RoadRunner Intercepting Domain Typos 337
shaunco writes "Sometime around midnight on February 26th (at least for the SoCal users), TimeWarner's RoadRunner service started intercepting failed DNS requests, redirecting them to RoadRunner's own search and advertising platform. To see if this has been enabled in your area, try visiting {some random string}.com in your Web browser. This feature subverts user preferences set within browsers, which allow the user to select which search engine receives their typos and invalid domains. RoadRunner users can disable this function — or they can just use OpenDNS. Here is an example RoadRunner results page.
OpenDNS Guide (Score:5, Insightful)
Re:OpenDNS Guide (Score:5, Informative)
Re:OpenDNS Guide (Score:4, Informative)
Even in Firefox, all domains are intercepted and the search page is delivered if you just type the name (good or not)without http:/// [http] and hit enter. IE users won't notice this as IE already delivers MSN Search if you try that.
Re: (Score:2)
Re:OpenDNS Guide (Score:5, Funny)
Re: (Score:3, Informative)
Re:OpenDNS Guide (Score:4, Informative)
We are still doing tests (it just started here in Charlotte yesterday).
Another change over the past few days is that newsgroup access has been halved (connections) from 8 to 4.
Re: (Score:2)
Re:OpenDNS Guide (Score:5, Informative)
They're tracking by the cable modem's MAC address. There's a page explaining this (and how it's insecure) here:
http://rgov.org/road-runners-dns-wildcard [rgov.org]
Re:OpenDNS Guide (Score:4, Funny)
Yeah, yeah, I know. Cleveland's the last place to get everything new.
Re:OpenDNS Guide (Score:5, Insightful)
Re: (Score:2)
"Sorry this service is not available at this time.
Back to www.rr.com
"
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
Actually, OpenDNS is even worse! (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Can't say routinely type in the www for any website - and get frustrated with the few sites that bork when you skip it. Nonetheless, the firefox search bar sends queries to www.google.com so this would hit quite a few folk if they use opendns.
Re: (Score:3, Interesting)
Thanks for the heads up. I've just removed OpenDNS from my router's configuration. My ISP's DNS sucks but there are some caching servers at work I can piggyback on.
I wonder if this OpenDNS business explains the error page I've been getting with increasing frequency from Google, something to the effect of my query looking like it came from malware on my computer.
Re:Actually, OpenDNS is even worse! (Score:5, Informative)
Re:Actually, OpenDNS is even worse! (Score:5, Informative)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Just curious, but would you feel better if they appended an element to the page to give you a little message saying you typed the URL wrong?
Good question. The answer is that I would be more likely to recommend OpenDNS to less technical people who don't know how to setup a local DNS cache. For me, I want vanilla DNS that will give me the straight dope, none of this fuzzy DNS B.S. In other words, I won't use DNS servers that don't give accurate forward lookups, no matter their intentions.
Re: (Score:3, Informative)
If you're running a mail server or for any other reason want it turned off, just email contact at opendns dot com with your username and tell them you want it turned off.
-david
Re:OpenDNS Guide (Score:5, Informative)
Re:OpenDNS Guide (Score:5, Interesting)
Suspiciously, however, I didn't turn off the "service". Someone at the other end did it. I refused to give them my phone number, so either they used caller ID to pull up my account without my consent, or they blacked out my cable modem MAC when I started portscanning the server and looking up a hundred variations of www.stopfuckingwithmydnsroadrunnersucksdogballs.com.
All around evil. Cable companies are doing this to boil the Net Neutrality frog, have no doubt about it.
And? (Score:3, Informative)
Re: (Score:2, Funny)
Re:And? (Score:4, Insightful)
Re:And? (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:3, Informative)
Re:And -- Advertising revenue (Score:3, Insightful)
Here's why: (Score:5, Insightful)
However, there is one instance where this issue matters right now: a lot of site monitoring still relies on pings or basic server lookups to figure out whether the server is up and running. This feature would immediately screw with that kind of monitoring. Basically, you cannot assume anymore that because a dns lookup or a ping returns a positive result that the server with that hostname is actually alive or in the DNS tables. Yes, there are ways around that, but it basically breaks one of the central tenets of the internet: the intelligence is on the edge of the network, and everything in between is just a packet forwarder.
More significantly though is that it redirects a user to a place that wasn't requested. Basically, it means that from a technological perspective, this no different than RR or Verizon taking my request to www.google.com and redirecting it to their own search page. See why this can easily become a very, very big deal? I can guarantee you that this is a trial balloon by the ISPs to see how users react to this. If this goes through, expect that at some point in the future, you will have to jump through hoops to get to the site you want, and not the site your ISP thinks you ought to want.
This is another problem that will most likely have to be enshrined in actual law: ISPs shall not take a request and redirect it elsewhere. The potential for and likelihood of abuse is just too large otherwise.
