Earlier quoted context omitted.
This is done. A summary of the issue and apology can be found here: https://gitlab.com/gnachman/iterm2/wikis/dnslookupissue
Thanks for the quick response. How does this coincide with the 3.1.1 release though? I was still on 3.0.15 and there are new features and other fixes in 3.1.x. Do the new features and the other fixes happen to be reasonably tested and ready already?
iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
71–80 of 114 posts
Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
#72It's horrifying to watch your own DNS traffic. All sorts of mysterious domains show up. (On a typical macbook on WiFi, this will do it:) sudo tcpdump -i en0 -s 5000 -n port 53 On mine, these get resolved every 30 seconds (probably some Adobe updater): scss-prod-ue1-notif-39.adobesc.com. Several servers get lookups of names long enough to be exfiltrating data: r3---sn-nvopjoxu-25ve.gvt1.com. (Google) gzunified-ecselas…
That Google one uses a similar naming scheme to the servers used for video data for YouTube etc. You just made me realize something, though. The Google and AWS examples you gave won't be able to do this, but if you set up wildcard DNS and tell DNS that you have your own nameserver via CNAME aliasing, you could make your software do a lookup for eg something like "bm9ib2R5IHdpbGwgZXZlciBub3RpY2UgaWYgSSB0cmFuc21pdCBkYX…
It's pretty cool being able to do an rsync-over-DNS.
Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
#73Given the level of concern, I will change the default and release a new version right away.
Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
#74Fantastic response. ~4 hours from report to release.
More like 2 years! And at least 3 separate bug reports, roughly one year apart each!
https://gitlab.com/gnachman/iterm2/issues/3688
https://gitlab.com/gnachman/iterm2/issues/5303
Unless you are into alternative facts, of course, then, yeah, very prompt release engineering and vulnerability fixing!
Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
#75Earlier quoted context omitted.
That Google one uses a similar naming scheme to the servers used for video data for YouTube etc. You just made me realize something, though. The Google and AWS examples you gave won't be able to do this, but if you set up wildcard DNS and tell DNS that you have your own nameserver via CNAME aliasing, you could make your software do a lookup for eg something like "bm9ib2R5IHdpbGwgZXZlciBub3RpY2UgaWYgSSB0cmFuc21pdCBkYX…
I know several people who use these sorts of techniques to exfiltrate data from a network where you don't have outbound TCP but you can leak information through DNS. As you mentioned, Iodine lets you do this (though by default it tries to use VOID DNS responses that are blocked by a lot of networks). It's pretty cool being able to do an rsync-over-DNS.
For ages I've been meaning to [figure out how to] report this to the iodine dev, but I actually set up iodine specifically to get a working network while I knew I'd briefly be visiting a hospital.
I discovered to my amusement that the (public!) hospital's IT infra is really, really good; I was trying to SSH directly on top of the iodine tunnel, and while the first few DNS requests associated with the connection setup would work and I'd get as far as getting a shell prompt, but everything would rapidly screech to a halt and jam up pretty much instantly after that; maybe I'd get a single character typed, then it would completely die. I figured I was looking at a remarkably well-put-together leaky-bucket implementation.
So I tried hacking usleep()s into likely-looking spots in the code, but that didn't seem to slow it down enough. iodine is a rather interesting program internally, and a quick overview while distractedly sitting in a waiting area wasn't entirely sufficient to figure out why I didn't seem to be slowing it down enough to be a problem.
Before this "production" test, I previously verified that iodine was working by running the client on an AWS box. IIRC, ping ran over the link for quite some time (less than an hour; many minutes) without a single hitch.
On another note, I found that iodine seemed utterly incapable of setting up a correctly-configured tunnel on my Arch (receiving/server) box; I always had to ifconfig the tunnel (I forget exactly) to make it work. Problem with that was, my ifconfig-ing only routed one specific IP address, iodine wanted to give connections their own discrete IPs, and old sessions that locked up would take a while to time out. So I made a gigantic hack-script that would repeatedly kill iodine over and over every 1.5 minutes if it didn't see an authenicated SSH login. Would be nice for everything to just work properly...
Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
#76Wow, this reminds me of how Cisco routers automatically try to SSH to anything that isn't a recognized command. (I may be mis-remembering part of this)
I remember it being telnet, not SSH. I started working with Cisco routers in the early 90's, before SSH was even a thing.
Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
#77Given the level of concern, I will change the default and release a new version right away.
This is done. A summary of the issue and apology can be found here: https://gitlab.com/gnachman/iterm2/wikis/dnslookupissue
Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
#78It's horrifying to watch your own DNS traffic. All sorts of mysterious domains show up. (On a typical macbook on WiFi, this will do it:) sudo tcpdump -i en0 -s 5000 -n port 53 On mine, these get resolved every 30 seconds (probably some Adobe updater): scss-prod-ue1-notif-39.adobesc.com. Several servers get lookups of names long enough to be exfiltrating data: r3---sn-nvopjoxu-25ve.gvt1.com. (Google) gzunified-ecselas…
It may be better to do it like this:
sudo tcpdump -i any -s 0 -n port 53
That way you'll get to see every single DNS query made, and capture everything about it.Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
#79Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
#80It never ceases to amaze me how otherwise intelligent people think it‘s a good idea to send unencrypted user data to random servers on the internet in the background.