Skip to Content.
Sympa Menu

discuss - Re: [opennic-discuss] [URGENT] [ROUND-ROBIN] DNS POISONING/POSSIBLE MITM ATTACK

discuss AT lists.opennicproject.org

Subject: Discuss mailing list

List archive

Re: [opennic-discuss] [URGENT] [ROUND-ROBIN] DNS POISONING/POSSIBLE MITM ATTACK


Chronological Thread  
  • From: Lennart Seitz <mail AT lseitz.de>
  • To: discuss AT lists.opennicproject.org
  • Subject: Re: [opennic-discuss] [URGENT] [ROUND-ROBIN] DNS POISONING/POSSIBLE MITM ATTACK
  • Date: Thu, 2 Sep 2021 03:07:36 +0200

On 02.09.2021 03:02, Se7en wrote:
> On 21-09-02 02:53:44, Lennart Seitz wrote:
>> Something certainly is odd here: the "@" part of dig defines the used
>> server. So you dont need to "change back" anything. If you put
>>
>> dig duckduckgo.com @185.121.177.177 +short
>>
>> in your cli. It will always query at 185.121.177.177, so it should
>> always give you the same results (lets keep dns-roundrobin out for now,
>> the 69.171.246.9 is certainly wrong)
>>
>> It seems like something on your system is locally redirecting querys.
> I'm looking at my system's /etc/resolv.conf and I see no problem with
> it. It is pointing at the router. The router is setup to use the
> PiHole as a DNS server. The pihole is (was) setup to use
> OpenNICProject. The issue is not on my own computer, but
> network-wide. All devices on the WLAN and LAN are affected. There is
> no issue when I use another DNS provider. I do not know what may be
> causing this alleged redirection on my system I'm using to diagnose
> but it seems unlikely as I am not running any kind of special
> networking such as `torsocks` into the terminal. While I have DNSCrypt
> installed, it is not running on this machine. I am using the version
> of `dig` which was in apt, provided by the ISC (DiG
> 9.11.5-P4-5.1+deb10u5-Debian).
>
> What else could this problem be? I do not believe iti s a cracked
> PiHole due to the fact the issue /only occurs/ using the Wiki's
> Anycast Servers.
>
Yeah i get that. But if you dig @opennicIP, you skip the resolv.conf. So
it does not matter what you system "normally" uses.

So whats weird here is that the output changes, denpending on the server
you configure on the Pihole. This should not happen and leads to thing
me that something (perhaps your firewall) is somehow messing things up here.



--
Mit freundlichen Grüßen,
Lennart Seitz
PGP-Schlüssel: 0x187abd76a5660379 (https://pgp.lseitz.de/key.asc)
--




Archive powered by MHonArc 2.6.24.

Top of Page