Welcome to the intelligent network. It'll be a nightmare.
Good thing I'm with Comcast not TW (Score:5, Funny)
Re: (Score:2)
but it doesn't matter how slow my torrents run, if I am running a bittorrent client unencrypted, my Time Warner connection always ground to a halt. I just canceled with Time Warner and switched to U-Verse. The guy on the phone told me "just be sure I bring that modem back whenever it's convenient". When I did five days later, the idiot at the desk told me she was going to change the date I disconnected to the day I returned the stupid modem. Even though the service did not work this week because
DFW (Score:2)
And this is new? (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Just noticed that somebody has already registered jkshdfkljh23sadf.com. Way to go Mr. Private, Registration...
Re: (Score:2)
What's next? (Score:5, Funny)
Re:What's next? (Score:5, Funny)
Brilliant! (Score:2)
Re: (Score:2, Informative)
Lest anyone think this demonstrates that Road Runner is intentionally blocking Google, the trick here is that you can arbitrarily edit the string after ?origURL= to produce a page describing any website couldn't be found.
Been at least a month (Score:2)
Squatting www.jkshdfkljh23sadf.com (Score:5, Funny)
Re: (Score:2)
I actually laughed when one of them served an ad titled "Learn how to type".
Too late (Score:2)
Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: JKSHDFKLJH23SADF.COM
Created on: 26-Feb-08
Expires on: 26-Feb-09
Last Updated on: 26-Feb-08
My ISP does this too (Score:5, Insightful)
Re:My ISP does this too (Score:4, Interesting)
So... I simply blacklisted Charter's redirection site in my firewall and proxy server.
Re: (Score:2)
This would be fine... (Score:3, Insightful)
... if it were opt-in and not opt-out. I would like to think that the majority of Internet users who don't use Slashdot have no idea about what actually happens when you type in www.dlibert.com, for example.
Send an e-mail to your subscribers and let them enable the feature if they so desire, but don't force it on your userbase.
You said it yourself... (Score:3, Insightful)
One of the things most Internet Service Provider customers are paying for is... well, service. While I'm sure most of the Slashdot audience finds this service annoying, for MOST people on the internet, the resulting page is probably better for them than a blank error page.
And, opt-in is a lousy way to institute change. If you make the change, and let people opt out, everyone who the change helps will get it and everyone who doesn't like the change will opt-out, at the cost of the inc
Interception, first down! (Score:4, Interesting)
But it's still nowhere near as worthwhile as the "what you want, when you want it" domain squatter pages where most of the links are porn and ads. Catch up, Roadrunner!!
ATT does it as well (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
Would you know the difference? (Score:4, Funny)
Are there failed DNS requests any more? I'd thought every combination of characters had its own ad farm by now. If the last few unused ones now also direct to some random ads, I doubt I'd even notice.
Who clicks on those things, anyway? You land on ebaaaaaay.com when your 'a' key sticks and think "Yes, I do want a beautiful Russian bride!"?
QUICK (Score:2, Funny)
Verizon FIOS does the same in No VA (Score:4, Informative)
Re: (Score:2)
Don't care, I have my own DNS server (Score:2, Interesting)
The Site Finder stunt NetSol/Verisign pulled a few years ago, that was done on the root servers, wasn't it? That was a lot more disruptive than an ISP creating a catch-all DNS zone on their little DNS boxes.
In the grand scheme of things (Score:2)
Re:In the grand scheme of things (Score:5, Insightful)
I have FiOS at home and luckily VZ has an opt out if you want to go configure your DNS manually in your router.
Didn't a registrar do this? (Score:2)
Re:Didn't a registrar do this? (Score:5, Informative)
There was. What TW's doing is more pernicious, though. When NetSol was doing it, they were returning the A records directly from their first-level nameservers. BIND's no-delegation option can deal with that, because those first-level nameservers aren't supposed to be returning A records and BIND can translate those response into proper NX responses. With TW, since their DNS servers are supposed to be returning A records, there's no way to tell whether a particular affirmative response is valid or invalid. The only way to fix the problem is to cut TW's servers out of the loop entirely. All well and good, until of course TW either starts blocking all traffic to port 53 that's not to their DNS servers (like they do with outbound to port 25 now) or silently redirecting all DNS queries to their servers. Note that both of these are trivial, my own firewall has (commented-out) rules for both and neither takes more than about 3 lines.
Yet another one (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Didn't know about monitoring bitorrents though. (I don't have Tivo, and so the option to view a missed show is attractive.) I suppose this isn't illegal... although it does feel a lot like wiretapping.
I wonder if Verizon FIOS is any better in terms of privacy. (Comcast, the only other non-dial up option isn't even up for debate.)
