Ukuqweqwediswa kweNdlela ye-DNS, iiSeva ze-DHCP eziHluphekileyo, kunye noBuyiselo nge-Encrypted DNS (DoH/DoT)¶

Ngalo lonke ixesha uchwetheza idilesi yewebhusayithi njenge chase.com, google.com, okanye apple.com kwibhrawuza yakho, isixhobo sakho sibuza i Domain Name System (DNS) umlungisi ukuguqulela elo gama lifundeka ngumntu kwidilesi ye-IP yamanani (142.250.190.46). Ukuba umhlaseli uthe cwaka utshintsha useto lwePrayimari kunye neSekondari ye-DNS ngaphakathi kwekhaya lakho okanye kwiofisi yeWi-Fi umzila, ijikelezisa ** iseva yeDHCP ekhohlakeleyo ** kwinethiwekhi yakho yendawo, iguqula ikhompyuter yakho efihliweyo **hosts ifayile **, okanye ibamba imibuzo yakho kwihotele okanye kwinethiwekhi yesikhululo seenqwelomoya, balawula incwadi yefowuni ye-intanethi yakho. Nokuba uchwetheza kanye, i-URL epelwe ngokuchanekileyo yebhanki yakho, umboneleli we-imeyile, okanye iseva yohlaziyo lwesoftware kwibar yedilesi, iseva yeDNS eqweqwedisiweyo (DNSChanger, ghostDNS, ZuoRAT, okanye indawo dnsmasq spoofer) inokuhambisa umdibaniso wakho ukuya kwiseva enobungozi, ithintele isoftware yakho ye-antivirus ekukhupheni iinkcazo zesoyikiso, okanye ibonise "uHlaziyo lweFirmware yeRouter / uHlaziyo oluBalulekileyo lweChrome" olufakela i-infostealer trojan.

Sukuzihoya ngesiquphe NET::ERR_CERT_AUTHORITY_INVALID izilumkiso, ezingalindelekanga "Ngena kwiNethiwekhi ye-Wi-Fi" i-portal portal popups kwi-Wi-Fi yakho yasekhaya, okanye ukuhambisa umkhangeli zincwadi xa undwendwela iiwebhusayithi ezinkulu. Ngokuthelekisa ukuba umncedisi weDNS owabelwe ngoku ubuyisela ntoni ngokuchasene nomsombululi othembekileyo ofihliweyo (1.1.1.1, 8.8.8.8, okanye 9.9.9.9), ukuphicotha i-WAN yomzila wakho kunye nezicwangciso ze-DHCP, ukugungxula i-OS enetyhefu kunye ne-browser ye-DNS caches, kunye nokwenza i-DNS-over-HTTPS (DoH)* okanye DNS-over-TLS (DoT), unokuphelisa ukuqweqwediswa kweDNS ngaphantsi kwemizuzu eli-10.

