How often are users' DNS queries intercepted? – Help Net Security

A group of Chinese researchers wanted to find out just how widespread DNS interception is and has presented the result of their large-scale study to the audience at the Usenix Security Symposium last week.

Most Internet connections are preceded by a DNS address lookup request, as the Domain Name System (DNS) “translates” human-readable web addresses to IP addresses.
DNS queries from clients are handled by recursive nameservers and, usually, users’ recursive nameservers are pointed to the ones operated by ISPs. Users can choose their own DNS servers or public recursive nameservers, but there is no guarantee that their requests won’t be intercepted.
According to the researchers, there are many on-path devices that intercept DNS queries sent to public DNS and respond with DNS answers resolved by alternative recursive nameservers.
These interceptions can be made for various purposes: censorship, displaying ads, collecting statistics, blocking malware connections, etc. But they are not authorized by users and are difficult for them to spot.
“The on-path devices either redirect or replicate the requests to alternative resolvers (typically, local DNS resolvers), which perform the standard resolution process. Finally, before responses are sent from alternative resolvers back to clients, the sources are replaced with addresses of the original resolvers. Therefore, from a client’s perspective, DNS responses appear to come from the original DNS resolvers according to their source addresses, making the actual interception behaviors difficult to be discerned,” the researchers explained.
The researchers have devised new approaches to detect DNS interception and have leveraged 148,478 residential and cellular IP addresses around the world for analysis.
They found that:
Surreptitious interception of DNS queries is problematic from the ethical and privacy standpoint.
“Firstly, when DNS requests from clients are handled by alternative resolvers, previous studies have proved it is possible to illegally monetize from traffic. Secondly, as it is difficult for Internet users to detect DNSIntercept merely from clients, public DNS resolvers can be wrongly blamed when undesired results (e.g., advertisement sites or even malware) are returned. Finally, it is possible for intercepted DNS requests to be snooped by untrusted third parties, leading to the leak of privacy data,” the researchers explained.
In addition to this, popular public DNS servers are often deployed with full DNSSEC support and up-to-date DNS software and these alternative resolvers used by intercepters are often not.
The solution for these problems is to encrypt DNS traffic. It can be done but not quickly or easily.
“The deployment of DNS over TLS is sophisticated and needs changes from the client side. As such, the wide deployment of this initiative could take a long time,” they concluded.

source

About The Author

admin

See author's posts