ISPs Hijack Cloudflare/Google DNS Requests, Ending Site-Blocking Workarounds

When ISPs are instructed to block pirate sites, tampering with their own DNS records is often the weapon of choice. This type of blocking can be circumvented by switching to public DNS offered by companies including Cloudflare and Google. Tests carried on several ISPs in Malaysia this week reveal that requests to Cloudflare and Google public DNS servers are being hijacked and diverted to local ISP DNS servers.

From: TF, for the latest news on copyright battles, piracy and more.

dns-liarTo the average internet user, DNS translates a domain into an IP address to make browsing as simple and unintrusive as possible. Under the hood, DNS does just that and for the majority of people online, that’s good enough.

For those who work with DNS and understand how incredibly important (and beautiful) it is, the idea that DNS is something to be tampered with, so that the system effectively tells lies, steps over the line. Yet, thanks to the global site-blocking drive, DNS servers all around the world, in dozens of countries, constantly lie to those who use them.

Site-blocking programs dictate that, when ISP-operated DNS servers are asked to return the IP addresses for tens of thousands of ‘pirate’ domains, the IP addresses returned by those DNS servers (if any IP addresses are returned at all) will not be the correct ones. This means that the user cannot access the domain; not by this route at least.

Public DNS – Mostly Tamper-Free

Since most blocking measures are implemented by consumer ISPs that operate their own DNS servers, users who switch to public DNS servers operated by Cloudflare, Google, Quad9, and many others, can usually avoid ISP blocking altogether. There are some exceptions depending on country, and since all three of the above have been ordered to block a small number of domains, switching to their DNS servers won’t unblock every domain, just the overwhelming majority.

Pressure from the Motion Picture Association (MPA) to introduce pirate site blocking in Malaysia, led to its implementation under Section 263 of the Communications and Multimedia Act 1998. Requests to block sites are processed by the Malaysian Communications and Multimedia Commission (MCMC), which instructs local ISPs to prevent their systems “from being used in, or in relation to, the commission of any offense,” including copyright infringement.

MPA reports on Malaysia’s site-blocking program have painted a regular picture of success but, in common with other schemes reliant on DNS tampering at ISPs, users eventually discovered that switching to public DNS restores connectivity.

Reports emerging from Malaysia this week, affecting both Cloudflare and Google DNS, are much more concerning than ISP blocking or even blocking measures imposed on public DNS providers.

Public DNS Under Threat and Reportedly Hijacked in Malaysia

The Internet Monitoring Action Project (iMAP) monitors internet interference and restrictions impacting freedom of expression online in Cambodia, Hong Kong (China), India, Indonesia, Malaysia, Myanmar, Philippines, Thailand, Timor-Leste and Vietnam. The group uses the detection and reporting systems of the Open Observatory Network Interference (OONI) and this week reported a significant shift in Malaysia’s site-blocking program.

“It was detected through automated and manual testing on 5th August, that transparent DNS proxy redirecting of DNS queries to Google and Cloudflare public DNS servers has been implemented by two Malaysian ISPs Maxis and Time,” iMAP reports.

“Users that have configured their Internet settings to use alternative DNS servers, would have found that they are now unable to access websites officially blocked by MCMC and [are now] getting a connection timeout error.”

A brief technical summary from iMAP reveals what happens when users attempt to access sites using Cloudflare and Google DNS.

• On Maxis, DNS queries to Google Public DNS (8.8.8.8) servers are being automatically redirected to Maxis ISP DNS Servers;

• On Time, DNS queries to both Google Public DNS (8.8.8.8) and Cloudflare Public DNS (1.1.1.1) are being automatically redirected to Time ISP DNS servers.

“Instead of the intended Google and Cloudflare servers, users are being served results from ISP DNS servers. In addition to MCMC blocked websites, other addresses returned from ISP DNS servers can also differ from those returned by Google and Cloudflare,” iMAP warns.

Technical Problems, Technical Solutions

It’s worth highlighting the seriousness of these claims. Requests destined for Google and Cloudflare DNS are being rerouted to local ISPs, in a manner that indicates those companies are responsible for users ending up at the Malaysian Communications and Multimedia Commission’s IP address (175.139.142.25), rather than the website they requested.

In a nutshell, internet users cannot rely on their ISPs’ DNS servers to respond accurately, and can longer rely on third-party DNS to respond accurately either.

But if there’s one good thing about such aggressive blocking it’s this: like almost all efforts that rely on a technical solution to impose blocking, there is a technical solution to neutralize it.

