4

I'm new to this netsec stuff but I wanted to ask an opinion about what is going on here.

I've been doing some web development and have been using Codekit for ages, but recently noticed that it's in-built http server (which relies on mDNS/Bonjour) was replacing the genuine computer name with a domain name that is linked to my ISP (telenet.be).

When I navigated to the url (at first by accident as that's how I discovered the issue) it was blocked by safari as being unsafe. I checked with Google transparency report and it also confirmed it was unsafe:

"https://transparencyreport.google.com/safe-browsing/search?url=http:%2F%2Fptr-7t1s6cghydz54g8s3vv.18120a2.ip6.access.telenet.be" 
as well as the subdomain : 
"https://transparencyreport.google.com/safe-browsing/search?url=access.telenet.be"

I contacted Codekit who confirmed that all the software does is request the computer name. Using Wireshark I confirmed that was what it was doing, and that the response it got was correct. Although I'm not an expert Wireshark user and reading beyond that may give clues.

Bryan at Codekit mentioned that he believed sometimes ISPs abuse Bonjour on the local network, and that could be happening here. I concluded that if it was the router behaving badly Google Transparency report would not have flagged it as it would not really be aware of LAN mDNS issues.

I have also noticed another artifact. Codekit can generate a self-signed certificate for using https on it's http server. When I am disconnected from the router, the certificate has the expected DNSName entries when it is generated. However when I connect to the router, when codekit generates the certificate, it includes two additional DNS Names which seem related to the issue:

ptr-7t1s6cghydz54g8s3vv.
ptr-7t1s6cigrgphwg7vz1u.

Also I have tried connecting via a personal hotspot from my phone's 4G service (ie avoiding the router) and the problem does not occur at all. In fact I've tried so many times I'm certain that it isn't my Mac that has the problem, as it probably should occur regardless of how I access the internet. So from this perspective I believe it has something to do with the mDNS bonjour service.

I contacted the ISP to ask them to check their subdomain content, and DNS records and to verify that they were not inadvertantly hosting malware, and to request a replacement router to do an A/B test. I was told at first (no joke) to restart my router. Then they said they'd replace the router for a fee. I should also add that the ISP do not allow direct access to the admin panel of the router, instead you have to go via their website (yes I did say that) to set up port forwarding, network passwords etc...

After many days of conversations and further investigation, I think that there are three likely scenarios, outlined in the title, but my technical abilities on how to deal with this are exhausted. I seem to be going round in circles with the ISP, they either know about this and are not willing to do anything about it, or they just don't have the techncal expertise to understand what is going on.

Hence the post here. Can anyone shed some light on this?

Improve this question
7
  • Just speculation, but it looks like the subdomain is assigned from a pool owned by your ISP to represent your machine. This address probably gets sent to your router by your ISP, which passes it on to the computer where Codekit picks up on it. My guess would be that a previous owner of this address did Bad Things and Google noticed.
    – ndm13
    Commented Dec 24, 2017 at 3:41
  • Any idea what the mechanism is and how I could stop it from happening, i already blocked port 5353 on my router (mDNS Bonjour) but that still doesn't stop it.
    – T9b
    Commented Dec 26, 2017 at 13:52
  • The only evidence you have of malware is a flag by Google, correct? I don't believe there's actually any malware, and that there flag comes from a previous client that was assigned that domain. Did you try to restart your router? That might put you on a new domain, which would get rid of the flag.
    – ndm13
    Commented Dec 26, 2017 at 21:17
  • I would say the evidence goes beyond a google flag, it affects the mDNS service, and edits self-signed certificates even after they have been created - but none of this happens if the router is turned off (which BTW I did try a reset).
    – T9b
    Commented Dec 27, 2017 at 13:28
  • The mDNS/certificate issues are not really issues per se: like you said, your router is providing an external domain name, and Codekit is making a certificate based on that. Everything looks by design to me, and even if it wasn't, I'd be hard-pressed to think of any malware that doesn't require system presence but can also modify a local certificate. I suppose the next step in "fixing" this would be to try to get your ISP to assign you a new subdomain, but I'm unsure how to go about that.
    – ndm13
    Commented Dec 27, 2017 at 16:50

1 Answer 1

Reset to default
2

Why you get the strange domain

Your ISP gives you an IP when you connect to the internet. There is a type of DNS record used to link an IP to a hostname (called a PTR record, which explains why the domains you listed all start with ptr). If you visit this site you can see your current PTR record.

Why the 3G internet does not have a hostname

It is possible your 3G IP does not have a PTR record.

Why are these domains treated as malicious

As you can see from the Transparency report, all subdomains of ip6.access.telenet.be are treated as mallicious.

This is probably because either:

  • Someone on your ISP deliberately hosted a malicious site and got the whole ISP flagged
  • Someone on your ISP got infected with malware which hosted a malicious site, causing the same effect

References

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .