Routeur DNS xajamal, serveur DHCP Rogue, ak DNS encrypté (DoH / DoT) defaraat¶

Saa yoo bindee adres sitweb bu melni chase.com, google.com, wala apple.com ci sa nawigatër, sa aparey dafay laaj Sistemu Tur Domen (DNS) resolver ngir tekki tur wi nit ñi mëna jàng ci adres IP bu am nimero (142.250.190.46). Sudee ab songekat soppee ci ab tekkaaral jekkal serwëru DNS bu njëkk bi ak bu ñaareel bi ci biir sa routeur Wi-Fi kër wala biro, dafay génne ab serwëru DHCP bu soxor ci sa reso bi la nekk, soppali sa ordinatër bu nëbbu hosts file, wala mu jàpp say laaj ci reso otel wala aéroport, ñooy saytu sa téere telefon ci internet. Doonte danga bind URL bi gëna jub ci sa bànk, sa joxekatu imeel, wala serwëru yeesal losisel bi ci barabu adres bi, serwëru DNS biñ jàpp (DNSChanger, ghostDNS, ZuoRAT, wala ab dëkk dnsmasq spoofer) mën na yóbbu sa lëkkaloo ci serwër bu niru ak lu bon, tere sa losisel antivirus yebbi ay firnde yu am fitna, wala wane ab popup bu baaxul "Yeesal losisel bimu àndaale ak Chrome" buy samp ab trojan infostealer.

Bul bàyyi xel ci saasi NET::ERR_CERT_AUTHORITY_INVALID àrtu, portal popups "Dugg ci Reseau Wi-Fi" buñu xamul ci sa Wi-Fi kër, wala navigateur buy soppiku soo duggee ci sitweb yu mag yi. Soo méngale li sa serwëru DNS biñ la jox fi mu nekk di delloo ak ab saafarakat buñ enkripte buñu wóolu (1.1.1.1, 8.8.8.8, wala 9.9.9.9), xool jekkal WAN ak DHCP sa routeur, fomp OS bu am dangar ak cache DNS navigateur, ak may DNS-over-HTTPS (DoH) wala DNS-ci kaw-TLS (DoT), mën nga dindi DNS ci diir bu néew 10 simili.

Defal lii leegi¶

1. BUL MUSAA bës Advanced -> Proceed to [website] (unsafe) sudee sa nawigatër dafa jekki rek wane NET::ERR_CERT_AUTHORITY_INVALID wala MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT àrtu ci bànk bu mag, imeel, wala sitweb cloud. HTTPS bu bees (TLS 1.3) ak HTTP Kaaraange dem ak dikk bu dëgër (HSTS) ñooy sa liiñ bu mujj ngir kaaraange suñu jàppee sa DNS: serwëru DNS biñ jàpp dafa yóbbu sa nawigatër ci adres IP bi songekat bi, te sa nawigatër jàpp fen bi ndax serwëru songekat bi amul caabi privé kriptografik bu dëggu bu Google wala Chase. Soo bësee ci "Demal numu mëna dem" dafay jox sa baatu-jàll ak say kuki sesioŋ ci saasi ki lay song.
2. BUL MUSAA yebbi wala doxal ab "Browser Update.exe / .dmg" wala nga bind sa baatu-jàll Wi-Fi WPA2/WPA3 ci benn popup buy jameet ci sa Wi-Fi kër wala sa biro. Sudee logiciel buy jàpp routeur bi (ghostDNS, Roaming Mantis).
3. Daw 10 sikon nslookup wala dig test méngale ci sa terminal leegi ngir xam ndax sa serwëru DNS bi fi nekk daf lay fen. Ubbil Command Prompt wala Terminal nga méngale nslookup google.com (biy jëfandikoo sa routeur/OS DNS serwër biñ la jox) nslookup google.com 1.1.1.1 (muy laaj Cloudflare ci saasi). Sudee sa serwëru DNS biñ jagleel ab adres IP bu doywaar la bu nekk ci beneen réew boo musul konfigurer, wala mu delloo ay IP yu wuute lool ngir domen bànk/antivirus, sa DNS dañu ko xañ.
4. Soppi ci ab diir jekkal DNS sa aparey ci DNS Encrypted (DoH / DoT ci kaw 1.1.1.1, 9.9.9.9, wala 8.8.8.8) LAATA ngay dugg ci sa routeur wala nga reset baatu-jàll yi. Ndax DNS-over-HTTPS (DoH) di yónnee bépp seetlu domen ci biir benn enkripte TLS Port 443 tunnel directement ci Cloudflare, Quad9, wala Google, taal DoH ci biir sa nawigatër wala OS ci saasi dafay mbummbaay routeur buñ jàpp wala ISP bu soxor suko defee nga mëna dugg ci sitweb dëgg te setal sa reso.
5. Duggal ci sa routeur kër/biro jaaraleko ci fiil Ethernet bu am kable (192.168.1.1 wala 192.168.0.1), xool ñoom ñaar WAN / Internet DNS AK LAN DHCP Server DNS barab yi, ak sudee benn ci ñoom amna adres IP bu ñépp xamul, defal ab aparey 30-second Pin-Hole Factory Reset ci saasi. Malware biy soppi jekkal DNS routeur bi daanaka saa yu nekk dafay dugg ci Remote Web Management (WAN Admin) port, a UPnP (Plug and Play) sàrtu yebal port, wala sàrt buñ jagleel admin/admin baatu-jàll (xoolal Kaaraange routeurs kër yi ak aparey IoT).
6. Xool sa ordinatër hosts fichier ak jekkal proxy/PAC (C:\Windows\System32\drivers\etc\hosts ci Windows wala /etc/hosts ci macOS/Linux) nga fomp sa cache DNS OS. Doonte sa routeur set na 100 pursaa, adware wala trojans ci benn PC wala Mac mën nañu soppi dayo DNS ci barab bi suñu dugalee IP yi ci biir hosts fichier wala defar ab rogue Tablug proxy otomatik (PAC) URL ci tànneefi Internet Windows.

flowchart TD
    A["DNS Hijacking: Àrtu Cert, Popups yu baaxul, wala Sitweb yu Juum"] --> B["1. Aktiwise DNS encrypté (DoH) ci Navigateur / OS ci saasi ngir moytu resolver poisoned"]
    B --> C["2. Doxal Terminal Diagnostic: Teg 'nslookup misaal.com' ak 'nslookup misaal.com 1.1.1.1'"]
    C --> D{"Ndax aparey yépp ci Wi-Fi bi lañu laal, wala benn ordinatër/telefon kese?"}
    D -->|"Bépp aparey bu am Wi-Fi lañu laal"| E["Routeur WAN/DHCP Hijack wala Serveur DHCP bu soxor ci LAN"]
    E --> F["Saytu buntu biñ jagleel ak IP serwëru DHCP ('ipconfig / lépp'). Sudee xamoo MAC/IP -> Xàjjale aparey Rogue"]
    E --> G["-> Yeesal losisel bi -> Def WAN Admin & UPnP -> Def DNS routeur bi ci 1.1.1.1 / 9.9.9.9"]
    D -->|"BENN ordinatër wala telefon kese lañu laal"| H["Japp aparey bi ci dëkk bi: Saytu adaptatëru reso bi DNS bu taxaw, fichier host yi, script proxy/PAC ak extension navigateur"]
    H --> I["Raxasal '/etc/host' wala 'C:\\Windows\\System32\\dawalkat\\etc\\host', dindi sertifikaa Root yu baaxul yi, nga fomp cache DNS"]

Matrix diagnostic: 5 couche yi ñuy xajamal DNS ak reso bi¶

Su tur domen bi jaar ci serwër bu jaarul yoon, jàpp bi dafay am ci benn ci juróomi dayo xarala yu wuute yi ci chaîne resolution bi. Jëfandikool tablo bii ngir xam ban couche lañu laal:

Faas 1: DNS & DHCP buy saytu forensiik ci diiru 60 sikon¶

Laata ngay reset dara, ubbil benn terminal ci sa ordinatër nga def yii komànd yuñ mëna jàng rek ngir jàpp firnde yi ci serwëru DNS yi ak serwëru DHCP yi sa masin di jëfandikoo fi mu nekk.

1. Windows 10 & Windows 11 (Command Prompt wala PowerShell)¶

# 1. Inspect your active Default Gateway, DHCP Server IP, and configured DNS Servers:
ipconfig /all

# 2. Check if any non-commented IP redirect lines exist in your local Windows hosts file:
findstr /V "^#" "%SystemRoot%\System32\drivers\etc\hosts" | findstr /V "^$"

# 3. Check if a rogue Proxy Server or Automatic Configuration Script (PAC) is hijacking browser traffic:
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL

# 4. Compare what your current default DNS server returns vs. Quad9 (9.9.9.9) and Cloudflare (1.1.1.1):
nslookup www.microsoft.com
nslookup www.microsoft.com 9.9.9.9

• Ni ñuy jàngee li génn ci Jéego 1 (ipconfig /all):
• Look at DNS Servers. Daanaka, lii dafay wane IP LAN privé bu sa routeur kër (192.168.1.1, 192.168.0.1, 10.0.0.1), ab resolver publik bu siiw bu nga def ci sa xel (1.1.1.1, 1.0.0.1, 8.8.8.8, 8.8.4.4, 9.9.9.9, 208.67.222.222), wala sa serwëru DNS ISP bu dëggu (xool bépp IP boo xamul ci https://bgp.he.net wala whois: sudee IP bi bokk na ci fournisseur VPS bu amul bal ci beneen réew te du sa ISP, sa DNS dafa daanu).
• Look at DHCP Server vs. Default Gateway. Ci 99 pursaa ci reso yi ci kër yi, DHCP Server IP and the Default Gateway IP dafa wara nekk nuróo (misaal, ñoom ñaar 192.168.1.1). Sudee wuute nañu (te defaroo sa bopp Pi-hole wala Windows Server domen), am nga serwëru DHCP bu soxor ci sa reso bi la nekk.

2. macOS & Linux (Terminal)¶

# 1. On macOS: Display all active DNS resolvers, search domains, and interface bindings:
scutil --dns | grep -E "nameserver|domain|interface"

#    On Linux (systemd-resolved / NetworkManager):
resolvectl status

# 2. Inspect the local /etc/hosts file for unauthorized redirects (anything other than 127.0.0.1 localhost / ::1):
grep -v '^#' /etc/hosts | grep -v '^$'

# 3. On macOS: Check if a malicious Web Proxy or PAC Auto-Config script is enabled on Wi-Fi:
networksetup -getwebproxy Wi-Fi
networksetup -getsecurewebproxy Wi-Fi
networksetup -getautoproxyurl Wi-Fi

# 4. Compare DNS answers and check DNSSEC authentication (ad flag) using dig:
dig www.google.com
dig @1.1.1.1 www.google.com +dnssec

3. Rëbb ak tàqale Serveur DHCP bu soxor ci sa Reseau Local¶

Ak sudee ipconfig /all (wala ip route / networksetup -getinfo Wi-Fi) dafay wane ni sa ordinatër jotna IP lease ak jekkal DNS ci adres IP bu la xamul lu melni 192.168.1.142 ludul sa routeur dëgg (192.168.1.1)? 1. Xaarandil ci saasi aparey bi Adres MAC (Physical Address) ak defarkatu aparey bu soxor bi (192.168.1.142) soo xoolee sa tablo ARP:

# On Windows, macOS, or Linux, display the hardware MAC address mapped to the rogue DHCP IP:
arp -a

2ème étape: Jéego ci jéego ngir dindi Router WAN/DHCP Hijack¶

Sudee sa audit ci Phase 1 dafa firndeel ni sa routeur Wi-Fi dafay joxe adres DNS yu bon (wala ni sa routeur WAN DNS bi ci biir dañu ko soppi), dugg ci routeur bi rek nga bind 1.1.1.1 dellu ci boyet bi doyul. Danga wara tëj vulnérabilité bi may ki la song mu dugg ci sa routeur ci njëkk:

Jéego 1: Defal ab reset usine bu 30 sikon ci routeur bi¶

Lan moo waral reset usine bu mat te baña soppali barabu DNS bi? Ndax xeetu loraange bu router (ZuoRAT, VPNFilter, Cyclops Blink, Mirai variants) dafay faral di yokk lu nëbbu iptables NAT yooni jëmmal (REDIRECT --to-ports 53), dafay samp liggéey cron budul jeex ci /tmp wala NVRAM, wala may kontu SSH/Telnet yu sori yu nëbbu. 1. Debrancher routeur bi WAN/Cable Ethernet Internet (fiil biy joge ci sa fibre ONT wala modem cable) suko defee ki lay song mënu ko connecter ci sa configuration. 2. Bu routeur bi taal, nga tëye Reset pinhole bi ci ginaaw routeur bi ak clip ci diiru 15 ba 30 seconde ba LED yi ci kanam yépp di melax benn yoon. 3. Xaaral 3 simili ngir routeur bi tàmbaliwaat ci stade usine bu sell, ba noppi nga boole ordinatër bu sell ci fiil Ethernet (wala santaane sticker Wi-Fi usine) nga dugg ci 192.168.1.1 (wala 192.168.0.1).

Jéego 2: Tëj 5 jekkal router bi songekat yi di jëfandikoo ngir jàpp DNS¶

Laata ngay boole fiil WAN/Internet bi, defaral juróomi jekkal yii nga wara def ci biir console administration routeur bi (xoolal sunu tegtal bu mat sëkk ci Kaaraange routeurs kër yi ak aparey IoT ngir dëgëral bu xóot): 1. Defal ab baatu-jàll admin router bu am 16+ araf (bumu wuute ak sa baatu-jàll Wi-Fi): Bul musa bàyyi login administratif router bi admin / admin wala admin / password. Bépp CSRF DNS-hijacking kit exploit ci web bi dafay xaar ci saasi ay santaane yuñ jagleel sudee danga sarse ab yëgle bu bonn ci sa nawigatër. 2. Xam Remote Management / WAN Administration mooy DISABLED: Xoolal ci suuf Advanced -> Administration -> Remote Management ak fexe ba kenn ci net bi ñépp bokk mënul dugg ci sa xëtu dugg ci sa routeur wala portu SSH/Telnet ci wàllu WAN. 3. Desactivar UPnP (Bil ak jouer universel): Ci suufu Advanced -> UPnP (wala NAT Forwarding -> UPnP), nga dindi UPnP. Malware ci bépp aparey bu nekk ci sa kër dafay jëfandikoo UPnP (IGD SOAP laaj) ngir wax sa routeur ci lu noppi mu ubbi port yi wala mu soppi sàrti yebal WAN te doo jëfandikoo baatu-jàll. 4. Serveur DNS yu wóor, yuy tere loraange yi (IPv4 AK IPv6) ci kaw routeur bi: Demal ci Tabb Internet / WAN -> Serveur DNS (ak LAN -> Serveur DHCP) nga joge ci Jël ISP ci saasi nga dem ci Jëfandikool Serveur DNS yii: * Niir (1.1.1.1 for Families - Malware Blocking): IPv4 bu njëkk: 1.1.1.2 | Ñaareelu IPv4: 1.0.0.2 (wala buñu filtrewul 1.1.1.1 / 1.0.0.1). IPv6: 2606:4700:4700::1112 ak 2606:4700:4700::1002. * Quad9 (Malware & Phishing Blocking + DNSSEC): IPv4 bu njëkk: 9.9.9.9 | Ñaareelu IPv4: 149.112.112.112. IPv6: 2620:fe::fe ak 2620:fe::9. * DNS Google bu ñépp bokk: IPv4 bu njëkk bi: 8.8.8.8 | Ñaareelu IPv4: 8.8.4.4. IPv6: 2001:4860:4860::8888 ak 2001:4860:4860::8844. 5. Jëfandikoo fiil WAN bi nga samp ci saasi yeesali losisel bi mujjee am ci router bi: Sudee sa modelu routeur weesuna defarkat bi Jeexal dundu (EoL) bis te dootul jot ay patch kaaraange (xoolal Zero-day jëfandikoo patching urgent ak Jeexal-Dundu aparey isolation), wecci hardware routeur bi ci saasi suko defee ñu baña mëna jëfandikoowaat CVE yiñ xam te patchwul suba bi.

