Running your own servers for Internet checks is what you're supposed to do -- when you don't, you cause problems for other people (e.g. if Google decided to sell an address block or change its DNS name or if someone decides to deprecate an NTP pool server).

For example, look at the document made by the NTP Pool: http://www.pool.ntp.org/en/vendors.html. Microsoft has time.windows.com, Apple has time.apple.com, and Canonical has ntp.ubuntu.com.

I recall reading a story where someone checked network connectivity by pinging a DNS name with a known but invalid IP address, and relying on the exact error message. When a sysadmin later removed the "invalid" DNS entry, ping would return a different error message, which caused the network connectivity check to fail. People do strange things for connectivity checks -- what Belkin did here seems pretty "by-the-book" by comparison.

This is why when I want to implement a negative connectivity check I always make a deal with admins to have a will-never-exist.whatever.com or similar record with known and documented behaviour.

Yes, that's because I've been caught out before :)

Amazon/Google might be a little annoyed if every Belkin router on the planet started pinging them.

They probably get much more legit traffic than that. Router doesn't need to do it that frequently, only when it needs to find out if internet connection is alive. Which is usually on boot and maybe on infrequent occasions after that. So they wouldn't even notice.

No. Terrible idea: http://pages.cs.wisc.edu/~plonka/netgear-sntp/

They would love it. Why do you think they provide public DNS in the first place?

Google provide public DNS because they think they can make people's DNS faster and more reliable, which causes web pages to load faster and more reliably, causing Internet users to be happier when using the Internet, and therefore providing more analytics data and ad revenue to Google.

and, they know where people are looking/surfing/...

>some vital router functions and not simple DNS check

How do you expect 99.99% of the world to get to facebook.com without DNS? It's pretty damn vital if you ask me, especially for a consumer grade router.

But their DNS doesn't actually depend on that server (at least according to the explanation above). Only the part of the code checking "do we have internet?" depends on it, and only because they use some internal company's address and apparently whoever is responsible for it doesn't know that if this host ever gets down it breaks the internet for all Belkin customers. So it's a simple case of miscommunication and failure to think systemically, not something fundamentally broken.

Do a dig of heartbeat.belkin.com and you get a bunch of 54.0.0.0/8 addresses that Amazon bought from Merck. It's using AWS.

Looks good, but how comes then it still didn't work properly? I see only two possibilities: somebody managed to mess up all the redundant servers at once, by either messing up firewall rules or replicated config or something like that, or somebody messed up heartbeat.belkin.com. DNS entry.

Looks like I was wrong cause I checked too late, Belkin moved to AWS as part of the fix, doh!

https://news.ycombinator.com/item?id=8429789

For most people, DNS on the router is vital because they don't know how to get online without it.

It shouldn't be less scary. Any time proprietary software calls home it could receive orders to open a backdoor or anything else. It's a command and control feature disguised as a DNS check, or at the very least it could be easily turned into one at any point without raising suspicion.

I think you're being too paranoid here (I don't say this often :). A ping to known good host is a benign thing. Can it be replaced with malicious thing? I'm sure it can, somebody could gain access to your router and reflash it with malware and you wouldn't even know. This is a real possibility. But it remains so regardless of presence or absence of DNS ping, so DNS ping by itself does not add any specific threat.

Calling it a "DNS ping" is just confusing or wrong. It's a DNS query.

It's dangerous because:

1. It allows them to create a database with the IP address of every internet-connected router.

2. It allows them to control routers via DNS packets, which are frequently permitted even behind firewalls.

3. It providers a cover for traffic to their servers on the DNS port.

This kind of thing is very common. It's also very dangerous and we should demand alternatives.

I called it DNS ping because it essentially serves the same function as "ping" command but on slightly different level - by checking if DNS functions.

1. This is true, but most routers check for firmware updates anyway, so there you go. Not to mention online warranty registrations, etc. which would get you into their DB anyway.

2. Unlikely, unless you have a RCE bug in your DNS implementation, in which case the router is toast without the DNS querying.

3. One query is not "traffic". It is pretty easy to distinguish between one query on boot and constant communication. Again, it is only relevant if you already have malware in your router.

#1 and #3 are not even refutations and #2 you didn't even understand. You're absolutely wrong that this isn't a security issue. The simple proof is that no secure network would ever allow a device to call home like this.

Maybe you think that because it's common it's not a problem. That's not how security works.