Rogers DNS Hijacking – A Summary So Far

Over the last few weeks we’ve seen Rogers pull some incredible stunts. Between the iPhone, Data Plans, and Funny Teaser Campaigns, Rogers has managed to get quite a bit of pie on its face. Nothing trumps that however as much as the recent reports that Rogers is redirecting invalid domain names to their own search page with custom advertisements. There’s a lot of confusion about what this is and how it works so I thought I’d summarize some of it here so that we can clear it up.

Rogers is redirecting traffic from invalid domains to its own search page. This doesn’t involve deep packet inspection, it simply means they’ve configured their DNS servers so that if you mis-spell the domain name in your browsers address bar you’ll go to a different site. DNS is a service that all ISP’s will run, and for the non-technical folk the process goes a little something like this (and for the technical please disregard my brushing over of the issue)

Every computer on the internet has a number, from 1-4 billion or so. When you type an address into your address bar and hit ‘go’ your computer will say “Do I know where that is already?” and if it doesn’t, it will ask a different computer, or DNS (Domain Name Server) for the number of the computer you want to visit. Every single time you type an address into your browser or click on a link this is what happens. For more information on how DNS really works go here (beginner), here (intermediate) or here (youalreadyknow).

Now, what normally happens when you type an invalid or non-existant domain name into your browser, the DNS server will return a special code that says ‘Theres no answer for this name’, and you just get a notification in your browser. Type in “http://example.co” using Firefox and you’ll get something that looks like this:

This is how DNS works, and how the browser is setup to respond to the message that says ‘Theres no answer’. Clear as mud? Lets move on.

The DNS servers that Rogers operates are doing something special. When your computer asks where ‘example.co’ is, the server won’t respond back saying ‘Theres no answer’, but will actually give you the answer containing the name of a server that belongs to Rogers. It will also do something speecial – It will build a page for you that contains links based on keywords of your domain. So if you typed in ‘search.example.co’ while using a Rogers DNS server, you’ll get a page that looks like this:

This does several things. For one it breaks the way DNS is supposed to work (and coincidentally the way some applications work), and it also violates some concepts regarding Network Neutrality. It represents a way for ISP’s to squeeze out as much value from their end-users as possible, and as John over at Blamcast writes it puts ads on invalid subdomains as well. This means that if you type in maill.google.com it will print up an ad on Rogers servers using Yahoo’s search feature.

I talked to some iPhone users and while they use Rogers, this doesn’t seem to be taking place on the 3G network’s DNS servers. I dont have those IP addresses so I can’t test it out myself. (Does anyone have that info kicking around?)

A couple companies also do this. A “feature” in IE8 is address-bar searching which is effectively the same thing. When you type an invalid domain into the address bar, it will direct you to Microsoft’s search page with results that suggest what you may have meant – and an ad or two of course.

Verizon also did this a few years ago with something called Site Finder but it ended rather quickly due to criticism.

Update: Parkerjon writes with information about an alternative Rogers DNS server, Here is the information

altdns.rnc.net.cable.rogers.com
64.71.255.202

Tags: , , , , ,

  • http://duanestorey.com Duane Storey

    It kind of sucks, but I don’t take huge offense to it. It would have been nice for them to state upfront that they were doing that. OpenDNS does something similar.

  • Kent Linkletter

    This has caused me trouble in my home network. When it tries to find other local computers, some software does a DNS lookup first and finds the Rogers redirect. This makes it impossible to use software like RemoteDesktop. Rogers should not be tinkering with something as fundamental as this.

  • slr

    “It kind of sucks, but I don’t take huge offense to it.”

    You don’t have a clear understanding the magnitude of this issue (and it wasn’t made clear in the post). They are not just redirecting ‘mistyped’ names…..they are redirecting all non-public domains. What does this mean? One example is that they successfully broke everyone’s VPN unless they were set up to point to a 3rd party DNS server. Every telecommuter using the Rogers DNS service (that they pay for), suddenly had ssh sessions ping, and applications etc simply stop working.

    The technology exists to exempt VPN traffic from this ‘hijacking’. They refuse to do so – or provide an alternate DNS server so that we who pay for the service can continue to use it.

  • Noel Quinn

    this is very offense to me .. i would type a word into my address bar and get a seach result ( mostly from msn live which i like .. now im getting redirected to rogers ad invested page and when i contact support there telling me … i have to fix it … but they broke it …what will they make you do next to get on line … mybe in the future you will have to log on and do 5 survey before you can use the internet … its getting to the point the the all mighty $$ is more inportant then the customer being right .. leave my browers alone and stop making me go to the sites you want me to ….