Yenza oku ngoku¶

1. UNGAZE ucofe Advanced -> Proceed to [website] (unsafe) ukuba umkhangeli zincwadi wakho ngokukhawuleza ubonisa a NET::ERR_CERT_AUTHORITY_INVALID okanye MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT isilumkiso kwibhanki enkulu, i-imeyile, okanye iwebhusayithi yelifu. I-HTTPS yanamhlanje (TLS 1.3) kunye noKhuseleko lwezoThutho oluQhelekileyo lweHTTP (HSTS) ngumgca wakho wokugqibela wokuzikhusela xa i-DNS yakho ithinjwa: iseva ye-DNS eqweqwedisiweyo iqondise isikhangeli sakho kwidilesi ye-IP yomhlaseli, kwaye isikhangeli sakho sibambe ubuxoki kuba umncedisi womhlaseli akabambeli isitshixo sabucala sikaGoogle okanye sikaChase. Ukucofa u-"Qhubeka nokuba kunjalo" unika amagama ayimfihlo akho kunye neekuki zeseshoni ngqo kumhlaseli.
2. UNGAZE ukhuphele okanye usebenzise i "Browser Update.exe / .dmg" okanye chwetheza igama lokugqitha lakho le-Wi-Fi WPA2/WPA3 kwi-popup ethi ivele ngesiquphe kwikhaya lakho okanye kwiofisi yeWi-Fi. Xa i-router-hijacking malware (ghostDNS, Roaming Mantis) utshintsha iiseva ze-WAN / DHCP DNS ze-router yakho kwidilesi ye-IP yobugebengu, iqhinga layo le-#1 kukubuyisela kwakhona yonke imithwalo yephepha le-HTTP kwi-fake "I-Google Chrome / Safari / I-Firmware ye-Router yakho iphelelwe yisikhathi" iphepha okanye i-portal ye-ISP yenkohliso.
3. Baleka imizuzwana eli-10 nslookup okanye dig Uvavanyo lothelekiso kwiterminal yakho ngoku ukubona ukuba umncedisi wakho wangoku weDNS ulele kuwe na. Vula i-Command Prompt okanye i-terminal kwaye uthelekise nslookup google.com (esebenzisa umzila owunikiweyo ngoku/umncedisi we-OS DNS) ngokuchasene nslookup google.com 1.1.1.1 (ebuza i-Cloudflare ngqo). Ukuba iseva yakho ye-DNS engagqibekanga yidilesi yoluntu engaqhelekanga ye-IP ebekwe kwelinye ilizwe ongazange uliqwalasele, okanye ibuyisela ii-IPs zomgunyathi ezahluke ngokupheleleyo zeendawo zebhanki/zokulwa nentsholongwane, iDNS yakho iyaqweqwediswa.
4. Okwexeshana ubhala ngaphezulu useto lwe-DNS yesixhobo sakho kwi-Encrypted DNS (DoH / DoT kwi 1.1.1.1, 9.9.9.9, okanye 8.8.8.8) PHAMBI kokungena kwirutha yakho okanye usete ngokutsha amagama ayimfihlo. Ngoba DNS-over-HTTPS (DoH) ithumela lonke ujongo lwesizinda ngaphakathi koguqulelo oluntsonkothileyo TLS Port 443 Itonela ngokuthe ngqo kwi-Cloudflare, i-Quad9, okanye i-Google, ivula i-DoH ngaphakathi kwesikhangeli sakho okanye i-OS ngokukhawuleza imfamekisa irutha ethinjiweyo okanye isisombululi se-ISP esikhohlakeleyo ukuze ukwazi ukufikelela ngokukhuselekileyo kwiiwebhusayithi zokwenyani kwaye ucoce inethiwekhi yakho.
5. Ngena kwi-router yasekhaya/yeofisi ngentambo ye-Ethernet enentambo (192.168.1.1 okanye 192.168.0.1), hlola zombini WAN / Internet DNS KUNYE LAN DHCP Server DNS imihlaba, kwaye ukuba mhlawumbi iqulethe iidilesi ze-IP ezingaqhelekanga zoluntu, yenza i-hardware 30-second Pin-Hole Factory Reset ngokukhawuleza. I-Malware etshintsha useto lwe-router ye-DNS phantse isoloko ingena ngokuvezwa Remote Web Management (WAN Admin) izibuko, a UPnP (Iplagi yeHlabathi kunye neDlala) umthetho wokudlulisela izibuko, okanye ummiselo admin/admin igama lokugqitha (bona Ukukhusela iirotha zasekhaya kunye nezixhobo ze-IoT).
6. Jonga indawo yekhompyuter yakho hosts ifayile kunye neProxy/PAC useto (C:\Windows\System32\drivers\etc\hosts kwiWindows okanye /etc/hosts kwi-macOS/Linux) kwaye ugungxule i-cache ye-OS DNS. Nokuba i-router yakho icocekile nge-100 lepesenti, iadware yasekuhlaleni okanye iitrojans kwiPC enye okanye iMac inokusihoya isisombululo seDNS ekuhlaleni ngokutofa ulwalathiso lwe-IP kwakhona hosts ifayile okanye ukuseta isigebenga Uqwalaselo lommeli oluzenzekelayo (PAC) URL kwiiKhetho zeIntanethi yeWindows.

