41–50 of 95 posts
Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data from the DNS Forwarder even if you haven't paid yet. I've been noodling on how to build a simple proxy off DNS to test on my next flight.
https://www.softether.org/1-features/1._Ultimate_Powerful_VP...!)
Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data from the DNS Forwarder even if you haven't paid yet. I've been noodling on how to build a simple proxy off DNS to test on my next flight.
Search for iodine
It's always amusing when someone discovers DNS TXT records. ClamAV has been using them to announce the latest versions for more years than I care to remember. $ dig +short -t txt current.cvd.clamav.net "0.103.8:62:26972:1689593340:1:90:49192:334" For anyone interested, Freshclam interprets this as: Latest ClamAV version: 0.103.8 Latest Main DB version: 62 Latest Daily DB version: 26972 UNIX Timestamp 1689593340 ...an…
That is... interesting that they do not even use HTTPS or any type of signature for that info. So a man in the middle could prevent updates from happening, and freshclam wouldn't even throw a warning?
Digging into the code of freshclam, source of libfreshclam.c, dnsquery() function call, it is painfully evident that freshclam daemon does not do basic DNSSEC when performing res_query().
Instead, freshclam should be calling `val_res_query()`.
They are currently using ‘res_query()’.
Earlier quoted context omitted.
Won't DNSSEC prevent MITM attacks in this case? From https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex... - "DNSSEC can protect any data published in the DNS, including text records (TXT) and mail exchange records (MX)"
clamav.net, like most domains, doesn't enable DNSSEC. Further, as designed, local resolvers don't validate DNSSEC, they just ask the recursive resolver to; a MITM between the local and the recursive can lie. So when wikipedia says DNSSEC can protect, that's the permissive can. Like things can happen. But don't rely on it.
Just that their dnsquery() via freshclam daemon is not using val_res_query() when pulling in the version number, so it is unverified DNS querying going on … over there.
OP, this is trivial to detect. DNS command and control is a thing malware/attackers use which among other things include TXT records,DoH, long A or AAAA records and many other creative ways, my fav right now being using a CNAME chain to encode information (no single request is too large or suspicious. In my experience, bypassing censorship does not mean doing unusual things like this but things like browser extenstio…
Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data from the DNS Forwarder even if you haven't paid yet. I've been noodling on how to build a simple proxy off DNS to test on my next flight.
Otherwise there's https://github.com/yarrick/iodine
Edit: seems like others have recommended it already. I got it working in a hotel room once after giving up on the utterly broken ToS acceptance page for the WiFi.
Earlier quoted context omitted.
Don't most of them hijack any DNS traffic to send it to their own portal?
That's not that typical anymore. For one thing, it poisons the client's dns cache, and it can be hard to go to the actual destination later. For another, if DNS was the access control mechanism, that's pretty weak, many people can figure out how to get around a DNS block. It's more typical now to return the A records, and then route all IPs to a portal server until you login. Logged in sessions get to go forth to the…
Earlier quoted context omitted.
clamav.net, like most domains, doesn't enable DNSSEC. Further, as designed, local resolvers don't validate DNSSEC, they just ask the recursive resolver to; a MITM between the local and the recursive can lie. So when wikipedia says DNSSEC can protect, that's the permissive can. Like things can happen. But don't rely on it.
Wrong (EDIT: oops, I am wrong) current.cvd.clamav.net is (EDIT:) NOT currently DNSSEC-signed. Just that their dnsquery() via freshclam daemon is not using val_res_query() when pulling in the version number, so it is unverified DNS querying going on … over there.
Earlier quoted context omitted.
Wrong (EDIT: oops, I am wrong) current.cvd.clamav.net is (EDIT:) NOT currently DNSSEC-signed. Just that their dnsquery() via freshclam daemon is not using val_res_query() when pulling in the version number, so it is unverified DNS querying going on … over there.
But there's no chain from the root, or at least that's what I'm getting from this tool [1]. [1] https://dnssec-analyzer.verisignlabs.com/clamav.net
This mean, any TXT record can easily be spoofed via a simple transparent MitM packet munging.
https://dnssec-analyzer.verisignlabs.com/current.cvd.clamav....
Earlier quoted context omitted.
:) to be fair SSH doesn't cope well on high latency, high packet loss connections.
mosh[0] helps a lot in these scenarios. It doesn't actually make your connection any faster, but it does make things feel a lot more responsive. [0] https://mosh.org/