If the network’s owner was the one doing DNS redirects, couldn’t they just instead use the IP address in the DNSSEC-signed record themselves? I don’t think DNSSEC is a robust protection if you don’t trust the network you’re connected to.
This would break the chain of trust (you wouldn't trust the network's key signing the address for that zone).
The attacker doesn’t resign the DNS record with their own key, they just let the legitimately signed record though and use the IP address in that legitimate record themselves. If someone owns the network (or is an active MitM) they can control where IP addresses route to.
Re:Hotel WiFi JavaScript Injection (2012)
by tptacek on Saturday April 27, 2024 @07:29PM
(#40184569)
They don't even have to do that. If they control the network, they can just set the AD flag to 'true' in a forged DNS response.
Re:Hotel WiFi JavaScript Injection (2012)
by WillowZzzzz on Saturday May 04, 2024 @12:03AM
(#40254707)
Add DoH/DoT to your reply and you're correct.
And for all the whining about how "but DNSSEC doesn't do anything!", this is exactly an attack scenario which DNSSEC protects, and which it has protected since the very first RFC describing it. The client can check for itself whether the IP address in the response has been correctly signed by the (sub-)domain owner (and recursively whether the (sub-)domain has been signed by the parent domain, all the way back to the root).
As for "but how will I redirect hosts to my captive portal?", that's what DHCP option 114, DHCPv6 option 103 and IPv6 Router Advertisement option 37 are for. https://developer.apple.com/news/?id=q78sq5rv