Skip to Content.
Sympa Menu

discuss - Re: [opennic-discuss] [URGENT] [ROUND-ROBIN] DNS POISONING/POSSIBLE MITM ATTACK

discuss AT lists.opennicproject.org

Subject: Discuss mailing list

List archive

Re: [opennic-discuss] [URGENT] [ROUND-ROBIN] DNS POISONING/POSSIBLE MITM ATTACK


Chronological Thread  
  • From: Se7en <se7en AT cock.email>
  • To: discuss AT lists.opennicproject.org
  • Subject: Re: [opennic-discuss] [URGENT] [ROUND-ROBIN] DNS POISONING/POSSIBLE MITM ATTACK
  • Date: Wed, 1 Sep 2021 18:02:51 -0700

On 21-09-02 02:53:44, Lennart Seitz wrote:
> Something certainly is odd here: the "@" part of dig defines the used
> server. So you dont need to "change back" anything. If you put
>
> dig duckduckgo.com @185.121.177.177 +short
>
> in your cli. It will always query at 185.121.177.177, so it should
> always give you the same results (lets keep dns-roundrobin out for now,
> the 69.171.246.9 is certainly wrong)
>
> It seems like something on your system is locally redirecting querys.

I'm looking at my system's /etc/resolv.conf and I see no problem with
it. It is pointing at the router. The router is setup to use the
PiHole as a DNS server. The pihole is (was) setup to use
OpenNICProject. The issue is not on my own computer, but
network-wide. All devices on the WLAN and LAN are affected. There is
no issue when I use another DNS provider. I do not know what may be
causing this alleged redirection on my system I'm using to diagnose
but it seems unlikely as I am not running any kind of special
networking such as `torsocks` into the terminal. While I have DNSCrypt
installed, it is not running on this machine. I am using the version
of `dig` which was in apt, provided by the ISC (DiG
9.11.5-P4-5.1+deb10u5-Debian).

What else could this problem be? I do not believe iti s a cracked
PiHole due to the fact the issue /only occurs/ using the Wiki's
Anycast Servers.

--
|-----/ | Se7en
/ The One and Only! | se7en AT cock.email
/ | 0x0F83F93882CF6116
/ | https://se7en-site.neocities.org

Attachment: signature.asc
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page