flowchart TD
    A["Ukuqweqwediswa kweDNS erhanelwayo: Izilumkiso zeSitifiketi, iiPopups zoHlaziyo olungeyonyani, okanye iiNdawo ezingalunganga ziyalayisha."] --> B["1. Yenza i-Encrypted DNS (DoH) isebenze kwiBhrawuza / OS kwangoko ukuze ugqithe kwisisombululo esinetyhefu."]
    B --> C["2. Sebenzisa i-Terminal Diagnostic: Thelekisa 'nslookup example.com' vs 'nslookup example.com 1.1.1.1'"]
    C --> D{"Ngaba ZONKE izixhobo ezikwi-Wi-Fi ziyachaphazeleka, okanye NYE kuphela ikhompyuter/ifowuni ethile?"}
    D -->|"Zonke izixhobo kwi-Wi-Fi zichaphazelekile"| E["Umzila WAN/DHCP Hijack okanye Rogue DHCP Server kwi LAN"]
    E --> F["Jonga iSango eliMiselweyo kunye ne-DHCP yeseva ye-IP ('ipconfig / yonke'). Ukuba i-MAC / IP engaqhelekanga -> Yahlula i-Rogue Device"]
    E --> G["I-Hardware Factory Setha kwakhona iRouter -> Hlaziya iFirmware -> Khubaza i-WAN Admin & UPnP -> Seta i-Router DNS kwi-1.1.1.1 / 9.9.9.9"]
    D -->|"INYE kuphela ikhompyutha okanye ifowuni echaphazelekayo"| H["Ukuqweqwediswa kwesiXhobo saseKuhlaleni: Hlola i-Adapter yeNethiwekhi engatshintshiyo ye-DNS, iFayile yoMmeli, iProxy/i-PAC iscript kunye nezandiso zebhrawuza"]
    H --> I["Coca '/ etc/hosts' okanye 'C:\\Windows\\ System32\\ drivers\\ etc \\ hosts', susa i-Rogue Certs, kwaye ugungxule i-DNS cache"]

I-matrix yokuxilonga: Imigangatho emi-5 apho i-DNS kunye nendlela yothungelwano ithinjwa¶

Xa igama lesizinda lisombulula kumncedisi ongalunganga, i-hijack iyenzeka kwelinye lamaleko amahlanu ahlukeneyo obugcisa kwikhonkco lesisombululo. Sebenzisa le theyibhile ukuchonga ukuba loluphi umaleko osengozini:

Isigaba 1: I-60-Second Command-Line yeDNS kunye ne-DHCP Forensic Audit¶

Phambi kokusetha kwakhona nantoni na, vula i-terminal kwikhompyuter yakho kwaye uqhube le miyalelo yokufunda kuphela ukubamba ubungqina bokuba zeziphi iiseva ze-DNS kunye neseva ye-DHCP esetyenziswa ngumatshini wakho ngoku.

1. Windows 10 & Windows 11 (Command Prompt okanye PowerShell)¶

# 1. Inspect your active Default Gateway, DHCP Server IP, and configured DNS Servers:
ipconfig /all

# 2. Check if any non-commented IP redirect lines exist in your local Windows hosts file:
findstr /V "^#" "%SystemRoot%\System32\drivers\etc\hosts" | findstr /V "^$"

# 3. Check if a rogue Proxy Server or Automatic Configuration Script (PAC) is hijacking browser traffic:
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL

# 4. Compare what your current default DNS server returns vs. Quad9 (9.9.9.9) and Cloudflare (1.1.1.1):
nslookup www.microsoft.com
nslookup www.microsoft.com 9.9.9.9

• Ukufunda njani iziphumo zeNyathelo 1 (ipconfig /all):
• Jonga DNS Servers. Ngesiqhelo, oku kubonisa nokuba i-IP yabucala ye-LAN yendlu yakho (192.168.1.1, 192.168.0.1, 10.0.0.1), umsombululi owaziwayo woluntu oseta ngabom (1.1.1.1, 1.0.0.1, 8.8.8.8, 8.8.4.4, 9.9.9.9, 208.67.222.222)https://bgp.he.net** okanye whois: ukuba i-IP yeye-bulletproof VPS hosting provider kwelinye ilizwe kune-ISP yakho, iDNS yakho inetyhefu).
• Jonga DHCP Server vs. Default Gateway. Kwiipesenti ezingama-99 zothungelwano lwasekhaya, i DHCP Server IP kunye ne Default Gateway IP kufuneka ifane (umzekelo, zombini 192.168.1.1). Ukuba zahlukile (kwaye awuzange uzenzele ngokwakho i-Pi-hole okanye i-Windows Server yesilawuli se-domain), unomncedisi we-DHCP okhohlakeleyo kwinethiwekhi yakho yendawo.

