5

I have been thinking of using http://tunlr.net/ for accessing "geo-IP banned websites" like netflix.

However, I have my concerns about safety of using some third party DNS server for everything. So, my question is. Let's suppose I use something like tunlr.net or some other third party DNS server. What "evil" they can and can't do?

Let's also add these assumptions.

  • I access mails, facebooks and most importantly bank accounts only through https, but I don't check the certificates by hand, but let my browser do it for me
  • I generally disallow any third party plugins in browser as much as I can (flash, java, Acrobat)
  • I am smart enough not to fall for completely obvious phishing
  • I install actualization, but I don't use antivirus (since I use OS X and Ubuntu)

With all this said - if I use some third party DNS server and it becomes malicious, what can they do?

[edit, 2017 - tunlr.net is no longer operating; it was a DNS server that redirected netflix to proxied US version for free. There might be similar servers now.]

|improve this question
4

Malicious DNS alteration usually drives people to phishing sites instead of the legitimate site they want, but it can also be used to prevent machines from retrieving updates for their OS/Security software, or route your connections through a proxy where an adversary can intercept communications.

|improve this answer
  • Hm. But if I access those sites by https, it shouldn't matter - it can't show me their version of a website and the communication will be encrypted anyway, no? – Karel Bílek Jun 20 '13 at 16:23
  • true, which is why phishing is less popular these days, but as the post you highlighted in your answer says, a sufficiently advanced adversary is capable of performing MITM attacks and interception on SSL streams. ISPs in particular have a disturbing capacity to insert themselves into an https stream. zdnet.com/… – Frank Thomas Jun 20 '13 at 18:08
  • @FrankThomas That article makes some grand assumptions which are false. It is actually very difficult to MITM attack an SSL connection. The NSA could potentially do it, but that would require them to gag-order one of the root CA to sign a wildcard signing key. Otherwise, if you can trust the root CAs in your browser (i.e., not your work computer), then you can trust the SSL connection. Certificate pinning will even stop the NSA from doing a MITM attack. – Darth Android Jun 20 '13 at 18:40
  • @DarthAndroid - Certificate pinning will not necessarily stop the NSA; if the NSA wanted to MitM https traffic to example.com for anti-terror work, they could potentially force by court order that example.com (or the CA example uses) to give the original private certificate used by example.com to the NSA. (I agree that certificate pinning raises the bar, as you can't change the certificate if an attacker manages to successfully attack one certificate authority). – dr jimbob Jun 20 '13 at 19:14
  • 1
    ....if I am attacked by NSA that can forge certificates, it doesn't matter if I have or haven't the right DNS in the first place since the NSA can just use the actual server – Karel Bílek Jun 20 '13 at 21:37
4

Say you go to https://www.facebook.com but using an attacker-controlled DNS entry www.facebook.com points to an attacker controlled IP address. What can they do? On the face of it, not too much unless they control or can fool a certificate authority that your browser trusts and can get a signed private certificate for www.facebook.com (or simply steal the private certificate for www.facebook.com. They should not be able to re-direct you to http://www.facebook.com without your browser popping up a huge warning that the certificate is not for www.facebook.com and some social engineering to explain it away.

Granted if you just type in facebook.com / www.facebook.com in your browser, your browser may first go to http://www.facebook.com and normally redirect you to https://www.facebook.com. With malicious DNS entry they could intercept the request to http://www.facebook.com and not redirect you to the HTTPS version. Then they can complete eavesdrop, intercept your passwords, and perform a Man-in-the-Middle attack.

|improve this answer
  • This is very accurate, however with proper HSTS configuration, your browser (should) automatically connect using HTTPS even if you type HTTP. This then leaves the only option open to find a way to social engineer through a certificate warning. – Andrew Mar 24 '17 at 14:29
1

If you are using the same computer for your banking, checking emails, I would strongly suggest not to change your DNS settings. In case you forget to change it back to your ISP's DNS server and try to access your email or banking site, you maybe redirected to one of their sites to enter the information.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.