3ème étape: Raxas ordinatër bu am dangar (Hosts Dosie, DNS adaptatër, & Flush cache)¶

Ginaaw boo secure sa routeur (wala sudee benn ordinatër kese lañu jàpp), defal yii komand ngir reset stack reso ordinatër bi la nekk, nga fomp bépp dokimaa DNS buñ cache:

1. Windows 10/11 DNS bu mat, njaatige, Winsock, ak defaraat cache navigateur¶

Ubbi Komand Prompt ni Administratër (Win + X -> Terminal (Admin) / Command Prompt (Admin)) ak daw:

:: 1. Reset all network adapters back to automatic DHCP DNS (removes static Trojan DNS overrides):
powershell -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | Set-DnsClientServerAddress -ResetServerAddresses"

:: 2. Disable any rogue Windows Registry Proxy or PAC AutoConfig script:
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /f 2>nul

:: 3. Flush the Windows OS DNS Resolver Cache, Winsock Catalog, and NetBIOS table:
ipconfig /flushdns
nbtstat -R
netsh winsock reset
netsh int ip reset

• Sudee sa C:\Windows\System32\drivers\etc\hosts fichier bi defa am ay liiñ yuñu nanguwul: Ubbi Notepad ni Administratër, ubbi C:\Windows\System32\drivers\etc\hosts, efaase bépp liiñ bu amul àdd (Windows bu sell buñ jagleel hosts fichier bi amna zero ligne yu amul komànteer, te bépp liiñ komànteer dafay tàmbali ci #), denc fichier bi, nga doxal ipconfig /flushdns.
• Xool ndax amna Sàrtifikaa Root (certmgr.msc): Sudee ab songekat wala xeetu loraange bu dëkk bi itam samp na ab kilifag sertifikaa Root bu baaxul (CA) ci sa ordinatër ngir ñu mëna jàpp trafik HTTPS te duñu def àrtu ci nawigatër bi, bësal Win + R, bind certmgr.msc, yaatal Njiitu Sàrtifikaa Root yu Wóolu -> Sàrtifikaa, tànnal ko ci Issued By wala Expiration Date, nga efaase bépp sertifikaa root buñu siñe boppam te xamoo ko.

2. macOS & Linux Reset DNS bu mat ak fomp cache¶

# On macOS: Clear any static DNS overrides on Wi-Fi (reverts to DHCP) and flush mDNSResponder cache:
sudo networksetup -setdnsservers Wi-Fi Empty
sudo networksetup -setautoproxystate Wi-Fi off
sudo networksetup -setwebproxystate Wi-Fi off
sudo networksetup -setsecurewebproxystate Wi-Fi off
sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

# On Linux (Ubuntu / Debian / Fedora with systemd-resolved):
sudo resolvectl flush-caches

3. Raxasal socket bi ci biir sa nawigatër web ak cache DNS (Chrome, Edge, Brave, Firefox)¶

Fiir bu am solo: Navigateur web yi leegi dañuy tëye seen cache DNS bu wuute ci biir ak pool socket TCP bu ubbeeku moom boppam ci ipconfig /flushdns. Doonte defar nga sa routeur ba noppi nga daw ipconfig /flushdns, Chrome wala Edge mën nañu la yónnee IP ki lay song ci diiru 15 simili yu bees ba nga dindi cache bi ci biir navigateur bi: 1. Ci chrome, boor, wala jambaar: * Xeet chrome://net-internals/#dns (wala edge://net-internals/#dns) ci barabu adres bi nga bës Clear host cache. * Bësal ci saasi Sockets ci baraabu cammoy bi (chrome://net-internals/#sockets) nga bës Flush socket pools (lii dafay ray bépp lëkkaloo HTTP/2 wala QUIC bu ubbeeku ba leegi ci IP kiy song). 2. Ci Mozilla Firefox: * Xeet about:networking#dns dugg ci baraabu adres bi nga bës Clear DNS Cache. 3. Ci Apple Safari (macOS ak iOS): * Ci macOS, ubbil Safari -> Jekkal -> Avance, nga xool Show features for web developers, nga bës Develop -> Empty Caches (Opt + Cmd + E), nga bàyyi te tàmbaliwaat Safari. * Ci iPhone wala iPad, taalal Mode avion 5 seconde nga dellu OFF, loolu mooy forse iOS mDNSResponder ngir dindi bépp cache DNS bu mën soppiku ci saasi te doo efaase sa dugg sitweb biñ denc.