2. iMacOS kunye neLinux (Terminal)¶

# 1. On macOS: Display all active DNS resolvers, search domains, and interface bindings:
scutil --dns | grep -E "nameserver|domain|interface"

#    On Linux (systemd-resolved / NetworkManager):
resolvectl status

# 2. Inspect the local /etc/hosts file for unauthorized redirects (anything other than 127.0.0.1 localhost / ::1):
grep -v '^#' /etc/hosts | grep -v '^$'

# 3. On macOS: Check if a malicious Web Proxy or PAC Auto-Config script is enabled on Wi-Fi:
networksetup -getwebproxy Wi-Fi
networksetup -getsecurewebproxy Wi-Fi
networksetup -getautoproxyurl Wi-Fi

# 4. Compare DNS answers and check DNSSEC authentication (ad flag) using dig:
dig www.google.com
dig @1.1.1.1 www.google.com +dnssec

3. Ukuzingela kunye nokwahlula iseva ye-DHCP ekhohlakeleyo kwiNethiwekhi yeNgingqi yakho¶

Kuthekani ukuba ipconfig /all (okanye ip route / networksetup -getinfo Wi-Fi) ibonisa ukuba ikhomputha yakho ifumene i-IP yokuqeshisa kunye nezicwangciso ze-DNS kwidilesi ye-IP engaqhelekanga 192.168.1.142 endaweni yerouter yakho yokwenyani (192.168.1.1)? 1. Ngoko nangoko chonga ihardware Idilesi ye-MAC (Physical Address) kunye nomvelisi wesixhobo esikhohlakeleyo (192.168.1.142) ngokuhlola itafile yakho yeARP:

# On Windows, macOS, or Linux, display the hardware MAC address mapped to the rogue DHCP IP:
arp -a

Isigaba sesi-2: Ukupheliswa kwamanyathelo ngamanyathelo kwi-Router WAN/DHCP Hijacking¶

Ukuba uphicotho lwakho kwiSigaba soku-1 lubonakalise ukuba umzila wakho we-Wi-Fi unikezela ngeedilesi ezikhohlakeleyo ze-DNS (okanye umzila wakho wangaphakathi we-WAN DNS ulungisiwe), ungene ngokulula kwirutha kwaye uchwetheze. 1.1.1.1 emva kwibhokisi **akwanelanga **. Kuya kufuneka uvale ubuthathaka obuvumele umhlaseli ukuba angene kwi-router yakho kwasekuqaleni:

Inyathelo loku-1: Yenza i-Hardware ye-30-Second Factory Reset kwi-Router¶

Kutheni kuseta ngokutsha umzi-mveliso ogcweleyo endaweni yokuhlela nje indawo ye-DNS? Ngenxa yokuba i-router malware (ZuoRAT, VPNFilter, Cyclops Blink, Mirai ezahlukeneyo) wongeza rhoqo efihliweyo iptables Imithetho yokuqondisa ngokutsha ye-NAT (REDIRECT --to-ports 53), ifaka umsebenzi wecron oqhubekayo /tmp okanye i-NVRAM, okanye yenza i-akhawunti efihliweyo ye-SSH/Telnet yolawulo. 1. Susa uqhagamshelwano lwerutha WAN / Internet Ethernet cable (intambo evela kwifiber ONT yakho okanye imodem yentambo) ukuze umhlaseli angakwazi ukuphinda aqhagamshele ngelixa usayiqwalasela. 2. Xa i-router ivuliwe, cofa kwaye ubambe i-recessed Setha kwakhona iqhosha le-pinhole ngasemva kwe-router kunye ne-paperclip **15 ukuya kwi-30 imizuzwana epheleleyo ** de zonke iipaneli ze-LED zangaphambili zidanyaze ngaxeshanye. 3. Lindela imizuzu emi-3 ukuba irutha iqalise kwakhona kwisimo sayo sefektri ecocekileyo, emva koko uqhagamshele ikhompyuter ecocekileyo ngentambo ye-Ethernet (okanye iziqinisekiso zesitikha seWi-Fi yasefektri) kwaye ungene. 192.168.1.1 (okanye 192.168.0.1).

Inyathelo lesi-2: Tshixa i-5 Router Settings Attackers Exploit to Hijack DNS¶

Ngaphambi kokuba uplage i-WAN / intambo ye-Intanethi emva, qwalasela ezi zicwangciso zintlanu zinyanzelekileyo ngaphakathi kwikhonsoli yolawulo yerutha yakho (bona isikhokelo sethu esipheleleyo Ukukhusela iirotha zasekhaya kunye nezixhobo ze-IoT ukwenzela ukuqina okunzulu): 1. Seta iPassword yoLawulo lweNdlela yoMlinganiswa oyi-16+ (AKUFANANI nephasiwedi yakho ye-Wi-Fi): Ungaze ushiye igama lokungena kwirutha njenge admin / admin okanye admin / password. Yonke ikhithi ye-CSRF DNS-hijacking exploit kwiwebhu iqikelela ngokuzenzekelayo iziqinisekiso ezihlala zikhona xa ulayisha ibhena enobungozi kwibrawuza yakho. 2. ** Qinisekisa Remote Management / WAN Administration ngu Ngokungqongqo DISABLED:** Jonga phantsi Advanced -> Administration -> Remote Management kwaye uqiniseke ukuba akukho mntu kwi-intanethi yoluntu onokufikelela kwiphepha lokungena kwi-router okanye izibuko ze-SSH/Telnet ukusuka kwicala le-WAN. 3. ** Khubaza UPnP (Iplagi kunye noDlala jikelele):** Ngaphantsi Advanced -> UPnP (okanye NAT Forwarding -> UPnP), cima UPnP CIMA. I-Malware nakwesiphi na isixhobo esingaphakathi endlwini yakho isebenzisa i-UPnP (IGD izicelo zeSEPHA) ukuyalela ngokuthe cwaka umzila wakho ukuba uvule amazibuko okanye uguqule imithetho yokuthunyelwa kwe-WAN ngaphandle kwegama lokugqitha. 4. Hardcode Thenjiwe, IMalware-Ivalwa iiSeva ze-DNS (IPv4 NE-IPv6) kwiNdlela: Yiya ku **Intanethi / Ukuseta i-WAN -> Iseva ye-DNS ** (kunye ne-LAN -> Iseva ye-DHCP) kwaye utshintshe ukusuka ku-Fumana ngokuzenzekelayo ukusuka kwi-ISP ukuya Sebenzisa Ezi Seva ze-DNS **: * **loudflare (1.1.1.1 for Families - Malware Blocking): IPv4 engundoqo: klzzwxh062 | IPv4 yesibini: 1.0.0.2 (okanye umgangatho ongahluzwanga 1.1.1.1 / 1.0.0.1). IPv6: 2606:4700:4700::1112 kwaye 2606:4700:4700::1002. **Iiquad9 (klzzwx0068): IPv4 engundoqo: 9.9.9.9 | IPv4 yesibini: 149.112.112.112. IPv6: 2620:fe::fe kwaye klzzh:0072. **Google Public DNS:** IPv4 enguoqo: 8.8.8.8 | IPv4 yesibini: 8.8.4.4. IPv6: 2001:4860:4860::8888 kwaye 2001:4860:4860::8844. 5. Qhagamshela kwakhona iCable yeWAN kwaye kwaNgoko uFakele uHlaziyo lweFirmware yeRouter yamva nje: Ukuba imodeli yakho yerouter idlule umenzi wayo Ukuphela koBomi (EoL) umhla kwaye awusafumani iindawo zokhuseleko (bona I-Zero-day ixhaphaza i-patching engxamisekileyo kunye ne-End-of-Life device yodwa), buyisela i-router hardware ngoko nangoko eyaziwayo ii-CVEs ezingabhalwanga azikwazi ukuphinda zisetyenziswe ngomso.

Inqanaba lesi-3: Ukucoca ikhompyuter yendawo enetyhefu (Hosts Ifayile, i-DNS yeAdapter, kunye neCache Flush)¶

Emva kokukhusela irutha yakho (okanye ukuba bekuqweqweniwe ikhompyuter enye), sebenzisa le miyalelo kanye ukuseta kwakhona isitakhi senethiwekhi yekhompyuter yakho kwaye ugungxule yonke irekhodi yeDNS enetyhefu:

1. Windows 10 / 11 Gqibezela iDNS, iinginginya, iWinsock, kunye nokuSeta kwakhona iCache yesikhangeli¶

Vula Uyalelo olukhawulezileyo njengoMlawuli (Win + X -> Terminal (Admin) / Command Prompt (Admin)) kwaye uqhube:

:: 1. Reset all network adapters back to automatic DHCP DNS (removes static Trojan DNS overrides):
powershell -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | Set-DnsClientServerAddress -ResetServerAddresses"

:: 2. Disable any rogue Windows Registry Proxy or PAC AutoConfig script:
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /f 2>nul

:: 3. Flush the Windows OS DNS Resolver Cache, Winsock Catalog, and NetBIOS table:
ipconfig /flushdns
nbtstat -R
netsh winsock reset
netsh int ip reset

• ** Ukuba wakho C:\Windows\System32\drivers\etc\hosts ifayile equlathe imigca engagunyaziswanga yokwalathisa kwakhona:** Vula iNotepad njengoMlawuli, vula C:\Windows\System32\drivers\etc\hosts, cima wonke umgca ongachazwanga (iWindows ecocekileyo engagqibekanga hosts ifayile ine zero esebenzayo iilayini ezingachazwanga, kwaye wonke umgca wezimvo uqala ngawo #), gcina ifayile, kwaye ubaleke ipconfig /flushdns.
• Jonga iZatifikethi zeRogue Root (certmgr.msc): Ukuba umhlaseli okanye i-malware yasekuhlaleni ifake neGunya leSatifikethi seNgcambu yobuxoki (CA) kwikhompyuter yakho ukuze bathintele itrafikhi ye-HTTPS ngaphandle kokuqalisa izilumkiso zesikhangeli, cofa Win + R, uhlobo certmgr.msc, yandisa Abasemagunyeni abaThenjiweyo beZiqinisekiso zeNgcambu -> Izatifikethi, hlela nge Issued By okanye Expiration Date, kwaye ucime nasiphina isiqinisekiso sengcambu esingaziwayo ongasaziyo.

2. macOS & Linux Gqibezela iDNS Reset kunye neCache Flush¶

# On macOS: Clear any static DNS overrides on Wi-Fi (reverts to DHCP) and flush mDNSResponder cache:
sudo networksetup -setdnsservers Wi-Fi Empty
sudo networksetup -setautoproxystate Wi-Fi off
sudo networksetup -setwebproxystate Wi-Fi off
sudo networksetup -setsecurewebproxystate Wi-Fi off
sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

# On Linux (Ubuntu / Debian / Fedora with systemd-resolved):
sudo resolvectl flush-caches

3. Gubha iSokethi Yangaphakathi yeSikhangeli sakho seWebhu kunye neCache yeDNS (Chrome, Edge, Brave, Firefox)¶

Umgibe obalulekileyo: Abakhangeli bewebhu bale mihla bagcina eyabo i-cache yangaphakathi ye-DNS eyahlukileyo kwaye bavule ichibi le-socket ye-TCP abazimeleyo ngokupheleleyo ipconfig /flushdns. Nasemva kokuba ulungise i-router yakho kwaye uqhube ipconfig /flushdns, I-Chrome okanye i-Edge ingaqhubeka ikuthumela kwi-IP yomhlaseli enye imizuzu ye-15 de ucime i-cache yangaphakathi yesikhangeli: 1. KwiChrome, kuMda, okanye uBukroti: * Uhlobo chrome://net-internals/#dns (okanye edge://net-internals/#dns) kwibar yedilesi kwaye ucofe Clear host cache. * Cofa kwangoko Sockets kwibar esecaleni ekhohlo (chrome://net-internals/#sockets) kwaye ucofe Flush socket pools (oku kubulala nayiphi na imidibaniso esebenzayo eqhubekayo yeHTTP/2 okanye ye-QUIC esayivulekele kwi-IP yomhlaseli). 2. KwiMozilla Firefox: * Uhlobo about:networking#dns kwibar yedilesi kwaye ucofe Clear DNS Cache. 3. ** KwiApple Safari (iMacOS kunye ne-iOS):** * Kwi-macOS, vula ** iSafari -> Useto -> Advanced **, khangela Show features for web developers, kwaye ucofe Develop -> Empty Caches (Opt + Cmd + E), emva koko uyeke kwaye uqalise kwakhona iSafari. * Kwi-iPhone okanye kwi-iPad, vula **Imo yeNqwelomoya VULA imizuzwana emi-5 kwaye ubuye OFF **, nto leyo enyanzela iOS mDNSResponder ukucoca yonke i-cache ye-DNS eguquguqukayo ngokukhawuleza ngaphandle kokucima ukungena kwewebhusayithi yakho egciniweyo.

Inqanaba lesi-4: Ukwenza i-DNS eFihliweyo isebenze (DoH / DoT) ke akukho mzila, ihotele, okanye i-ISP inokuphinda iqweqwedise iDNS yakho kwakhona¶

Kutheni iDNS yesiko (UDP Port 53) kulula kakhulu kwirouter yasekhaya esengozini, ikofu-shop Wi-Fi, okanye i-ISP ukuyihlola nokuqweqwedisa? Ngenxa yokuba i-DNS eqhelekileyo yenzelwe 1983 (RFC 882) ngoguqulelo oluntsonkothileyo kunye noziro ongunothi: wonke umbuzo uhamba ngapha kocingo ngokubhaliweyo okungenanto, kwaye nasiphi na isixhobo esisendleleni sinokuyila impendulo yobuxoki yeUDP ngaphantsi kwemillisecond (DNS Spoofing).

