Which security risks are associated with alternative DNS providers?

Question

I'm considering using an alternative DNS provider on my computer. Which risks do I run if I use one?

I already know that the DNS provider may return a malicious IP address when I'm trying to access google.com for example, leaving me under the wrongful impression that I've reached Google. I'm currently assuming that SSL traffic is safe because I'd get a security warning. Anything else I should be keeping in mind?

There's a really nice article by Melissa Elliot (aka. 0xabad1dea) on Veracode's blog that sums up the dangers of 3rd party DNS quite nicely. It's rather cutesy and is mainly aimed at semi-techies, but it does a great job of illustrating both the problem and a common attack vector. — Polynomial, Nov 05 '12 at 21:21
Moral of that story: don't install root certificates if you're not really, really sure what you're doing? — Pieter, Nov 06 '12 at 10:21
Privacy is also an issue. I would point out that your ISP may be just as bad as another 3rd party DNS. Personally I run my own server. — ewanm89, Nov 06 '12 at 10:22

score 8 · Accepted Answer · answered Nov 05 '12 at 19:00

In addition to the risks that you've noted about being returned, it's possible that access to SSL sites could also be jepordised in this scenario in a couple of cases.

If you access any SSL sites who don't use correctly issued certificates it would be difficult to differentiate between the invalid certificate warning you usually get and the one that you're getting with a malicious DNS provider
If the attacker is able to get access to a CA certificate that your browser trusts they would be able to MITM SSL connections without this being obvious. This scenario is only likely in the case of high-end attackers (e.g. government level) who can either compromise a a CA or persuade one to issue a CA certificate.

That said if you're generically looking for an alternate DNS provide you could consider Google public DNS depending on how much you trust Google, this could be a good option.

Expanding on that first point: this would only be the case on websites that already trigger a security warning in my browser, right? I haven't added any exceptions. — Pieter, Nov 05 '12 at 19:43
Yes I'd say so, if you're not currently getting a warning and you start getting one on the new provider that could be an indication that the host record for that site had been changed. Even with the one's you're getting a warning with it would still be possible to detect the change, as the certificate would be different but you'd have to have manually noted the SSL cert information on the original host before you changed DNS and then check each warning afterwards to see what (if anything) had changed. — Rory McCune, Nov 05 '12 at 20:23

Which security risks are associated with alternative DNS providers?

1 Answers1

Related