4ème étape: Activer DNS encrypté (DoH / DoT) kon amul benn routeur, otel wala ISP bu mëna xajamal sa DNS¶

Lu tax DNS cosaan (UDP Port 53) lu yomb la ci ab routeur buñu laal ci kër gi, Wi-Fi bu benn kafe, wala ISP ngir xool ko ba noppi jàpp ko? Ndax DNS biñ miin ñu ngi ko sos ci 1983 (RFC 882) ak benn encryption ak benn authentification: bépp laaj dafay jaar ci biir fiil bi ci bind bu leer, te bépp aparey bu nekk ci yoon wi mën na defar tontu UDP bu baaxul ci diir bu néew benn milisegond (DNS Spoofing).

Soo amalee DNS-ci kaw-HTTPS (DoH, RFC 8484) wala DNS-ci kaw-TLS (DoT, RFC 7858), sa aparey dafay ëmb bépp laaj DNS ci biir benn kriptografik TLS 1.3 tunnel directement ci ab resolver buñu wóolu (Cloudflare 1.1.1.1, Quad9 9.9.9.9, Google 8.8.8.8, wala NextDNS). Su amee routeur bu soxor wala Wi-Fi otel buy jéema soppi tontu bi, anamu siife TLS bi du mëna dem, sa aparey dafay bañ njuumte gi ci saasi.

Ni ñuy amalee DNS encrypté (DoH / DoT) Ci bépp aparey ci 60 segond¶

Laaj yi ñuy faral di laaj¶

Lu tax sama nawigatër di wane NET::ERR_CERT_AUTHORITY_INVALID ci kaw google.com wala sama bànk biñu jàpp sama DNS routeur?¶

Njuumteg nawigatër bi moo la musal ci ñu sàcc sa kontu. Su ab songe jëlee sa jekkal DNS routeur, dafay soppi adres IP ngir `www.yourbank.com` Kon sa ordinatër dafay jëflante ak serwëru web bi ki lay song, te du jëflante ak sa bànk dëgg. Waaye, sudee sa nawigatër tàmbali HTTPS buñ enkripte (`TLS`) jàpp loxo ak serwëru songekat bi, serwëru songekat bi mënul defar sertifikaa dijital TLS bu baax buñu siñe ci anam wu kriptografik bu kilifag sertifikaa bi wóolu siñe ngir `yourbank.com`. Sa nawigatër dafay taxawal lëkkaloo bi ci saasi ba noppi wane `NET::ERR_CERT_AUTHORITY_INVALID`. Soo musa klike ci "Demal ci anam wumu mëna doon" te doo musa samp ab Sàrtifikaa Root bu soxor (`CA`) ci sa aparey, DNS hijacking kese mënul dechiffre wala spoof ab sitweb HTTPS buñu aar ci HSTS.

naka la ko pirat bi mënee soppi jekkal DNS yi ci sama routeur Wi-Fi te xamul sama baatu-jàll Wi-Fi?¶

Ñi lay song soxla wuñu ñu nekk ci biir Wi-Fi bi la nekk ci sa kër ngir mëna soppi jekkal DNS yi ci sa routeur. Dañuy jëfandikoo ñaari pexe yu sori: bu njëkk bi, bot yu otomatik (`Shodan` / `Censys` scanners ak botnet) scanner bépp adres IP bu ñépp bokk ci net bi di wër routeurs yu am **Njiitu Web ci fu sori (`WAN Admin`)** wala **`UPnP`** ñu bàyyi ko ubbeeku ndax amna ay ñakk kattan ci losisel bi. Ñaareel ba mooy, doonte WAN Admin dafa tëju, soo bàyyi sa baatu-jàll administraasioŋ bi ci biir routeur bi ci default usine bi (`admin / admin` wala `admin / password`), soo bësee ci benn piblisite wala sitweb bu baaxul ci sa ordinatër portable, loolu dafay tax JavaScript bi nëbbu ci sa nawigatër yónnee **Njuumteg sàq ci sit yi (`CSRF`)** wala **DNS Rebinding** laaj ci sa ordinatër portable ci `http://192.168.1.1`, dugg ci sa routeur ci biir ba noppi binndaat say jekkal DNS ci noppi.

