic but my network may be in a MITM attack. Could a MITM cause this?

  • It looks like your Nmap scan is ending at your router. What do you get if you run the following scan? nmap -F scanme.nmap.org Also, you're running Nmap 6.46. I think the latest version is 7.01 now, so i'd recommend upgrading too. – mk444 Dec 27 '15 at 4:23
  • @mk444 Not shown: 94 closed ports PORT STATE SERVICE 22/tcp open ssh 53/tcp open domain 80/tcp open http 135/tcp filtered msrpc 139/tcp filtered netbios-ssn 445/tcp filtered microsoft-ds – user76223 Dec 27 '15 at 4:25
  • @mk444 I think I found the problem it's actually the dns port of my router. It is showing up in every scan. Does this normally happen if you use the ISP's dns? – user76223 Dec 27 '15 at 4:26
  • try specifying custom DNS servers via the --dns-servers option. Nmap --help for more info on usage. – mk444 Dec 27 '15 at 4:37
  • It looks like your ISP is intercepting all port 53 requests. Perhaps for advertising ("maybe you wanted to search for this keyword and look at our partners' offers"), but maybe they're using a captive portal that makes sure you can't access anything (and redirecting you to the portal for all names) before you log in. Perhaps the router is configured this way, if it is supplied by the ISP. – chexum Dec 27 '15 at 5:36
2

It apears that your router's firewall has hijacked your DNS requests. I found these instructions on your router's wiki page which describe exactly how to do that:

Force users to use specified DNS server

This is just simple firewall rule which will force all Your users behind RB to use DNS server which You will define.

In /ip firewall nat

add chain=dstnat action=dst-nat to-addresses=192.168.88.1 to-ports=53 protocol=tcp dst-port=53

add chain=dstnat action=dst-nat to-addresses=192.168.88.1 to-ports=53 protocol=udp dst-port=53

This rule will force all users with custom defined DNS server to use 192.168.88.1 as their DNS server, this rule will simply redirect all request sent to ANY-IP:53 to 192.168.88.1:53

If you can log into your router, you may be able to undo the damage yourself. If not, your ISP would have to make the change. Your other options will be complex, like setting up a VPN.

Please note that your country may have laws regarding DNS that may have forced your ISP to provide only government-approved DNS name resolutions. For example, Turkey required the removal of Twitter's servers from DNS due to all the public tweets criticizing their corrupt cabinet. I would not advise you to attempt to work around this restriction if it means going to jail.

  • Sadly the same router is used for tens of people. I neither have the physical or digital access to the Router. I guess I'll just have to use a VPN. – user76223 Dec 27 '15 at 17:14
1

Your scan results for scanme.nmap.org are correct and are the same results as mine and those obtained from the URL link you provided. Your Nmap is working correctly.
Also, it might not be a good idea to scan domains that you don't have authorisation to do so, so i can't help with your scan of stackoverflow.com.
scanme.nmap.org is ok to scan as this has been provided by the creator of Nmap for testing.
Also, try specifying custom DNS servers via the --dns-servers option. Nmap --help for more info on usage.

  • I get 53/tcp MikroTik RouterOS named or OpenDNS Updater even when I scan scanme.nmap.org with intense scan. – user76223 Dec 27 '15 at 4:41
  • I get it even if I use custom DNS nmap -T4 -A -v --dns-servers 8.8.8.8 scanme.nmap.org – user76223 Dec 27 '15 at 4:44
  • It sounds like the intense scan is triggering some kind of security function on your router, since the fast scan worked fine. It could be firewall related. Have a look at your router settings - wiki.mikrotik.com/wiki/Drop_port_scanners – mk444 Dec 27 '15 at 4:45
  • The ISP's router is not under my control. They use a single shared router for many customers. – user76223 Dec 27 '15 at 4:46
  • I'll just have to exclude 53 port from my nmap scan. Thanks. – user76223 Dec 27 '15 at 4:48
1

This sounds to me as though your ISP (or MitM'd network) is redirecting all port 53 (DNS) requests to their own DNS service. This may be a means of preventing users from using other DNS servers. My guess is this is to possibly help enforce domain restriction (blocking access to certain websites by domain name as opposed to IP address). This could also be a part of a very elaborate MitM attack as you have suggested. In order to find out for sure, I would recommend contacting your ISP.

If this is a part of a MitM attack, this attack would make use of the poisoning of your DNS cache by the resolving of legitimate domains to an attacker's IP address, and could do so without changing the actual IP address of the DNS server advertised by the router or ISP.

  • Thank you. Can you please point me to more resources on how I can bypass this or detect the MitM or stop it? – user76223 Dec 27 '15 at 6:40
  • @Wally Bypassing and detecting this kind of attack isn't easy. In order to detect this attack and confirm it, you will need a computer on another network with ports open and logging on those ports enabled (in order to communicate with it and compare results). Bypassing it would involve the use of a DNS server that uses a port other than 53. Realistically this would involve you personally setting up your own DNS server (which could actually be done pretty easily, but will probably cost you a bit of money to get it set up on a completely different network). Might need a proxy for DNS too though. – Jonathan Gray Dec 27 '15 at 6:51
  • @Wally, you could use DNSSEC or DNSCrypt. – John Deters Dec 27 '15 at 6:52
  • @JohnDeters Good idea, hasn't even crossed my mind. But I'm not sure -- do they use different ports (other than 53)? – Jonathan Gray Dec 27 '15 at 6:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy