72% of smart TVs and 46% of game consoles hardcode DNS settings • Hacker News Board

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#171

Post by JohnBooty » Sat, Dec 05, 2020, 4:07 PM UTC

EvanAnderson wrote: post #18

Another step in the silly device manufacturer / device owner arms-race. As long as people keep rewarding device manufacturers who treat owners as tenants it will progress. I wish people would just stop buying this garbage. They won't, though-- they see the features but not the down-side. The next step will be hard-coded DoH server IPs. Sly owners will NAT those to a transparent MiTM proxy. Then device manufacturers w…

    As long as people keep rewarding device manufacturers 
    who treat owners as tenants it will progress. I wish 
    people would just stop buying this garbage. They won't,
    though-- they see the features but not the down-side.

I hope that folks who blindly espouse free markets above all else realize that this sort of thing is the inevitable consequence.

Consumers nearly always shop with price as a primary concern, and almost never have the sort of detailed domain knowledge to understand pitfalls like the ones discussed here.

We certainly do not want the government to control too many things and should err on the side of freedom, but the result of too little consumer protection by the government means that situations like this are an absolutely guaranteed outcome.

Educated consumers are a good and necessary thing to have, but that falls far short of correcting the issue. It is impossible for a single person to have expert domain knowledge in every single product category. I've been a software developer for 20 years, so (relative to the general population, not HN) I am an "expert" of sorts in this field, but I am assuredly not also an expert in automobiles, food safety, home appliance safety, airline maintenance, medicine, or any of the other things upon which I might spend money.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#172

Post by acdha » Sat, Dec 05, 2020, 4:10 PM UTC

syshum wrote: post #148

acdha wrote: post #76

Earlier quoted context omitted.

It’s not just the U.S. A problem report once lead me to discover that the Spanish company Telefónica cached DNS results for years longer than the TTL. My error monitoring also picked up content injection (prior to HTTPS) and DNS hijacking around the world. Before going with the conspiratorial take note that Mozilla shipped DoH early and both Microsoft and Apple implemented it. Untrustworthy ISPs are a real problem ev…

At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them.... and DoH is absolutely designed to get around network based security and filtering, both for Ad's and other reasons.

> At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them

You can just say you don’t follow this closely. Mozilla is not perfect but they do push for privacy, with an increasingly limited amount of negotiating power.

> DoH is absolutely designed to get around network based security and filtering, both for Ad's and other reasons.

This is similarly reflecting a poor understanding of the situation. DoH can’t get around network filtering - if you block packets, there’s no magic trick to bypass it. It’s great for preventing ISPs from tampering with traffic or monitoring activity (this will also require eSNI to complete) but it’s not giving an attacker any capability they didn’t already have. If you’re concerned about security you’re fooling yourself if you don’t have endpoint management and some level of network segmentation and egress control. Attackers have hard-coded DNS servers, C&C endpoints, etc. for decades.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#173

Post by temptemptemp111 » Sat, Dec 05, 2020, 4:11 PM UTC

stiray wrote: post #17

[flagged]

Quality comment. Are you github.com/stiray? I wanted chat about this without being buried about the HN censor, which I'm surely already.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#174

Post by grishka » Sat, Dec 05, 2020, 4:12 PM UTC

therealx wrote: post #117

grishka wrote: post #109

Earlier quoted context omitted.

I heard that you can buy a dumb 55" monitor if you call it digital signage. Though these things are expensive because they're made for businesses. Another option is to simply never give your smart TV any kind of network connection.

Sadly, some will look for other open wireless netorks and connect. In the future, I'm sure all will have a 5g connection.

At this point you could as well open it up and disconnect the antennas.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#175

Post by Spooky23 » Sat, Dec 05, 2020, 4:12 PM UTC

the8472 wrote: post #61

jon-wood wrote: post #10

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN r…

> and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN responses into the IP address of their ad-laced web search, and occasionally just highjack every single query to send you to a page saying you’re approaching your bandwidth quota Universally? Perhaps in the US? But IoT devices are sold worldwide. While I do run my own recursive resolver I checked my ISP's and they're behaving…

ISPs will also enforce other things using DNS. For example when Spectrum was fighting with Netflix, they sent traffic to some overloaded peering connection.

DNS over HTTPS is an abomination sold as snake oil security.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#176

Post by LeoPanthera » Sat, Dec 05, 2020, 4:12 PM UTC

scarface74 wrote: post #170

bitlevel wrote: post #89

They appear to not be trustworthy to be on our networks - so we should: 1. Not join them to our networks 2. Stop buying 'Smart TV's' 3. Get panels and a smart box that you can control I'm lucky enough to be able to direct ALL DNS through my router first. Nothing gets out without my say so. Not everyone has that capability, sadly, with home routers. The solution provided by the OP is a solid one - another would be to…

So which “smart box” would that be? Roku? Where the CEO outright said that they aren’t in the hardware business and they are trying to monetize via ads? Google? Need I say more Amazon Fire devices? See above with Google AppleTV? Sure I have a couple. They aren’t trying to monetize with advertising. But the HN crowd is anti-Apple.

HN not liking something doesn't make it a bad choice.

Kodi running on a Pi or some other low power computer is probably HN-friendly, although the usability isn't even close to as good as the Apple TV.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#177

Post by willis936 » Sat, Dec 05, 2020, 4:13 PM UTC

jsnell wrote: post #144

willis936 wrote: post #54

Earlier quoted context omitted.

I don’t understand the downvotes. Google has a long history of killing projects. Of all the public DNS to trust, why does anyone have confidence in Google? Because they’re big? Fool me once, shame on you. Fool me 1500 times...

Because you made a zero effort joke that has been worn to the absolute bone by people repeating it thousands of times per year in HN comments, rather than at least putting in a bit of thought as to what the risk is for this service. Here's a quick attempt: Track record: 8888 has been running for more than ten years. Popularity: It appears to be incredibly widely used; e.g. a research paper from 2013 claimed it was se…

It’s not a joke. It’s a question of trust and authority. “Google DNS has been running for 10 years” does not negate Google’s management behavior or change the inherent risk of a free running for-profit entity being considered a DNS authority.

You calling it a tired joke doesn’t change these things.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#178

Post by hanklazard » Sat, Dec 05, 2020, 4:14 PM UTC

mojomark wrote: post #139

hanklazard wrote: post #111

Earlier quoted context omitted.

Yeah I worry about this sort of “annoy the customer into connecting” behavior becoming more common as integrating ads becomes more a part of the business model. Also could connect to open wifi networks in more densely populated areas The real problem will be integrated cellular connectivity with no option to disable.

I hate my Samsung. All of our TV content comes through our Xfinity internet (no digital antenna, no cable box). However, when you turn the TV on the Samsung defaults to "Samsung TV" set of stations that look like local TV and have commercials. They hijack your internet, bandwidth that you pay for, to feed you commercials that they get paid for. How the hell is this legal???

I have a Samsung but use an Apple TV, I'd recommend disconnecting it and going this route. I was paranoid to give this TV any access to a network, and actually kind of freaked out on my poor wife when she connected it one time when I wasn't home.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#179

Post by dkdbejwi383 » Sat, Dec 05, 2020, 4:16 PM UTC

choeger wrote: post #27

We need legislation against this kind of crap. It is only a matter of time until these "smart" devices share childporn or host darknet drug shops. Let's face it, the devs implementing these devices run a scrum process, features get stacked upon features and no one cares about, let alone understands the security of the whole tool stack. It is only a matter of time before we have a bot net of smart tvs and roombas. And…

I wouldn't be surprised if such a thing already exists

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#180

Post by bsagdiyev » Sat, Dec 05, 2020, 4:17 PM UTC

jlgaddis wrote: post #35

jon-wood wrote: post #10

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN r…

> ... and the response to that is hardcoding a set of known good DNS servers which we can rely on. Netgear, at one point, also decided that hard-coding an IP address (for NTP, not DNS) was the best solution [0]. -- [0]: https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Ne...

Sony did the same thing with a Blu-Ray player for NTP, effectively DDoSed that particular box because they also didn’t think to stagger the polling so like clockwork millions of consumer devices would check in at the same time nightly. From what I gathered from the electronics guys a few floors down they eventually resolved that in later revisions, or so I was told.