Suma amalee DNS encrypté (DoH) ci Chrome wala Firefox, ndax loolu dafay aar yeneen jëfandikukaay yi ci sama ordinatër?¶

Aktiwise DNS bu wóor (`DoH`) ci biir Chrome, Edge, Brave, wala Firefox dafay encrypter ak aar bépp seetlu DNS buñ def **ci biir navigateur web bi**, loolu dafay dakkal ci saasi phishing bu sukkandiko ci navigateur bi ak xëti yeesal yu baaxul yi. Waaye, yeneen aplikaasioŋ yu am ci sa ordinatër (lu melni sa klian imeel, Slack, jeu yi, wala yeesal OS) ba leegi dañuy jëfandikoo DNS biy jëfandikoo sistem bi yépp fileek defaroo DNS buñ encrypté ci niveau sistem bi (jaaraleko ci Windows 11 Native DoH, Android Private DNS `DoT`, wala ab profil DNS buñu siñe ci macOS/iOS) nga defar jekkal DNS WAN/DHCP bu sa routeur.

Luy wuutale 1.1.1.1 (Niirflare) ak 9.9.9.9 (Quad9), ak yan laa wara def ci sama routeur?¶

Ñoom ñaar ñépp gaaw nañu, sargal-sàmm, du topp global anycast DNS resolvers liggéey ci mbootaay yu wóor, te benn ci ñoom dina la aar ci ISP wala rogue-router hijacking. Standard **`1.1.1.1`** (Niir) ak **`8.8.8.8`** (Google) dafay delloosi tontu DNS yu sell te filtrewul ci domen bu nekk ci net bi. **`9.9.9.9`** (fondation Quad9 biy def te Yàlla tax) ak **`1.1.1.2`** (Cloudflare ngir njaboot yi - Bloke Malware) xool ci saasi bépp seetlu domen ci jamono dëgg feed yu xarañteef yu sitweb phishing, ransomware komand-ak-kontrol (`C2`) serwër yi, ak domen infostealer, di tëj lëkkaloo bi ci layer DNS balaa xët bu bonn bi di mëna charge.

Gid yu jëm ci loolu¶

• Kaaraange routeurs kër yi ak aparey IoT
• Wi-Fi bu ñépp bokk, hotspot Evil Twin, ak kaaraange jus USB
• Extension navigateur yu bonn yi, jàpp clipboard yi ak dindi losisel yiy yëgle
• Zero-day jëfandikoo patching urgent ak Jeexal-Dundu aparey isolation
• Xañ tur domen, DNS bu jeex, ak jël sitweb
• Nimero urgence global

Saytu nañu ay balluwaay¶

• Sibersécurité ak Agence de Sécurité Infrastructure (CISA) & Agence de Sécurité Nationale (NSA) (Etats Unis): Fiche d'information ci sibersécurité (Tànn ab sarwiisu DNS buy Aar (PDNS) ak Jëfandikoo DNS buñ Encrypté DoH / DoT ci Environmaa Enterprise ak kër).
• Task Force Ingénieur ci Internet (IETF) (ci àdduna bi): RFC 7858 (Mandargal DNS ci kaw kaaraange Layer Transport DoT), RFC 8484 (Laajte DNS ci kaw HTTPS DoH), ak RFC 9462 (Gis-gis Resolver yuñ tànn DDR).
• Komite buy xelal kaaraange ak dal bu ICANN (SSAC) (ci àdduna bi): Xelal ci wàllu DNS infrastructure, tabbwaat WAN router, ak DNSSEC gëmloo.
• Centre National de Sécurité Cyber (NCSC) (Royaume-Uni): Architecture DNS buy Aar ak wàññi DHCP yu soxor yi ak Cong mu Reseau Local.