Geek


21
Jul 08

Rogers DNS Hijacking – A Summary So Far

Over the last few weeks we’ve seen Rogers pull some incredible stunts. Between the iPhone, Data Plans, and Funny Teaser Campaigns, Rogers has managed to get quite a bit of pie on its face. Nothing trumps that however as much as the recent reports that Rogers is redirecting invalid domain names to their own search page with custom advertisements. There’s a lot of confusion about what this is and how it works so I thought I’d summarize some of it here so that we can clear it up.

Rogers is redirecting traffic from invalid domains to its own search page. This doesn’t involve deep packet inspection, it simply means they’ve configured their DNS servers so that if you mis-spell the domain name in your browsers address bar you’ll go to a different site. DNS is a service that all ISP’s will run, and for the non-technical folk the process goes a little something like this (and for the technical please disregard my brushing over of the issue)

Every computer on the internet has a number, from 1-4 billion or so. When you type an address into your address bar and hit ‘go’ your computer will say “Do I know where that is already?” and if it doesn’t, it will ask a different computer, or DNS (Domain Name Server) for the number of the computer you want to visit. Every single time you type an address into your browser or click on a link this is what happens. For more information on how DNS really works go here (beginner), here (intermediate) or here (youalreadyknow).

Now, what normally happens when you type an invalid or non-existant domain name into your browser, the DNS server will return a special code that says ‘Theres no answer for this name’, and you just get a notification in your browser. Type in “http://example.co” using Firefox and you’ll get something that looks like this:

This is how DNS works, and how the browser is setup to respond to the message that says ‘Theres no answer’. Clear as mud? Lets move on.

The DNS servers that Rogers operates are doing something special. When your computer asks where ‘example.co’ is, the server won’t respond back saying ‘Theres no answer’, but will actually give you the answer containing the name of a server that belongs to Rogers. It will also do something speecial – It will build a page for you that contains links based on keywords of your domain. So if you typed in ‘search.example.co’ while using a Rogers DNS server, you’ll get a page that looks like this:

This does several things. For one it breaks the way DNS is supposed to work (and coincidentally the way some applications work), and it also violates some concepts regarding Network Neutrality. It represents a way for ISP’s to squeeze out as much value from their end-users as possible, and as John over at Blamcast writes it puts ads on invalid subdomains as well. This means that if you type in maill.google.com it will print up an ad on Rogers servers using Yahoo’s search feature.

I talked to some iPhone users and while they use Rogers, this doesn’t seem to be taking place on the 3G network’s DNS servers. I dont have those IP addresses so I can’t test it out myself. (Does anyone have that info kicking around?)

A couple companies also do this. A “feature” in IE8 is address-bar searching which is effectively the same thing. When you type an invalid domain into the address bar, it will direct you to Microsoft’s search page with results that suggest what you may have meant – and an ad or two of course.

Verizon also did this a few years ago with something called Site Finder but it ended rather quickly due to criticism.

Update: Parkerjon writes with information about an alternative Rogers DNS server, Here is the information

altdns.rnc.net.cable.rogers.com
64.71.255.202


16
Jul 08

Popurls Replacement

I’ve got a subversion repository full of projects that are essentially ‘proof of concept’ hacks and I’m fucking tired of seeing them in there. Lots of them were ideas I have while doing systems administration. Some of them are goddamned atricous (but functional!) perl programs I wrote for graphing NetFlow statistics, and for visualizing BGP routing. They all worked but I kept them to myself and they were forgotten.

One proof of concept hack I’m going to flesh out is this quick rails app, that with some initial groundwork laid out by Anis, is essentially another RSS reader. Actually its just an unapologetic Popurls ripoff, but I had a good reason for doing it. I like the popurls layout and the concept: Being able to see all the latest ‘buzz’ in one spot. The issue is that none of that information is at all important, but for some reason hitting refresh is really pleasurable. Who cares what the people on Digg and Reddit are saying. Fuck you. I want to know more about Cloud Computing, Cooking, and Sailing, and I want to be able to digest that information with a glance – not browse through it site by site, category by category. Bah! (Its still a long way off from what I *really* want but more on that later)

Anyway, here’s a screenshot. Once I’ve setup OMPL imports, User Accounts and fixed the Background Processing chunk I’ll release version 0.0.1 to the public.

Note: I acknowledge the total uselessness of Slashdot, and I don’t read Al Jazzera – I was just seeing if it would work. I dont know what those words are.

Update: I’ve checked some rudimentary code into GitHub.


14
Jul 08

Supernerd Geek Moment – Cisco Nexus 7000

This is the most gorgeous piece of network gear I’ve ever seen, and I didn’t know data centers were entered in beauty pagents. It’s the Cisco Nexus 7000. Sounds like a mainframe. Looks like a mainframe. Dispenses coffee and packets.


3
Jul 08

Data Transparency and Queries

Yesterday after speaking with Brendon Wilson I thought more about my old screen scraping scripts I had lying around. Taking a look at them reminded me of a few posts I’d written on the subject of being able to pull data out of services using semantic stack technologies, as well as the concept of data transparency. Specifically I scraped a whole bunch of names and profile URL’s out of a poplar professional networking website. The whole thing is listed in some nested pages in alphabetical order. It was simply a matter of getting the script to build the list of pages to crawl, then pointing a scraping function at those URLs to pull the names out. The time to get the data was about one hour, and it probably could have been done a lot faster if I’d forked the process of fetching pages into multiple processes but I’m getting off topic.

The real point is that the data is there – out in the open. The real question is how you get that information. What if all I want to know today is how many profiles exist in Facebook, MySpace, or LinkedIn? Shouldn’t that be something that you could find out easily? What if I want all the names? You can do it, you just have to effectively download the whole site then scrape it. Kind of a waste of resources but possible. What if I want something less ‘Privacy invading’? What if I just want to know the total number of comments on a website? I want my Sparql queries!

Obviously some data will be sensitive. Social networks might not want to give out your information because users will complain, but for data that isn’t so “privacy invading” it should be easy to get.