HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox

kiokoman

bind9

$TTL 60
@            IN    SOA  localhost. root.localhost.  (
                      2019091601
                      3H  ; refresh
                      1H  ; retry
                      1W  ; expiry
                      1H) ; minimum
              IN    NS    localhost.

; Make TRR unavailable
dns.adguard.com 120 IN CNAME  .
dns-family.adguard.com 120 IN CNAME  .
dns.google 120 IN CNAME  .
cloudflare-dns.com 120 IN CNAME  .
dns.quad9.net 120 IN CNAME  .
dns9.quad9.net 120 IN CNAME  .
dns10.quad9.net 120 IN CNAME  .
doh.opendns.com 120 IN CNAME  .
doh.cleanbrowsing.org 120 IN CNAME  .
dns.nextdns.io 120 IN CNAME  .
dns.dnsoverhttps.net 120 IN CNAME  .
doh.crypto.sx 120 IN CNAME  .
doh.powerdns.org 120 IN CNAME  .
doh-ch.blahdns.com 120 IN CNAME  .
doh-jp.blahdns.com 120 IN CNAME  .
doh-de.blahdns.com 120 IN CNAME  .
dns.dns-over-https.com 120 IN CNAME  .
doh.securedns.eu 120 IN CNAME  .
dns.rubyfish.cn 120 IN CNAME  .
doh-2.seby.io 120 IN CNAME  .
doh.seby.ie 120 IN CNAME  .
commons.host 120 IN CNAME  .
doh.dnswarden.com 120 IN CNAME  .
dns-nyc.aaflalo.me 120 IN CNAME  .
dns.aaflalo.me 120 IN CNAME  .
doh.appliedprivary.net 120 IN CNAME  .
doh.captnemo.in 120 IN CNAME  .
doh.tiar.app 120 IN CNAME  .
doh.dns.sb 120 IN CNAME  .
rdns.faelix.net 120 IN CNAME  .
doh.li 120 IN CNAME  .
doh.armadillodns.net 120 IN CNAME  .
doh.netweaver.uk 120 IN CNAME  .
jp.tiar.app 120 IN CNAME  .
doh.42l.fr 120 IN CNAME  .

i can change the dot to some "out of thin air ip" if i want to log, reporting NX for the moment

laboratorio@server:/$ dig @127.0.0.1 doh.crypto.sx

; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> @127.0.0.1 doh.crypto.sx
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10547
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: dda6e2c23949f6cda855e6485d7fa7fddeb8459af20d8f8b (good)
;; QUESTION SECTION:
;doh.crypto.sx.                 IN      A

;; ADDITIONAL SECTION:
overrides.              60      IN      SOA     localhost. root.localhost. 2019091601 10800 3600 604800 3600

;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Sep 16 17:19:25 CEST 2019
;; MSG SIZE  rcvd: 129

johnpoz

Only reason pointed it to an IP, is I normally don't log dns queries - there are so freaking many of them it can be information overload to weed through... I only enable dns query logs when wanting to troubleshoot a specific issue.

Figured if I point it to a specific IP, I can log any attempted access to that odd IP so can see at a glance in the firewall interface if any hits to it. And then investigate..

Multiple ways to skin the cat is best, so no matter what what users are using specific in there setups they have a easy way to skin this one..

These little devices could bypass these method with a direct query to the IP.. So prob need to put together an alias that lists the actual public IPs and blocks.. This is going to turn into such a shit show..

Uncontrolled circumvention of a local networks controls is not by any stretch of the imagination good for anyone!

JeGr

Was just shown this by colleague: https://bsd.network/interact/102767562311572315
Had to laugh ;)

Repo

This resolver now points to https://mozilla.cloudflare-dns.com/dns-query instead of https://cloudflare-dns.com/dns-query

JeGr

@JeGr said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

canary

But the canary stayed the same, so that should already disable it.

NollipfSense

I have been reading this thread and have added the list found in the link that BBcan177 provided above to DNSBL. However, where is the about:config mentioned by Jim so I can set network.trr.mode to 5? This is what I saw in Firefox preference:
Screen Shot 2019-10-06 at 1.05.22 PM.png

johnpoz

in the about:config section

NollipfSense

@johnpoz Thanks John for responding...it seems that Macs don't have that options...I am using Firefox 69.0.2...

Screen Shot 2019-10-06 at 2.33.59 PM.png

johnpoz

I don't have a mac to test with.. But your at about:preferences not about:config?

No you wouldn't find it there - see I went there in my windows firefox

NollipfSense

@johnpoz Found it John...one has to type about:config in the URL bar and accept the risk...thank you!