Ngokwenza i-DNS-phezu kwe-HTTPS (DoH, RFC 8484)* okanye DNS-over-TLS (DoT, RFC 7858), isixhobo sakho sisonga yonke imibuzo ye-DNS ngaphakathi kwe-cryptographically verified TLS 1.3 itonela ngqo kumsombululi othembekileyo (Cloudflare 1.1.1.1, Quad9 9.9.9.9, Google 8.8.8.8, okanye NextDNS). Ukuba i-rogue ekhohlakeleyo okanye i-Wi-Fi yehotele izama ukutshintsha impendulo, isignesha ye-TLS iyasilela kwaye isixhobo sakho siyala ukukhohlisa ngoko nangoko.

Uyenza njani i-DNS Efihliweyo (DoH / DoT) Kuzo zonke izixhobo kwiSekhondi ezingama-60¶

Imibuzo edla ngokubuzwa¶

Kutheni isikhangeli sam sibonise NET::ERR_CERT_AUTHORITY_INVALID kwi google.com okanye ibhanki yam xa i-DNS ye-router yam yathinjwa?¶

Loo mpazamo yomkhangeli zincwadi ikugcine ekubeni i-akhawunti yakho ibiwe. Xa umhlaseli eqweqwedisa useto lwe-DNS yomzila wakho, batshintsha idilesi ye-IP `www.yourbank.com` ngoko ikhomputha yakho iqhagamshela kwiseva yewebhu yomhlaseli endaweni yebhanki yakho yokwenyani. Nangona kunjalo, xa isikhangeli sakho siqalisa i-HTTPS efihliweyo (`TLS`) ukubamba isandla kunye nomncedisi womhlaseli, umncedisi womhlaseli akanakuvelisa isiqinisekiso esisebenzayo sedijithali se-TLS esisayinwe ngokufihlakeleyo liGunya elithembekileyo leSitifiketi se `yourbank.com`. Isikhangeli sakho simisa ngoko nangoko unxibelelwano kunye neziboniso `NET::ERR_CERT_AUTHORITY_INVALID`. Ngalo lonke ixesha ungaze ucofe u- "Qhubeka nokuba kunjalo" kwaye ungaze ufake iSatifikethi seNgcambu ekhohlakeleyo (`CA`) kwisixhobo sakho, ukuqweqwediswa kwe-DNS iyodwa akukwazi ukuguqulela amagama antsonkothileyo okanye ukonakalisa iwebhusayithi ye-HTTPS ekhuselwe yi-HSTS.

Ngaba ihacker ilutshintshe njani useto lwe-DNS ngaphakathi kwirutha yeWi-Fi yasekhaya ngaphandle kokwazi igama lokugqitha leWi-Fi yam?¶

Abahlaseli akufuneki babe ngaphakathi kuluhlu lwe-Wi-Fi lwendlu yakho ukuze utshintshe useto lwe-DNS yerouter yakho. Basebenzisa iindlela ezimbini ezikude: eyokuqala, i-automated bots (`Shodan` / `Censys` izikena kunye neebhotnets) skena yonke idilesi ye-IP yoluntu kwi-intanethi ijonge iirotha zasekhaya ezine **Ulawulo lweWebhu olukude (`WAN Admin`)** okanye **`UPnP`** ishiywe ivuliwe kunye nobuthathaka obaziwayo be-firmware. Okwesibini, nokuba i-WAN Admin ivaliwe, ukuba ushiye igama eligqithisiweyo lolawulo lwangaphakathi lwe-router kwindawo engagqibekanga yasefektri (`admin / admin` okanye `admin / password`), ukunqakraza intengiso ekhohlakeleyo okanye iwebhusayithi kwilaptop yakho ivumela iJavaScript efihliweyo kwisikhangeli sakho ukuba ithumele i-`CSRF`)** okanye **DNS Rebinding** cela ngqo kwilaptop yakho ukuya `http://192.168.1.1`, ukungena kwi-router yakho ngaphakathi kwaye ubhale kwakhona useto lwakho lwe-DNS ngokuthe cwaka.

