4

Today I was visiting a website, using HTTPS obviously, that firefox gave me a certificate error and said that the certificate did not match the website's information.

After a bit of investigation, it seems to me that my DNS provider is probably causing that. I suspect that my DNS requests are first resolved to an intermediary server and then rerouted to the original website.

Is it possible for ISPs to pull off this kind of attacks? For the record, my DNS providers are set to 8.8.8.8 and 8.8.4.4, which makes me quite paranoid that my ISP is doing some sort of sniffing on my traffic to override my DNS settings. My system uses unencrypted DNS by default (over port 53). So, am I being unreasonably paranoid or could I be right?

Improve this question
4
  • "So, am I being unreasonably paranoid or could I be right?" Get the IP address you had for that name, and compare it with results from other resolvers, either using DOH for example towards recursive resolvers, or use sites like whatsmydns.net ; note that IPs may not match legitimally because of CDNs or Geolocation. However you can also search (in RIR databases) to which organization the IP you got belongs.
    – Patrick Mevzek
    Sep 29, 2022 at 20:20
  • FWIW make sure you are paranoid enough and not just paranoid :-) The fact that the IP is the correct one is not enough, see this case at psychz.net/client/blog/en/… where a BGP level attack allowed traffic to be diverted while keeping the real IP. Note also that TLS does not help, if attackers are smart, they will be able to put in place (and do in practice) any DV issued certificate and it will raise no errors. One possible solution is DANE, and DNSSEC.
    – Patrick Mevzek
    Sep 29, 2022 at 20:23
  • @PatrickMevzek That's extremely scary stuff. How could I protect myself against such attacks? I would love to see a solution.
    – PizzaIsLove
    Sep 29, 2022 at 20:27
  • @PizzaIsLove, 1) you might want to check the details of the certificate you received (without accepting IT!) 2) compare the certificate with the latests ones found in crt.sh (especially checking if the certificate fingerprints are the same).
    – ysdx
    Sep 30, 2022 at 16:19

1 Answer 1

Reset to default
5

It is very much possible that your ISP could be messing with your DNS request.

Regular old DNS defaults to being UDP based, unencrypted and unauthenticated (yes, it can be TCP based and can be authenticated using DNSSEC, but the vast majority of DNS request in the wild will be UDP based and not using DNSSEC) - meaning it is trivial for your ISP to intercept it, read it, and send a reply pretending to be Googles DNS resolvers (8.8.8.8 and 8.8.4.4).

You’d be sent to a website that potentially would act as a proxy between you and your target destination. From there they’d be able to inject adverts that they’d collect money on, or more nefariously, they’d be able to sniff any data you send to the site, such as login credentials.

The reason it fails is, as you mentioned, that it fails to present the right certificate.

I would not say you are being unreasonably paranoid, given that this used to be “standard practice” for US based ISP’s some 10-15 years ago, and might very well still be today.

Edit: an alternative reason for the certificate error is that the site operators have misconfigured the webserver to present the wrong certificate.

You mention that you use Firefox. Firefox does use DNS-over-HTTPS for some locales/regions and you might be lucky that it’s enabled for you. If it is, your ISP cannot easily/trivially interfere with the DNS lookups made by Firefox. You can read more about it here: https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs

Improve this answer
9
  • Thanks. I can't upvote your post unfortunately because of my reputation. So, what is the solution? Does DNS over HTTPS solve this issue completely? I have tried to enable DNS over HTTPS in firefox but when I do it, no website is opened anymore.
    – PizzaIsLove
    Sep 29, 2022 at 20:20
  • 1
    "Regular old DNS is UDP based". No. Stop propagating this wrong assumption. DNS is using both UDP and TCP.
    – Patrick Mevzek
    Sep 29, 2022 at 20:21
  • 1
    Also "and unauthenticated" is half true. DNSSEC adds authentication and integrity.
    – Patrick Mevzek
    Sep 29, 2022 at 20:21
  • DNS-over-HTTPS is one of the answers. Why you can’t open any sites with it enabled I cannot answer - Either because of some network misconfiguration or because your ISP really do not want you to use DNS-over-HTTPS.
    – MadsRC
    Sep 29, 2022 at 20:28
  • @PatrickMevzek, thank you, I’ll make sure to update my answer to better reflect what I meant.
    – MadsRC
    Sep 29, 2022 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.