Details are available from iMAP and apply to anyone wishing to improve their online privacy and security in general, not just those wishing to avoid their DNS requests being hijacked.

“Users that are affected, can configure their browser settings to enable DNS over HTTPS to secure their DNS lookups by using direct encrypted connection to private or public trusted DNS servers. This will also bypass transparent DNS proxy interference and provide warning of interference,” iMAP concludes.

Tacit Acceptance of ■■■■■■■■■■

Finally, it’s worth mentioning that Malaysia is no stranger to censorship and controlling access to information. Under the Printing Presses and Publications Act 1984, unlicensed use or possession of a printing press is still a crime. Site-blocking measures that go way beyond blocking pirate sites currently target thousands of websites.

The big question is whether asking countries that routinely block access to information, to add even more domains to already large lists, sends the right kind of message.

Worse still, is active participation taken as an endorsement of what some claim is a denial of fundamental human rights? Not to mention being an affront to DNS, the very thing that underpins the right to communication and the free exchange of information and ideas.

From: TF, for the latest news on copyright battles, piracy and more.

Major shifts at OpenAI spark skepticism about impending AGI timelines

De Kraker: “If OpenAI is right on the verge of AGI, why do prominent people keep leaving?”

The OpenAI logo on a red brick wall.

Enlarge (credit: Benj Edwards / Getty Images)

Over the past week, OpenAI experienced a significant leadership shake-up as three key figures announced major changes. Greg Brockman, the company's president and co-founder, is taking an extended sabbatical until the end of the year, while another co-founder, John Schulman, permanently departed for rival Anthropic. Peter Deng, VP of Consumer Product, has also left the ChatGPT maker.

In a post on X, Brockman wrote, "I'm taking a sabbatical through end of year. First time to relax since co-founding OpenAI 9 years ago. The mission is far from complete; we still have a safe AGI to build."

The moves have led some to wonder just how close OpenAI is to a long-rumored breakthrough of some kind of reasoning artificial intelligence if high-profile employees are jumping ship (or taking long breaks, in the case of Brockman) so easily. As AI developer Benjamin De Kraker put it on X, "If OpenAI is right on the verge of AGI, why do prominent people keep leaving?"

Read 11 remaining paragraphs | Comments

All the possible ways to destroy Google’s monopoly in search

What the future of search could look like as DOJ seeks to end Google’s monopoly.

All the possible ways to destroy Google’s monopoly in search

Enlarge (credit: Aurich Lawson)

After US District Judge Amit Mehta ruled that Google has a monopoly in two markets—general search services and general text advertising—everybody is wondering how Google might be forced to change its search business.

Specifically, the judge ruled that Google's exclusive deals with browser and device developers secured Google's monopoly. These so-called default agreements funneled the majority of online searches to Google search engine result pages (SERPs), where results could be found among text ads that have long generated the bulk of Google's revenue.

At trial, Mehta's ruling noted, it was estimated that if Google lost its most important default deal with Apple, Google "would lose around 65 percent of its revenue, even assuming that it could retain some users without the Safari default."

Read 62 remaining paragraphs | Comments

macOS 15 Sequoia makes you jump through more hoops to disable Gatekeeper app checks

But nothing is changing about the kinds of software you can run on your Mac.

The Mac's Gatekeeper feature has been pushing developers to digitally sign their apps since it was introduced in 2012.

Enlarge / The Mac's Gatekeeper feature has been pushing developers to digitally sign their apps since it was introduced in 2012. (credit: Apple/Andrew Cunningham)

It has always been easier to run third-party software on a Mac than on an iPhone or iPad. Despite the introduction of the Mac App Store a couple of years after the iPhone's App Store opened, it has always been possible to download and run third-party scripts and software on your Mac from anywhere. It's one reason why the iPhone and iPad are subject to new European Union regulations about software sideloading and third-party app stores, while the Mac isn't.

That's not changing in macOS 15 Sequoia, the new version of macOS that's due to be released to the public this fall. But it is about to get more annoying for some apps, according to a note added to Apple's developer site yesterday.

"In macOS Sequoia, users will no longer be able to Control-click to override Gatekeeper when opening software that isn’t signed correctly or notarized," the brief note reads. "They’ll need to visit System Settings > Privacy & Security to review security information for software before allowing it to run."

Read 9 remaining paragraphs | Comments

Reddit considers search ads, paywalled content for the future

Current ad load is relatively “light,” COO says.

In this photo illustration the Reddit logo seen displayed on

Enlarge (credit: Getty)

Reddit executives discussed plans on Tuesday for making more money from the platform, including showing ads in more places and possibly putting some content behind a paywall.