Screen Shot 2019-10-06 at 3.01.32 PM.png

HuskerDu

I've just tried the unbound custom option... it seems Firefox keeps asking for its DoH stuff, Suricata seeing some associated traffic.

1	TCP	A Network Trojan was Detected	10.X.X.X 51133	104.16.249.249 443	1:2027695 ET POLICY Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)

johnpoz

Did you set TRR in firefox to 5? Without some details of what you actually did there is little anyone can do to help you find out what you did wrong.

You need to make sure unbound return NX..

I watch this like a hawk and have rules in place to log any sort of doh to any of the know ns doing doh, and block tos - and have not seen any hits on the rules at all.

HuskerDu

The purpose was to test the usage that Firefox makes of its canary domain and if it obey their published rules.

First of all, the status is NOERROR not NXDOMAIN

; <<>> DiG 9.10.6 <<>> use-application-dns.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27411
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;use-application-dns.net.	IN	A

;; ANSWER SECTION:
use-application-dns.net. 60	IN	A	10.10.10.1

;; Query time: 45 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Tue Nov 26 21:31:02 CET 2019
;; MSG SIZE  rcvd: 68

TRR was 2 as it was the intend of that quick test.

johnpoz

Well that is not how canary is meant to work - so yeah it would fail... It needs to return NX..

https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet

You returned no error and A record... So yeah its going to be able to use doh.

HuskerDu

I've changed

local-zone: "use-application-dns.net" static

to

local-zone: "use-application-dns.net" always_nxdomain

And it now works

; <<>> DiG 9.10.6 <<>> use-application-dns.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58414
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;use-application-dns.net.	IN	A

;; Query time: 37 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Wed Dec 04 20:16:56 CET 2019
;; MSG SIZE  rcvd: 52

Well kind of, Suricata keeps logging the same alert (ET POLICY Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI))

johnpoz

@HuskerDu said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

cloudflare-dns .com in TLS SNI)

Who says that is firefox? That could be some malware/trojan you have on your network.

I see zero hits to 1.1.1.1 or 1.0.0.1, so firefox wouldn't doing it.. Unless your client not using pfsense for dns, and not seeing the nx for the canary..

HuskerDu

This only happens when I launch Firefox from the machine which generates an alert in Suricata. No worms/trojans and co, it only happens when :

Firefox is set to use DNS over HTTPS
Firefox is launched

My firewall rules only allow DNS to pFsense (including NATing 8.8.8.8:53 towards the firewall for Android devices.... whatever you are telling them, they keep checking "Internet connectivity" on that).

Interestingly, it is not hitting 1.1.1.1 but 104.16.249.249. Maybe the anycast IP is used for marketing purposes but not always used in real life traffic ?

johnpoz

@HuskerDu said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

104.16.249.249

https://community.cloudflare.com/t/dns-over-https-using-https-104-16-249-249-dns-query

motific

I skimmed the comments and didn’t see any mention of this...

I’m now seeing IOS devices trying to connect out to google DoH servers.

For now I’ve just blocked Google’s DoH infrastructure but it looks like we’re on the cusp of a technological arms-race.

johnpoz

@motific said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

looks like we’re on the cusp of a technological arms-race.

Yup!! Its going to be interesting to be sure.. I think this is is an understatement to be sure. But I really do not think its the place of applications to try and circumvent local dns no matter if their intentions are good or not..

Unless the user of said application be it a browser or any other application specifically sets this application to use some dns be it direct or doh or dot, the application should use the OS set dns..

I am not a fan of the browser using anything other than what my OS is set to use for dns, without my explicit validation to do so.. It for sure its an arms race to have users dns point to a specific location.. I have no problem with the browser offering the ability to do doh or dot.. But its not something the application should just assume - it should have to be called out to do such things by the person running the application.. If they want to default the application to do such a thing it should be a clear op in sort of thing.. There is no scenario where opt out makes any sense - and opt out is a bad thing for sure..

This goes for any sort of device or application - you should use the dns handed you via dhcp, or set by the user in the os or device. Circumvention of this in anyway is violation of user choice! If the user wanted to use xyz for dns - then they should set that be it on the device/application specifically or what they hand out via dhcp..

Using the excuse that the user is too stupid to set this, and we are going what is best for the user is just nonsense!! And just looking to grab information from the users too stupid to know what is going on. Even IF!!! this was being done with the best of intentions - which it is not.. Its the wrong way to go about it.. Education of the user is the correct way!! Let the user chose and set what they want to use..