Changes

Page history
Apply conversion script to all *.md files. authored by Alexander Hansen Færøy's avatar Alexander Hansen Færøy
Show whitespace changes
Inline Side-by-side
doc/DNSHijacking.md
View page @ a1a4b621
What's '''DNS hijacking?''' What's **DNS hijacking?**
[https://secure.wikimedia.org/wikipedia/en/wiki/DNS_hijacking DNS hijacking] is [DNS hijacking](https://secure.wikimedia.org/wikipedia/en/wiki/DNS_hijacking) is
the act of an [http://en.wikipedia.org/wiki/Internet_service_provider ISP] redirecting resolution of hostnames to other servers, usually the act of an [ISP](http://en.wikipedia.org/wiki/Internet_service_provider) redirecting resolution of hostnames to other servers, usually
for advertising purposes. The use of DNS hijacking hurts Tor exit-relay for advertising purposes. The use of DNS hijacking hurts Tor exit-relay
quality. Tor attempts to detect and compensate, however it is not always quality. Tor attempts to detect and compensate, however it is not always
possible. The best solution is to disable the hijacking or switch to a possible. The best solution is to disable the hijacking or switch to a
different Public DNS resolver, or use your own DNS server. different Public DNS resolver, or use your own DNS server.
[[TOC]]
= Solutions =
== Opt-out == # Solutions
## Opt-out
Some ISPs and DNS providers let you disable DNS hijacking. Below is a list of Some ISPs and DNS providers let you disable DNS hijacking. Below is a list of
such ISPs: such ISPs:
* [http://dns-opt-out.comcast.net/help-index.php Comcast] * [Comcast](http://dns-opt-out.comcast.net/help-index.php)
* [https://www.opendns.com/support/article/312 OpenDNS] * [OpenDNS](https://www.opendns.com/support/article/312)
* [http://www.optimum.net/Article/DNS#btnBlue Optimum Online] * [Optimum Online](http://www.optimum.net/Article/DNS#btnBlue)
* [http://service1.dnsassist.optusnet.com.au/search?qh=DNS%20hijacking&srh=optout Optus] * [Optus](http://service1.dnsassist.optusnet.com.au/search?qh=DNS%20hijacking&srh=optout)
* [http://foren.t-online.de/foren/read/service/browser/t-online-browser/neues-leistungsmerkmal-navigationshilfe,164,3808480,fid=84b72be.html T-Online] * [T-Online](http://foren.t-online.de/foren/read/service/browser/t-online-browser/neues-leistungsmerkmal-navigationshilfe,164,3808480,fid=84b72be.html)
* [https://service.upc.ie/pdf/DNS%20opt-out%20instructions.pdf UPC] * [UPC](https://service.upc.ie/pdf/DNS%20opt-out%20instructions.pdf)
* [https://www22.verizon.com Verizon] * [Verizon](https://www22.verizon.com)
== SSL == ## SSL
Encrypted, authenticated DNS ideas (ISPs cannot intercept): Encrypted, authenticated DNS ideas (ISPs cannot intercept):
* [https://www.privacyfoundation.de/wiki/HTTPS-DNS HTTPS-DNS] * [HTTPS-DNS](https://www.privacyfoundation.de/wiki/HTTPS-DNS)
* [https://www.privacyfoundation.de/wiki/SSL-DNS SSL-DNS] * [SSL-DNS](https://www.privacyfoundation.de/wiki/SSL-DNS)
== Setup your own DNS server == ## Setup your own DNS server
* [wiki:"TheOnionRouter/BIND" BIND] for [http://en.wikipedia.org/wiki/Linux Linux]. * [BIND](./"TheOnionRouter/BIND") for [Linux](http://en.wikipedia.org/wiki/Linux).