On Tuesday, Reddit shared its Q2 2024 earnings report (PDF). The company lost $10.1 million during the period, down from Q2 2023’s $41.1 million loss. Reddit has never been profitable, and during its earnings call yesterday, company heads discussed potential and slated plans for monetization.

As expected, selling ads continues to be a priority. Part of the reason Reddit was OK with most third-party Reddit apps closing was that the change was expected to drive people to Reddit’s native website and apps, where the company sells ads. In Q2, Reddit’s ad revenue grew 41 percent year over year (YoY) to $253.1 million, or 90 percent of total revenue ($281.2 million).

Read 11 remaining paragraphs | Comments

Report: Apple’s external DVD drive is up burning discs in dongle heaven

Other DVD drives are cheap and plentiful, but Apple’s slot-loader was unique.

Apple's external DVD-burning SuperDrive may be fading away.

Enlarge / Apple's external DVD-burning SuperDrive may be fading away. (credit: Apple)

Apple has always been eager to dump technologies when the company feels they have outlived their usefulness. The original iMac came without a floppy drive. The iPhone 7 came without a headphone jack. Mid-2010s MacBooks and MacBook Pros came with USB-A ports. And the original 2008 MacBook Air came without a built-in optical drive for CDs and DVDs. By the time 2012 and 2013 Macs rolled around, products from the iMac to the MacBook Pro followed suit.

These exclusions have often made Apple's devices thinner, lighter, sleeker, or some combination of all three. But they've also meant that people who still needed those technologies also needed to deal with dongles, adapters, or clunky external accessories hanging off their devices. For the MacBook Air and other modern Macs that needed to read or burn optical discs, that clunky accessory was Apple's SuperDrive, an external DVD burner that connected via USB.

After 16 years of availability, it looks like the SuperDrive's run could be coming to an end. As noticed by MacRumors, the drive's status has shifted to "sold out" in Apple's online store, a more definitive and permanent-sounding label than the "currently unavailable" status assigned to some other out-of-stock products.

Read 3 remaining paragraphs | Comments

31% of Republicans say vaccines are more dangerous than diseases they prevent

The partisan divide on vaccine falsehoods threatens the health of children nationwide.

Polio victim Larry Montoya is at the airport for the arrival of cases of vaccine, which were distributed as part of the KO Polio campaign, September 5, 1962.

Enlarge / Polio victim Larry Montoya is at the airport for the arrival of cases of vaccine, which were distributed as part of the KO Polio campaign, September 5, 1962. (credit: Getty | John McBride)

Public sentiment on the importance of safe, lifesaving childhood vaccines has significantly declined in the US since the pandemic—which appears to be solely due to a nosedive in support from people who are Republican or those who lean Republican, according to new polling data from Gallup.

In 2019, 52 percent of Republican-aligned Americans said it was "extremely important" for parents to get their children vaccinated. Now, that figure is 26 percent, falling by half in just five years. In comparison, 63 percent of Democrats and Democratic leaners said it was "extremely important" this year, down slightly from 67 percent in 2019.

Overall, only 40 percent of Americans now say it is extremely important for parents to vaccinate their children, down from 58 percent in 2019 and 64 percent in 2001.

Read 6 remaining paragraphs | Comments

Microsoft says Delta’s ancient IT explains long outage after CrowdStrike snafu

“Delta, unlike its competitors… has not modernized its IT infrastructure.”

Delta Air Lines customers looking for missing bags wait in line in an airport baggage claim area.

Enlarge / Delta Air Lines customers looking for missing bags wait in line at Los Angeles International Airport (LAX) on July 24, 2024. (credit: Getty Images | Patrick T. Fallon )

Microsoft says that Delta Air Lines' ancient IT infrastructure is to blame for the airline's inability to quickly recover from last month's CrowdStrike debacle.

With Delta threatening to sue Microsoft and CrowdStrike, both companies issued responses saying that Delta refused repeated calls for help. A Microsoft letter to Delta yesterday said the Windows maker is starting to figure out why Delta took longer than other airlines to recover.

"Microsoft continues to investigate the circumstances surrounding the CrowdStrike incident to understand why other airlines were able to fully restore business operations so much faster than Delta, including American Airlines and United Airlines," the letter from Microsoft attorney Mark Cheffo said. "Our preliminary review suggests that Delta, unlike its competitors, apparently has not modernized its IT infrastructure, either for the benefit of its customers or for its pilots and flight attendants."

Read 9 remaining paragraphs | Comments