Live data from Hacker News

iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

gitlab.com

71–80 of 114 posts

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#71
post #63

Earlier quoted context omitted.

This is done. A summary of the issue and apology can be found here: https://gitlab.com/gnachman/iterm2/wikis/dnslookupissue

Thanks for the quick response. How does this coincide with the 3.1.1 release though? I was still on 3.0.15 and there are new features and other fixes in 3.1.x. Do the new features and the other fixes happen to be reasonably tested and ready already?

3.1.1 is well tested. Everyone should upgrade. If you find regressions they'll be my highest priority.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#72
post #64
post #23

It's horrifying to watch your own DNS traffic. All sorts of mysterious domains show up. (On a typical macbook on WiFi, this will do it:) sudo tcpdump -i en0 -s 5000 -n port 53 On mine, these get resolved every 30 seconds (probably some Adobe updater): scss-prod-ue1-notif-39.adobesc.com. Several servers get lookups of names long enough to be exfiltrating data: r3---sn-nvopjoxu-25ve.gvt1.com. (Google) gzunified-ecselas…

That Google one uses a similar naming scheme to the servers used for video data for YouTube etc. You just made me realize something, though. The Google and AWS examples you gave won't be able to do this, but if you set up wildcard DNS and tell DNS that you have your own nameserver via CNAME aliasing, you could make your software do a lookup for eg something like "bm9ib2R5IHdpbGwgZXZlciBub3RpY2UgaWYgSSB0cmFuc21pdCBkYX…

I know several people who use these sorts of techniques to exfiltrate data from a network where you don't have outbound TCP but you can leak information through DNS. As you mentioned, Iodine lets you do this (though by default it tries to use VOID DNS responses that are blocked by a lot of networks).

It's pretty cool being able to do an rsync-over-DNS.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#74
post #54

Fantastic response. ~4 hours from report to release.

4 hours?

More like 2 years! And at least 3 separate bug reports, roughly one year apart each!

https://gitlab.com/gnachman/iterm2/issues/3688

https://gitlab.com/gnachman/iterm2/issues/5303

Unless you are into alternative facts, of course, then, yeah, very prompt release engineering and vulnerability fixing!

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#75
post #72
post #64

Earlier quoted context omitted.

That Google one uses a similar naming scheme to the servers used for video data for YouTube etc. You just made me realize something, though. The Google and AWS examples you gave won't be able to do this, but if you set up wildcard DNS and tell DNS that you have your own nameserver via CNAME aliasing, you could make your software do a lookup for eg something like "bm9ib2R5IHdpbGwgZXZlciBub3RpY2UgaWYgSSB0cmFuc21pdCBkYX…

I know several people who use these sorts of techniques to exfiltrate data from a network where you don't have outbound TCP but you can leak information through DNS. As you mentioned, Iodine lets you do this (though by default it tries to use VOID DNS responses that are blocked by a lot of networks). It's pretty cool being able to do an rsync-over-DNS.

> VOID DNS responses that are blocked by a lot of networks

For ages I've been meaning to [figure out how to] report this to the iodine dev, but I actually set up iodine specifically to get a working network while I knew I'd briefly be visiting a hospital.

I discovered to my amusement that the (public!) hospital's IT infra is really, really good; I was trying to SSH directly on top of the iodine tunnel, and while the first few DNS requests associated with the connection setup would work and I'd get as far as getting a shell prompt, but everything would rapidly screech to a halt and jam up pretty much instantly after that; maybe I'd get a single character typed, then it would completely die. I figured I was looking at a remarkably well-put-together leaky-bucket implementation.

So I tried hacking usleep()s into likely-looking spots in the code, but that didn't seem to slow it down enough. iodine is a rather interesting program internally, and a quick overview while distractedly sitting in a waiting area wasn't entirely sufficient to figure out why I didn't seem to be slowing it down enough to be a problem.

Before this "production" test, I previously verified that iodine was working by running the client on an AWS box. IIRC, ping ran over the link for quite some time (less than an hour; many minutes) without a single hitch.

On another note, I found that iodine seemed utterly incapable of setting up a correctly-configured tunnel on my Arch (receiving/server) box; I always had to ifconfig the tunnel (I forget exactly) to make it work. Problem with that was, my ifconfig-ing only routed one specific IP address, iodine wanted to give connections their own discrete IPs, and old sessions that locked up would take a while to time out. So I made a gigantic hack-script that would repeatedly kill iodine over and over every 1.5 minutes if it didn't see an authenicated SSH login. Would be nice for everything to just work properly...

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#76
post #15

Wow, this reminds me of how Cisco routers automatically try to SSH to anything that isn't a recognized command. (I may be mis-remembering part of this)

I remember it being telnet, not SSH. I started working with Cisco routers in the early 90's, before SSH was even a thing.

Yup, that's right.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#77

Given the level of concern, I will change the default and release a new version right away.

This is done. A summary of the issue and apology can be found here: https://gitlab.com/gnachman/iterm2/wikis/dnslookupissue

Logging in to HN for the first time in several years to say thank you for your swift and responsible action.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#78
post #23

It's horrifying to watch your own DNS traffic. All sorts of mysterious domains show up. (On a typical macbook on WiFi, this will do it:) sudo tcpdump -i en0 -s 5000 -n port 53 On mine, these get resolved every 30 seconds (probably some Adobe updater): scss-prod-ue1-notif-39.adobesc.com. Several servers get lookups of names long enough to be exfiltrating data: r3---sn-nvopjoxu-25ve.gvt1.com. (Google) gzunified-ecselas…

> sudo tcpdump -i en0 -s 5000 -n port 53

It may be better to do it like this:

    sudo tcpdump -i any -s 0 -n port 53
That way you'll get to see every single DNS query made, and capture everything about it.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#79

Given the level of concern, I will change the default and release a new version right away.

This is done. A summary of the issue and apology can be found here: https://gitlab.com/gnachman/iterm2/wikis/dnslookupissue

Awesome, thank you for the swift fix!

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#80

It never ceases to amaze me how otherwise intelligent people think it‘s a good idea to send unencrypted user data to random servers on the internet in the background.

Come on, it's doing domain lookups, it's not sending social security numbers to Russia. The amount of hyperbole regarding this misfeature is absurd. It was something that maybe should have been better expressed but this is not some kind of massive security failure.
Post reply on HN