* Use your own '''DNSSEC''' supported [wiki:doc/DnsResolver DNS server] or resolver, or, use trustworthy external DNSSEC supported recursive/caching DNS Server. Few DNSSEC supported DNS Server software are: BIND, Unbound, GbDns, etc. * Use your own **DNSSEC** supported [DNS server](./doc/DnsResolver) or resolver, or, use trustworthy external DNSSEC supported recursive/caching DNS Server. Few DNSSEC supported DNS Server software are: BIND, Unbound, GbDns, etc.
== Public DNS (resolver) servers == ## Public DNS (resolver) servers
If opting out is not feasible, there are public DNS servers you can use for If opting out is not feasible, there are public DNS servers you can use for
free. Below follows some services and IP addresses: free. Below follows some services and IP addresses:
=== [http://www.level3.com/ Level 3] / GTEI (Now owned by VERIZON) === ### [Level 3](http://www.level3.com/) / GTEI (Now owned by VERIZON)
* 4.2.2.1 * 4.2.2.1
* 4.2.2.2 * 4.2.2.2
* 4.2.2.3 * 4.2.2.3
...@@ -45,21 +45,21 @@ free. Below follows some services and IP addresses: ...@@ -45,21 +45,21 @@ free. Below follows some services and IP addresses:
ISSUES: Verizon publicly known for manipulating, filtering, redirecting DNS answers. ISSUES: Verizon publicly known for manipulating, filtering, redirecting DNS answers.
=== [http://www.opennicproject.org OpenNIC] === ### [OpenNIC](http://www.opennicproject.org)
* [http://wiki.opennicproject.org/Tier2 List of servers] * [List of servers](http://wiki.opennicproject.org/Tier2)
* Find DNS server from OpenNIC site, which has disclosed that it does not do any form of Redirect and does not keep log, and does not store records, and does not store user's any information. * Find DNS server from OpenNIC site, which has disclosed that it does not do any form of Redirect and does not keep log, and does not store records, and does not store user's any information.
=== [https://code.google.com/speed/public-dns/ Google] === ### [Google](https://code.google.com/speed/public-dns/)
* 8.8.8.8 * 8.8.8.8
* 8.8.4.4 * 8.8.4.4
ISSUES: Google deletes IP address for a DNS query after 24 hours, but permanently stores ISP, location information for that DNS query. See [https://en.wikipedia.org/wiki/Google_Public_DNS Google Public DNS (wikipedia)] and check reference area. ISSUES: Google deletes IP address for a DNS query after 24 hours, but permanently stores ISP, location information for that DNS query. See [Google Public DNS (wikipedia)](https://en.wikipedia.org/wiki/Google_Public_DNS) and check reference area.
=== Other Public DNS Servers === ### Other Public DNS Servers
List of other Public DNS Servers are also available from: List of other Public DNS Servers are also available from:
* [wiki:doc/DnsResolver/PublicDnsResolvers Public DNS Resolvers] page. * [Public DNS Resolvers](./doc/DnsResolver/PublicDnsResolvers) page.
== Other DNS related articles == ## Other DNS related articles
* [wiki:doc/DnsResolver DNS Resolver] (in `[`wiki`:`doc/DnsResolver`]` (torproject.org), How to prevent any mis-configured app from (even accidentally) trying to resolve any .onion related DNS through direct internet). * [DNS Resolver](./doc/DnsResolver) (in `[`wiki`:`doc/DnsResolver`]` (torproject.org), How to prevent any mis-configured app from (even accidentally) trying to resolve any .onion related DNS through direct internet).
* [https://en.wikipedia.org/wiki/DNS_spoofing DNS spoofing/cache poisoning] (wikipedia). * [DNS spoofing/cache poisoning](https://en.wikipedia.org/wiki/DNS_spoofing) (wikipedia).
* [https://en.wikipedia.org/wiki/DNS_Security_Extensions DNSSEC] (wikipedia). * [DNSSEC](https://en.wikipedia.org/wiki/DNS_Security_Extensions) (wikipedia).