  • Strobey

    As a home user- I find their tactic overbearing, and on par with other malware browser hijackers. They should be at least ashamed of themselves for being so slimy – and at best they should stop the setup *OR AT LEAST HAVE A WORKABLE OPT OUT NOT REQUIRING A COOKIE*. If I want to search the internet I’ll go to a search engine of my choice thanks… and it won’t be one that is a blatant attempt to pull more money from my pocket. ROgers – you disgust me and have gone too far. I’m leaving.

  • Strobey

    It even somehow manages to hijack my mis-typed searched ON MY GOOGLE TOOLBAR. How can they get away with this?

  • http://www.gusgreeper.com gusgreeper

    holy crap thank you SO much for this!!! i am on shaw BUT two weeks ago my computer basically died, i asked retrocatcus what to do and took it to london drugs and it turned out it was my DNS thankfully they did not charge me a lot and told me i take good care of my machine which was nice, but still they never told me what a DNS blah blah etc is?? or why it happened or nothing just that some programs but they didn’t know which ones likely changed the settings. so now i have learned something and i hate this tech shit confuses the living CRAP out of me, so thanks again!!! :)

  • Parkerjon

    I got the following from an anonymous but embarrassed Rogers employee. They bowed to pressure (many larger companies complaining that their remote workers were affected): and that even poor Edward was harassed.

    Alternate DNS server that avoids the redirect:

    altdns.rnc.net.cable.rogers.com
    64.71.255.202

    Apparently the engineers warned the marketing types… but the suits didn’t listen.

    JP

  • Jaisne Blue Sexton

    @Parkerjon – how does one use this alternate DNS info? like how should one implement it? in case you need to know to answer, i’m indeed using a router (desktop plugged in, laptop used wirelessly). thanks!

  • http://www.kwpages.com Hemant

    Hi Guys,

    I am starting the Class Law Suite Against this.

    1. It takes of my mistyped keyword which i will never know what i typed wrong.
    2. It shows the ads which are adult ads.
    3. Enabling cookies would end up with my privacy compromise.

    I want a team of members to help this Force here on called “Rogers Force”

    Here we will have 2 options
    1 To stop them doing this
    2 We click on all the ads or creating a software that does 24/7 clicking the ads of the Rogers Publications would endup rogers losing there Advertiser Account with whomever it may concern.
    This would also make advertisers not to be with Rogers would again stop them from doing the DNS Hack

  • http://mywebsite Rob

    I’m really upset as a network administrator, we have no rogers connection what so ever on our network and now we have been infultrated with the rogers DNS redirector and I’m immencly frustrated because now I have 300 users asking me why we have rogers internet here when we’ve got a massive fibre pipe that has nothing to do with that filthy mess called Rogers communications…
    What the HELL!?!?!

  • Sean

    I started noticing this a couple weeks ago, and it pissed me off but didn’t surprise me in the least, knowing Rogers. I quickly switched to OpenDNS who, although they also supply ads on mistyped URLS, aren’t Rogers. I’m content as long as someone other than Rogers is benefiting from it.

    Parkerjon, that’s pretty cool that you were able to get that alternate DNS server from them. Regardless, I think I’m going to stick to OpenDNS solely based on their privacy policy: they purge your IP address from their logs within 2 business days.

    Who knows how Rogers handles all the information they collect on everybody’s web activity? Also, I have a question: if someone uses Rogers as their ISP but uses a non-Rogers DNS service, can Rogers still collect information on that person’s web activity?

  • http://trevoro.ca Trevor Orsztynowicz

    @Rob

    It might be worth your while to setup your own DNS service within your network environment. The only reason that your results would appear to have some type of Rogers influence is if you’re using their DNS servers.

    If you’re running a Windows shop then check out the DNS Administrator service, otherwise install BIND.

    I’m very interested in how your users are seeing this information if they ARENT using Rogers DNS servers. Please provide more information if that’s the case.

    Cheers,

    -T

  • Muso

    Ya know, it makes me think of organized crime. Rogers is like the Mafia. They do as they please, pay off the right people (CRTC) and get away with it. No accountability. So, a class action lawsuit is started. Who do you think will win? Rogers with their panel of Liars, i mean Lawyers, or the little guy. And even if you do win, how do you enforce a court order. You’ll be lost in the bureaucratic pile of paperwork. It’s a no win situation. I’m stuck here with Rogers (in Brampton). I have ZERO alternative for high speed. Bell doesn’t service this area, believe me, I’ve tried, begged, cried…. I can’t get alternative high speed.