Ukuba ndenza i-Encrypted DNS (DoH) kwiChrome okanye kwiFirefox, ngaba oko kuyakhusela ezinye iiapps ezikwikhompyuter yam?¶

Ukwenza i-DNS ekhuselekileyo (`DoH`) ngaphakathi kweChrome, i-Edge, iBrave, okanye iFirefox encrypts kwaye ikhusela zonke ii-DNS lookups ezenziwe ** ngaphakathi kweso sikhangeli sewebhu esikhethekileyo **, eyeka ngokukhawuleza i-browser-based phishing redirects kunye namaphepha okuhlaziya inkohliso. Nangona kunjalo, ezinye izicelo ezingasemva kwikhompyuter yakho (ezifana nomxhasi wakho we-imeyile, iSlack, imidlalo, okanye isihlaziyi se-OS) zisasebenzisa isicombululo senkqubo ebanzi ye-DNS ngaphandle kokuba uqwalasele i-Encrypted DNS kwinqanaba lenkqubo yokusebenza (usebenzisa Windows 11 Native DoH, Android Private DNS `DoT`, okanye iprofayile ye-DNS Efihliweyo ye-macOS/iOS) kwaye ulungise i-WAN/DHCP DNS yomzila wakho useto.

Yintoni umahluko phakathi 1.1.1.1 (Cloudflare) kunye 9.9.9.9 (Quad9), kwaye yeyiphi endimele ndiyibeke kumzila wam?¶

Zombini ziyakhawuleza, zihlonipha ubumfihlo, azilandeli umkhondo wehlabathi naziphi na izisombululo ze-DNS ezisetyenziswa yimibutho ethembekileyo, kwaye enye iya kukukhusela kwi-ISP okanye ukuqweqwediswa kwerouter. Umgangatho **`1.1.1.1`** (Cloudflare) kunye **`8.8.8.8`** (uGoogle) buyisela iimpendulo ezisulungekileyo, ezingahluzwanga ze-DNS kuzo zonke iindawo ezikwi-intanethi. **`9.9.9.9`** (iqhutywa yiQuad9 Foundation engenzi nzuzo) kunye **`1.1.1.2`** (iCloudflare yeeNtsapho-Ukuvalwa kweMalware) jonga ngokuzenzekelayo ujongo lwesizinda ngasinye ngokuchasene nesoyikiso sobukrelekrele bexesha lokwenyani lewebhusayithi ezaziwayo, umyalelo kunye nolawulo lwe-ransomware (`C2`) abancedisi, kunye nemimandla ye-infostealer, ivalela uxhulumaniso kumaleko we-DNS phambi kokuba iphepha eliyingozi lingalayisha.

Izikhokelo ezinxulumeneyo¶

• Ukukhusela iirotha zasekhaya kunye nezixhobo ze-IoT
• I-Wi-Fi kawonke-wonke, i-Evil Twin hotspots, kunye ne-USB juice-jacking defense
• Izandiso zesikhangeli esikhohlakeleyo, abaqweqwedisi bebhodi eqhotyoshwayo, kunye nokususwa kwe-adware
• I-Zero-day ixhaphaza i-patching engxamisekileyo kunye ne-End-of-Life device yodwa
• Ukuqweqwediswa kwegama lesizinda, iDNS ephelelwe lixesha, kunye nokuthathwa kwewebhusayithi
• Iinombolo zikaxakeka zehlabathi

Imithombo ijongiwe¶

• I-Cybersecurity kunye ne-Arhente yoKhuseleko lweZiseko (i-CISA) kunye ne-Arhente yoKhuseleko lweSizwe (i-NSA) (eUnited States): iPhepha leNgcaciso ye-Cybersecurity (* Ukukhetha i-DNS eKhuselekayo (PDNS) iNkonzo * kunye * Ukusebenzisa i-DNS efihliweyo DoH / DoT kwiNdawo yoShishino neKhaya*).
• I-Internet Engineering Task Force (IETF) (International): RFC 7858 (Inkcazo yeDNS ngaphezu koKhuseleko lweNqanaba lezoThutho DoT), RFC 8484 (Imibuzo yeDNS ngaphezulu kweHTTPS DoH), kunye ne-RFC 9462 (Ukufunyanwa kweziSombululi ezichongiweyo DDR).
• IKomiti yeNgcebiso yoKhuseleko kunye noZinzo lwe-ICANN (i-SSAC) (yamazwe ngamazwe): Ingcebiso kwi-DNS Infrastructure Tampering, i-Router WAN Reconfiguration, kunye nokuqinisekiswa kwe-DNSSEC.
• IZiko leSizwe loKhuseleko lwe-Cyber (NCSC) (eUnited Kingdom): I-DNS yoKhuselo lwe-Architecture kunye nokunciphisa i-DHCP ye-Rogue kunye ne-Local Network Spoofing Attacks.