Same for Dallas Market (Score:2)
HAHAHA (Score:5, Informative)
Re: (Score:3, Insightful)
Verizon Fios does it too apparently... (Score:2)
Charter's doing it too (Score:3, Informative)
RFCs (Score:2)
Re: (Score:2)
Call and complain (Score:2)
Oh, wait, they have a government granted monopoly. My only alternatives are slow and really slow.
Call and complain to your elected representati
There's no ethical reason to do this (Score:2)
But what does the average user do? Do they properly question the website they are on? Do stop and go back and try another site? Not all of them. Many will start clicking on these links, waste time, and be led in circles. They migh
Cache this (Score:2)
All your errors belong to us (Score:2)
OK, what's the IP address of the ad site they send you to? Add that to block lists.
And then there was no one left. (Score:2, Funny)
and I didn't speak up,
because I didn't use news groups.
Then they came for the torrenters,
and I didn't speak up,
because I didn't torrent.
Then they came for the bandwidth hogs,
and I didn't speak up,
because I wasn't on Comcast.
Then they came for my dns,
and by that time there was no one
left to speak up for me.
Bundling Abuse Should Lead to Breakup (Score:2)
The Internet is not HTTP (Score:5, Insightful)
Sigh, and for those who still don't get it: HTTP is what your web browser uses to get web pages.
All those who are spouting "it's useful" or "I don't understand what the fuss is" or "why can't they do it?"... you simply don't understand the issues and shouldn't be commenting.
Re: (Score:2)
Any time a combined bittorrent upload of mine exceeds 30 KBPS, my modem mysteriously jams up.
Check your airflow.. it's probably overheating. Try putting an external fan blowing into the air vents and see if it stops doing that.
Re:Even happening with Lynx (Score:5, Funny)
Re: (Score:2, Informative)
Re: (Score:2, Insightful)
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
Re:So? (Score:5, Informative)
The problem here is that what TW is doing breaks DNS. By the RFCs, when I try to resolve a name that doesn't exist, I'm supposed to get an NX "record does not exist" result. What I get instead is an affirmative A record "name exists at this address" response. What happens at the browser level is irrelevant, TW's DNS system has already lied about the state of the DNS records associated with a given domain. This badly breaks a lot of things that aren't browsers that use HTTP and depend on correct NX responses to tell them when the server they're trying to talk to doesn't exist.
As long as TW doesn't block direct use of non-TW DNS servers this can be worked around. If they start blocking that access, or redirecting all DNS traffic to their servers, then we've got a major problem on our hands.
Re:So? (Score:5, Insightful)
Say you've got a program on an embedded device that automatically downloads updates. It retrieves "http://updates.devicecompany.com/model/latest-firmware.txt" to check what the latest offered version of the firmware is, and if the latest is greater than what's installed it retrieves "http://updates.devicecompany.com/model/firmware-.dat" and installs it. If the company goes out of business or stops providing updates, updates.devicecompany.com won't resolve anymore or will return a 404 error, so the device doesn't need to do a whole lot of error checking. And error checking means more code, which means more memory needed to hold that code, and this device is designed to be as cheap as possible so it omits anything it doesn't need.
Now, suppose the company goes out of business. No problem for the device, the host it's at is supposed to not resolve anymore so it won't try to contact it. But now TW intervenes. Instead of failing to resolve or getting a 404 error, the grab of the latest firmware version returns garbage (an HTML page, not a properly formatted indication of the latest firmware version). Bam, device crashes. Or worse, it misparses the results and tries to download new firmware. Again, garbage (HTML page) instead of a valid firmware image. But since there's no error checking, it tries to load that HTML page into memory as a firmware image. Bam, one insta-brick.
Or suppose the device isn't even using HTTP. The DNS servers don't know what protocol the device intends to talk, it could be logging into an FTP server or querying data via SNMP for all TW knows. The application gets bogus DNS responses anyway, even though it's not using HTTP or the Web at all. Breakage is the least problem here. The application's sending things like passwords up to the server. Even if it uses SSL to protect against eavesdropping, the TW server is an endpoint and SSL won't stop the endpoint from seeing the data. Do you want to have applications handing your vendor-support-site passwords over to TW because of a typo in a hostname? I sure don't.
This isn't a problem when it's a human running a browser looking at pages. But there's a large chunk of traffic that isn't humans, isn't a browser, and isn't using the Web at all. And TW's change breaks everything except that small, select chunk that's humans looking at a browser window. Bad thing, that.
Re: (Score:3, Insightful)
It breaks spam blocking.
1) One thing that spammers will do is send e-mail with a fake domain in the envelope sender field. My server checks this, and if it resolves, then that's one less tool I can use.
2) Another thing is checking a blocklist. IP address blocklists are queried using the IP address as part of a DNS lookup. Guess what happens when all of them resolve?
It also typosquats my domains (and every other business's domains) in a very non-ethical