    Here’s a thought…. with Rogers and their NEW imposed limits (oh, they were always there, but never enforced…) now I am paying EXTRA every month for a top tier service plan. If I go over 95 gigs (which I do! we have 4 students living here)) I pay $1.50 extra for each additional Gig up to a maximum of $25.00. Why not just say it like it is….. we’re upping your fees. Now it’s $75.00 a month for true unlimited instead of $50.00 like it was before. Now they are hijacking my browser and FORCING me to download EXTRA content through their redirects AT MY EXPENSE. Does this make sense to anyone else?? Make me pay more for my service and then hijack me to make me pay more again through extra content downloads that I didn’t ask for.
    Funny how if you’re 3 days late paying a bill, you get rude Rogers collectors calling for payment, but when their service is down or slow, that’s cool. They have no answer for that. Service out for 3 days and substandard for the rest of the summer but I still pay full $$. UP TO 10mps download. But never truly 10mps….. hey, 1mps is UP TO to 10mps, but they never claim sustained 10mps downloads. Once again, paying $$$ for substandard service, lies, deception, fraud, theft, (stealing my browser and $$ through redirects!!!!)

    It really does sound like organized crime to me. If anyone has any ideas how to stop it, TRULY stop it, then we have to get it going. Power in numbers. If enough people do something, maybe it will happen. Why can’t there be TWO cable companies servicing the same area? Oh, something along the lines of organized crime and territories…. I forgot there for a moment. Best to just shut up and get out the vaseline.

  • http://hummingbird604.com Raul

    I use Telus instead of Rogers as my internet provider, but this is something awful. Rogers has a way of screwing up their customers…

    BTW greetings from Mexico, Trevor! I haven’t seen you tweet much :)

  • Chris Kaknevicius

    Ridiculous. This was tried before by Verisign, and was eventually taken down due to all sorts of technical issues. Some software relies on failure of DNS to determine connectivity, server availability, etc. Some VPN issues have resulted in my needing to change my DNS entry, but I think its ridiculous that they enforce this on us by default and require us to make changes to fix it. I’ve been dealing with so many issues from Rogers, that this straw just might break the camel’s back.

  • http://jakebillo.com/rogers-dns-shenanigans-screwing-with-vpns-and-alternate-servers/ Rogers’ DNS shenanigans: screwing with VPNs (and alternate servers) | Bus error: Jake Billo’s weblog

    [...] I’ve done for now is listened to the accurate advice on trevoro.ca and changed my primary Rogers DNS server to an unadvertised IP address: [...]

  • Dan

    Rogers are not only doing it with invalid domains, but with domains that take a little bit of time to resolve… ie. domains that go to a server in New Zealand or even Europe. It seems that I get the Rogers ads about 80% of the time I try to connect to a NZ website, and about 40% of the time to sites I know are in Europe.

    It’s incredibly annoying, when you KNOW the site exists.

  • Jack

    I set my primary DNS to 4.2.2.2 and this problem goes away

  • Rob

    uh.. well not to be a jackass, but there are how many free dns services online?

    If you don’t like the ad’s on the free dns service and you know another dns server…

    Maybe i’m dumb, whats the problem again?

  • http://www.gastonl.com/2008/12/29/vpn-on-rogers-nightmare/ Nihil .:. [Buscando Nada - Looking for Nothing] » VPN on Rogers = Nightmare!

    [...] You can read the whole explanation and how to fix the problem from the blog trevoro.ca [...]

  • http://Website John

    It just goes to show that, despite what most people think, it is possible to suck and blow at the same time, Rogers does this quite regularly!

  • http://Website Nick

    Today Rogers has changed DNS for iPhone users. Search results page now appears. No one at Rogers technical support understood the problem. They even tried referring me to Apple.

  • Javis

    OpenDNS is definitely a good solution to avoid this Rogers DNS takeover. Another solution is to use the browser Firefox and then install this add-on: “NoRedirect”. It comes already configured to avoid Rogers DNS lookup and many others annoyers.

  • Javis

    OpenDNS is definitely a good solution to avoid this Rogers DNS takeover. Another solution is to use the browser Firefox and then install this add-on: “NoRedirect”. It comes already configured to avoid Rogers DNS lookup and many others annoyers.

  • Frank

    FYI Rogers 3G does not do the hijacking. We’ve been having issues with our VPN users not being able to resolve internal sites due to Rogers hijacking. Testing has proved it does not happen on 3G networks. Our solution is to use Googles name servers (8.8.8.8 and 8.8.4.4)

  • http://forum.canadianwoodworking.com/showthread.php?37685-Browser-Hijacked! browser hijacked

    Hijacking is so common, but this one almost seems humorous to me because they come out and say it. It’s really sad.

  • Alex

    If you don’t like it… don’t use it. If you CHOOSE to use it – don’t complain.

    You sound like a socialist (i.e. bum who feels victimized by all the evil companies)