0

My home / home-office network uses OpenDNS as a content filter. As the OpenDNS admin, I received a "User wants access to..." email indicating that someone tried to access a blocked site and requested that it be un-blocked. The user's name and email address were unfamiliar to me.

However, after studying the time of the request, details from the request email, and router logs, I'm fairly sure the requesting device was not connected to my network at the time. The request came from a Disconnect.me VPN IP address.

I'm hazy on the topology of a router-to-DSL-modem-to-OpenDNS configuration, especially with Disconnect.me thrown in. Is it possible this is some unexpected interaction between OpenDNS and Disconnect.me? Or is there some other way an OpenDNS "User wants access" email could be routed to the wrong admin from a device not directly on the admin's network?

More details:

The request email was from an iPad, and my WRT1900AC's control panel says this iPad has never authenticated to my network, so network intrusion seems somewhat unlikely. Also, someone stealthy enough to hack my router almost certainly wouldn't be clumsy enough to fill out a form, supply their name and ISP-based email address (@sbcglobal), and ask me to unblock an adult website.

Coincidentally (?) I recently started trying Disconnect's VPN on one Windows workstation, but that machine was powered off at the time of the request.

  • Thanks @TildalWave. The email looked identical to one I generated by trying to visit the same site, but I hadn't investigated in detail until now. The site seems to be a legitimate one, and except for reasonable variances the HTTP headers are the same in both the test and real email. So phishing and spam seem relatively unlikely. I've also submitted a support ticket to OpenDNS. I was just hoping that some expert here would have insight into possible OpenDNS issues from the security angle. – Andy Giesler Jan 5 '15 at 16:27
  • 1
    Just a thought - did your internet IP address recently change? If another DSL user was using OpenDNS and recently took over your previous IP at your ISP, OpenDNS may have identified you as the admin if you hadn't refreshed your IP with OpenDNS. – SilverlightFox Jan 6 '15 at 8:01
  • @SilverlightFox, thanks! You just gave me the last piece of the puzzle. I run the OpenDNS Updater utility on my main workstation, so OpenDNS is informed of any IP address changes. But ironically, that precaution is (I'm fairly sure) the problem's cause. I'll confirm a little further and then post an answer with details here. – Andy Giesler Jan 6 '15 at 15:31
  • @SilverlightFox, thanks +1 for helping me think this mystery through. I finally figured out an explanation, and it could easily affect other OpenDNS and Disconnect.me users. OpenDNS support confirmed the problem. – Andy Giesler Jan 15 '15 at 19:30
1

The problem here isn't about information security as in "someone hacking my network", but information security as in "information leaking unexpectedly from one user to another".

And it is caused by an interaction between OpenDNS and Disconnect.me VPN. I assume other similar-acting VPNs would have the same interaction.

What OpenDNS does

If you run OpenDNS, it learns to recognize your IP address, and it uses that IP address to apply your filtering rules to all of your traffic. And if you run the OpenDNS IP Updater utility (as recommended), the utility will inform OpenDNS's servers if it sees your network's external IP address change, which can happen to any network whose provider assigns IPs dynamically.

OpenDNS x Disconnect.me VPN

Now throw Disconnect.me's VPN into the mix. While the Disconnect.me VPN runs, it temporarily assigns your computer a new IP address. This is the address of a Disconnect.me VPN server, and the address is shared by other Disconnect.me users. The OpenDNS Updater sees this new IP address and tells OpenDNS's servers to associate it with your account.

Oops.

Why that's a problem

Now any Disconnect.me user who is also running OpenDNS, and who happens to go through the same Disconnect.me server, will have all of their traffic filtered according to your OpenDNS rules. Worse, if they request that their admin unblock a site, you'll receive that request by email instead of their admin receiving it.

When we had this configuration in place, OpenDNS servers showed our traffic stats increase by nearly 1,000% (2,400 requests per day vs. 20,000 requests per day). This was caused by other user's traffic being routed through our OpenDNS account for filtering. If one of those users hadn't requested access to a blocked site, we might not have recognized the problem for a long time.

Solution

Don't use Disconnect.me VPN on a computer that's running the OpenDNS Updater utility.

I suspect Disconnect.me VPN could also resolve this problem by providing its own DNS lookup service rather than running through the computer's default DNS service. (I'll raise this possibility with them.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.