Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Use DNS TXT to share information

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: Show HN: Use DNS TXT to share information

#71

Post by Bender »

smashed wrote: post #34
RajT88 wrote: post #31

Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data from the DNS Forwarder even if you haven't paid yet. I've been noodling on how to build a simple proxy off DNS to test on my next flight.

You might be interested in iodine. https://github.com/yarrick/iodine

A word of caution, don't try this in a corporate environment. Many corporate firewalls will generate security alerts on high DNS request rates. PaloAlto PAN's specifically have alerts for this. I believe Fortigate may as well. Most of the DLP appliances will detect this too. Splunk also has a module to detect this based on query logs. I don't have a horse in the race, just trying to save a few here from a paddlin'.

Re: Show HN: Use DNS TXT to share information

#72

Post by fruitreunion1 »

andrelaszlo wrote: post #46
RajT88 wrote: post #31

Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data from the DNS Forwarder even if you haven't paid yet. I've been noodling on how to build a simple proxy off DNS to test on my next flight.

A regular proxy on port 53 might work? Is it necessary to actually use DNS? Otherwise there's https://github.com/yarrick/iodine Edit: seems like others have recommended it already. I got it working in a hotel room once after giving up on the utterly broken ToS acceptance page for the WiFi.

If they do DPI on port 53 traffic to only allow DNS, then it's necessary.

The neat thing about iodine is that it even works when you don't even have access to your home/whatever destination IP address due to the firewall redirecting packets to their server. It uses their resolver as a proxy to access a nameserver that you control, allowing you to exfiltrate data and get an uncensored connection.

Re: Show HN: Use DNS TXT to share information

#73

Post by fruitreunion1 »

xyx0826 wrote: post #41
RajT88 wrote: post #31

Timely. I've been noticing on flights that the in-flight wifi uses a squid proxy to block you until you pay - but most of the time, you'll get whatever data from the DNS Forwarder even if you haven't paid yet. I've been noodling on how to build a simple proxy off DNS to test on my next flight.

Not a proxy but SoftEther VPN supports connection over DNS and/or ICMP. This is meant for circumventing firewalls. https://www.softether.org/1-features/1._Ultimate_Powerful_VP... !)

udp2raw also supports ICMP tunneling, as a simpler/leaner option that you could run WireGuard over. It's quite performant compared to DNS.

Re: Show HN: Use DNS TXT to share information

#74

Post by 8organicbits »

blechinger wrote: post #69
gunapologist99 wrote: post #66

You could also securely hash a username and password together with something like argon2ID, and then authenticate users by seeing if the base64'ed TXT record exists. No need to hit an overloaded database, just dig and you'll even have the benefits of local caching with per-record TTL's! But should you do crazy things like this? Absolutely not! DNS is notoriously prone to MITM, injection, cache poisoning, DoS, etc. DA…

I agree with the idea that one should not trust DNS with any information one does not want public. I'm not totally convinced DNS is irreparably broken though. What are your thoughts on DNS over HTTPS?

DNS over HTTPS secures the connection between the client and their resolver. It doesn't improve anything else. It's still vulnerable to tampering at the still insecure connection between the resolver and the authoritative DNS server.

Re: Show HN: Use DNS TXT to share information

#75

Post by WorldMaker »

hannob wrote: post #27
EnglishLFC wrote: post #22

It's always amusing when someone discovers DNS TXT records. ClamAV has been using them to announce the latest versions for more years than I care to remember. $ dig +short -t txt current.cvd.clamav.net "0.103.8:62:26972:1689593340:1:90:49192:334" For anyone interested, Freshclam interprets this as: Latest ClamAV version: 0.103.8 Latest Main DB version: 62 Latest Daily DB version: 26972 UNIX Timestamp 1689593340 ...an…

That is... interesting that they do not even use HTTPS or any type of signature for that info. So a man in the middle could prevent updates from happening, and freshclam wouldn't even throw a warning?

You don't even need an intentionally evil man in the middle: I can't imagine wanting to block something critical like AV updates on ordinary DNS TTLs, much less the long tail of DNS resolvers that have subtly broken caching strategies of one kind or another and sometimes get the TTLs wrong.

An hour or two may be a huge difference in preventing a viral spread, but at least in my experience is it is tough to rely on DNS propagation below the hour line. Seems like an odd technical choice to me.

Re: Show HN: Use DNS TXT to share information

#76

Post by 8organicbits »

gunapologist99 wrote: post #66

You could also securely hash a username and password together with something like argon2ID, and then authenticate users by seeing if the base64'ed TXT record exists. No need to hit an overloaded database, just dig and you'll even have the benefits of local caching with per-record TTL's! But should you do crazy things like this? Absolutely not! DNS is notoriously prone to MITM, injection, cache poisoning, DoS, etc. DA…

> DANE and DNSSEC are horrible bodges that don't actually do anything useful or in a secure way.

Adoption is extremely poor, usability is horrible, and the approach used is quite dated, but I'm not sure DANE and DNSSEC are insecure. Did you have a reference on the latter?

Re: Show HN: Use DNS TXT to share information

#77

Post by Eduard »

runjake wrote: post #36

It was pretty common for orgs to use TXT and HINFO (“host info”) records up through the 1990s. I still use them at work to provide hints and more information but the current fleet of IT workers don’t really grok anything beyond A and PTR. You’re just using DNS as intended. :-P

What are some neat things to place in TXT and HINFO records that time seems to have forgotten about?

Re: Show HN: Use DNS TXT to share information

#78

Post by 8organicbits »

breakingcups wrote: post #23

DPI will make short work of your unencrypted DNS records..

And encryption wouldn't help much either if this approach became popular enough. It's pretty rare to request TXT records in "normal" end user traffic so it's reasonable to either fully block TXT lookups or flag them as suspicious.

Re: Show HN: Use DNS TXT to share information

#79

Post by Eduard »

egberts1 wrote: post #44
toast0 wrote: post #37

Earlier quoted context omitted.

clamav.net, like most domains, doesn't enable DNSSEC. Further, as designed, local resolvers don't validate DNSSEC, they just ask the recursive resolver to; a MITM between the local and the recursive can lie. So when wikipedia says DNSSEC can protect, that's the permissive can. Like things can happen. But don't rely on it.

Wrong (EDIT: oops, I am wrong) current.cvd.clamav.net is (EDIT:) NOT currently DNSSEC-signed. Just that their dnsquery() via freshclam daemon is not using val_res_query() when pulling in the version number, so it is unverified DNS querying going on … over there.

> Wrong (EDIT: oops, I am wrong) current.cvd.clamav.net is (EDIT:) NOT currently DNSSEC-signed.

When it's better to just delete and replace a comment.

Post reply on HN