3

I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting the DNS settings to OpenDNS. While sorting out a network issue, Checked My DNS settings , and they were modified.

It turned out that a Video player app caused this change, along with some wierd advertisement in notification bar. After uninstalling that app, I found the market littered with similarly named video player apps, all claimed no root access , but access to device settings.

Two questions:

  1. Is DNS really an ordinary android setting ? I doesn't appears in settings menu. Can any app without root access this ?
  2. How dangerous is your address look-up pointed to an unknown server ?
Improve this question
4
  • Hi wingman, welcome to Information Security. I think you should split this into two questions - one specifically about the Android root question, and the 2nd about the more general DNS interception question. You'll get better, more focused answers that way.
    – AviD ♦
    Oct 31, 2012 at 11:31
  • Come to think of it, I'm pretty sure the 2nd one about DNS has been answered here a couple of times... can't look it up right now, but look around in the dns tag.
    – AviD ♦
    Oct 31, 2012 at 11:33
  • Could you please name the video player app so we know which one not to use?
    – ewanm89
    Oct 31, 2012 at 11:52
  • @ewanm89 Don't remember exact name, Easy Video player or new Video player. The thing I remember was a flower like blueish icon. Now I stick to apps with sufficient rep in market. There might be good apps unknown down the list, but then, its a dangerous area too.
    – user117
    Oct 31, 2012 at 11:59

2 Answers 2

Reset to default
4

It is actually possible to set your DNS servers in the phone's UI, by choosing a static IP in the advanced network connections settings. According to a question on StackOverflow, these settings can be programmatically altered as long as the WRITE_SETTINGS permission is set, using the following code:

android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_USE_STATIC_IP, "0");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_DNS1, "192.168.0.2");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_DNS2, "192.168.0.3");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_GATEWAY, "192.168.0.1");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_NETMASK, "255.255.255.0");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_IP, "1");

If you have USB Debugging enabled, the settings can also be changed by software on your PC, without any permission requirements or user interaction.

Onto the second part of your question: yes, this is most definitely a security concern. If an app sets your DNS server to a rogue server, it can redirect traffic to any IP address it wishes, facilitating a man-in-the-middle attack. Combined with tools like BeEF, sslstrip and sslsniff, it's almost trivial to completely spoof your browsing experience.

Improve this answer
4
  • 1
    Thank you. Now I have a hard time trusting any app that uses these permissions. Google should do something about this.
    – user117
    Oct 31, 2012 at 11:34
  • @Polynomial This code is not working for Android OS ver.3 & above. Can you help us for that too.
    – Harpreet
    Feb 25, 2013 at 12:08
  • @Harpreet Nope, sorry, you'll have to go ask on StackOverflow for that one since it's a code problem. I just pulled that code from another source; I'm not an android dev.
    – Polynomial
    Feb 25, 2013 at 13:00
  • 1
    These settings were deprecated in API 17, the current version of AOSP jellybean, and now setting the DNS for wifi has to be set through the wifiManager so there would be a slightly different permission required, but there is also the potential of a malicious app modifying these settings through an app has the correct permissions and exposes publicly accessible components that don't check the permissions of the caller or require permissions.(developer.android.com/reference/android/provider/…)
    – dudebrobro
    Apr 29, 2013 at 13:40
1

This code won't work indeed on Android 3.0 and above unless app is installed in /system/app partition. Those are now protected settings.

Also it doesn't answer the question of setting DNS when on mobile data instead of WiFi.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .