Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

gitlab.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#101

Post by alanh »

tlb wrote: post #23

It's horrifying to watch your own DNS traffic. All sorts of mysterious domains show up. (On a typical macbook on WiFi, this will do it:) sudo tcpdump -i en0 -s 5000 -n port 53 On mine, these get resolved every 30 seconds (probably some Adobe updater): scss-prod-ue1-notif-39.adobesc.com. Several servers get lookups of names long enough to be exfiltrating data: r3---sn-nvopjoxu-25ve.gvt1.com. (Google) gzunified-ecselas…

I woke up in the middle of the night, seized by the realization that this meant that Adobe knows, down to the half-minute resolution, when I am using my computer (to do anything).

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#102

Post by rasz »

emmelaich wrote: post #70
exikyut wrote: post #64

Earlier quoted context omitted.

That Google one uses a similar naming scheme to the servers used for video data for YouTube etc. You just made me realize something, though. The Google and AWS examples you gave won't be able to do this, but if you set up wildcard DNS and tell DNS that you have your own nameserver via CNAME aliasing, you could make your software do a lookup for eg something like "bm9ib2R5IHdpbGwgZXZlciBub3RpY2UgaWYgSSB0cmFuc21pdCBkYX…

I believe it's common for malware to beacon out with a similar method.

and as a bonus fully patched and firewalled Win10 will happily pass DNS traffic thru DNScache daemon without any filtering

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#103

Post by Habbie »

trapperkeeper74 wrote: post #92

In general, dnscrypt can help defend against DNS privacy loss for situations like these.

You said it right - can help defend. On the other end of your dnscrypt tunnel, the queries will still go out unencrypted. They will just be harder to correlate to you specifically.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#104

Post by ThisIs_MyName »

clairity wrote: post #18
duskwuff wrote: post #12

Earlier quoted context omitted.

A local firewall probably wouldn't have helped here -- the DNS lookups would be performed by mDNSResponder, not by iTerm itself.

you might be right about the DNS lookup. but i do distinctly remember getting alerts for this and being annoyed enough to go figure out how to disable the feature in iterm2 (it was at least a couple years ago, so my memory is hazy). maybe someone with more recent experience can clear up the mystery for us. =)

I don't think this "feature" existed a couple of years ago.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#106

Post by jakobegger »

burnte wrote: post #100
jakobegger wrote: post #87

Earlier quoted context omitted.

It doesn’t matter what the code intends to do. Sure, looking up strings that look like domains seems harmless. But it means that every string that looks like a domain is transmitted unencrypted over the internet. If your software deals with private user data, you must consider the side effects of every API you are calling. You can’t just transmit data somewhere and hope that everyone will do the right thing. Network…

It absolutely matters what the code intends to do. If it intends to do a DNS lookup, and does that, that's working properly, eepecially if it's doing an DNS lookup on what its regex says looks like a clickable URL. If it means to store an SSN in an encrypted DB and accidentally writes it to plaintext or sends it to twitter, that's a security flaw. If that same app is following the system standard method of doing DNS…

Most major security breaches are not caused by explicit back doors — they are caused by accidental vulnerabilities.

If you leak user data accidentally, saying “that wasn’t my intent” doesn’t help much.

The important thing that you don’t understand is that there is a difference between a search field / url box, and a Terminal.

I absolutely expect my browser to make DNS queries for stuff I paste into the URL box.

I don’t expect my terminal emulator to make DNS queries for random strings displayed on screen that happen to match a regex.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#107

Post by jetru »

tlb wrote: post #23

It's horrifying to watch your own DNS traffic. All sorts of mysterious domains show up. (On a typical macbook on WiFi, this will do it:) sudo tcpdump -i en0 -s 5000 -n port 53 On mine, these get resolved every 30 seconds (probably some Adobe updater): scss-prod-ue1-notif-39.adobesc.com. Several servers get lookups of names long enough to be exfiltrating data: r3---sn-nvopjoxu-25ve.gvt1.com. (Google) gzunified-ecselas…

I've been running this command on my mac for over 10 minutes, trying different stuff, nothing. Also tried "sudo tcpdump -i any -s 0 -n port 53 -v". What's going on?

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#108

Post by JosephRedfern »

greglindahl wrote: post #51
JosephRedfern wrote: post #21

Earlier quoted context omitted.

Not necessarily slow, DNS Lookups are generally pretty fast: ~ dig somerandomurlimadeup.com | grep 'Query time: ' ;; Query time: 23 msec

Er, that's just saying "you got lucky and the root nameserver you hit was fast". Looking up any valid .com requires that plus a 2nd level lookup.

I tried on several domain names (that I had not, to my knowledge, recently visited), and they were all around the 25ms mark.

I'm not saying that this is the case universally, but for many the typical lookup time will be very fast.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#109

Post by clairity »

duskwuff wrote: post #12
clairity wrote: post #9

a local firewall (hands off & little snitch are handy commercial ones for mac) will help you catch these kinds of info leaks (i caught this one a long time ago because of mine). it does come with a time cost however--little popups every time you launch a new application or connect to a new service that you have to evaluate and handle, since you haven't set rules for them already.

A local firewall probably wouldn't have helped here -- the DNS lookups would be performed by mDNSResponder, not by iTerm itself.

i think it was probably link pre-fetch that triggered the firewall rather than a dns lookup.

Re: iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'

#110

Post by burnte »

jakobegger wrote: post #106
burnte wrote: post #100

Earlier quoted context omitted.

It absolutely matters what the code intends to do. If it intends to do a DNS lookup, and does that, that's working properly, eepecially if it's doing an DNS lookup on what its regex says looks like a clickable URL. If it means to store an SSN in an encrypted DB and accidentally writes it to plaintext or sends it to twitter, that's a security flaw. If that same app is following the system standard method of doing DNS…

Most major security breaches are not caused by explicit back doors — they are caused by accidental vulnerabilities. If you leak user data accidentally, saying “that wasn’t my intent” doesn’t help much. The important thing that you don’t understand is that there is a difference between a search field / url box, and a Terminal. I absolutely expect my browser to make DNS queries for stuff I paste into the URL box. I don…

This wasn't an accident, it deliberately looked up domain looking string against a DNS server. Don't patronize me, going by your twitter picture, I've been at a command shell longer than you've been alive, I damn well know the difference. I also know that doing DNS lookups (the the user's chosen DNS server, rather than some secret one) on domain-name looking data isn't evil or completely unreasonable. He should have made it clear and opt-in rather than opt-out as it was, but by no means was this a vulnerability. If the user can't trust their domain server for domain-like data, they shouldn't use that server.
Post reply on HN