Comment by arcanemachiner

13 hours ago

Unrelated but hoping you could answer this:

There was a rumour years ago that Quad9 was connected to UK intelligence, or something like that. I haven't heard anyone discuss there for a long time, but wondering if you (or anyone reading this) can comment on the source of the rumours and whether there is any veracity to them.

6 comments

arcanemachiner

Reply
kickflipforever  1 hour ago

https://quad9.net/ lists as being founded by Global Cyber Alliance, which was founded by City of London police, Manhattan District Attorney’s Office and Center for Internet Security.

Quad9 openly operate in threat intelligence: https://quad9.net/news/blog/protecting-millions-in-asia-a-ca...

City of London and Manhattan District Attorney’s Office suggests finance is a factor, so I'll hazard a guess that Quad9's telemetry is useful for protecting the interest of finance: e.g. learning of new/popular domains that might be tricking users/businesses into fraudulent activity.

Quad9 meanwhile have the remit to provide the best public resolver, including fighting cases as they do.

gerdesj  12 hours ago

The thing about DNS is that you can do your own investigations, rather than rely on rumour and innuendo. You can query their DNS and anyone else you can get at and compare results. You can use a VPN to appear to come from somewhere else or ask a friend to perform a query on your behalf.

You can literally [sigh] be your own journalist in this regard. All you need is a DNS query tool. I recommend dig but you might only have nslookup available out of the box.

Now, this UK intelligence thing. Even if James Bond Q's mates were actually running a DNS system you can still query it and compare it to someone else's view of the internet, say 1.1.1.1 or 8.8.8.8 or whatever.

You can also go to the source, ie root: . and work your own way down to decide on what is what.

Let's have a go at an analogy: DNS is (not really) a bit like a topographical map. You could buy your maps from DodgyRussianMaps'R'us and be surprised that Ukraine has somehow been subsumed by a bunch of murderous wankers. On the other hand you might buy your maps from HonestJonOffOfFaceb00c and note that it isn't. You can, of course, ask for a few other opinions and make up your own mind.

My real point is that DNS is actually quite hard to tamper with, without breaking so many things that everyone can know it is being messed with. When an org resorts to fiddling with DNS they've already lost whatever argument is to be had.

  • fonix232  11 hours ago

    I think you fundamentally misunderstood the potential issue.

    Sure, on a reply based approach you can audit a DNS service.

    But that doesn't tell you about other things like "is my DNS provider also providing intelligence agencies with my entire DNS query history?". The issue isn't "oh no the MI6 can redirect my PornHub link to anothe site", but "oh no the MI6 knows every single webpage I visited". Which is a valid worry given the current British political climate.

  • echoangle  2 hours ago

    It’s like buying a dodgy map, except the map pulls updates every time you use it. You could very well provide DNS for free and get everyone to use it and then suddenly serve tampered responses at some specific time and use that until everyone affected notices and switches.

    And also you can just serve DNS normally and get the intelligence.