Adaway: Feature: DNS logging/capture for "private DNS" (Android 9+)

[TanyaEleventhGoddess]

Starting from Android 9 the feature private DNS is implemented
This means that DNS traffic will be sent over a TLS connection, thus making tcpdump uneffective
Please develop another method of capturing requested sites that works even if this function is enabled

[PerfectSlayer]

Hi @TanyaEleventhGoddess

Thanks for the report.

Is the issue only with "show DNS request" feature using tcpdump?
Is the hosts file blocking still honored?

[TanyaEleventhGoddess]

Sat, 17 Aug 2019 00:50:10 -0700 Bruce BUJON [e-mail]:

Hi @TanyaEleventhGoddess

Thanks for the report.

Is the issue only with "show DNS request" feature using tcpdump?
Is the hosts file blocking still honored?

Yes, the issue is only with "show DNS request" feature using tcpdump

Yes, even when setting DNS over TLS through "private DNS" function the
hosts file is still honored, I had a proof of that when an app refused
to load content without whitelisting some domains

[PerfectSlayer]

Okay so I might need to look at tcpdump manual to find the new request pattern to apply…

[TanyaEleventhGoddess]

Sat, 17 Aug 2019 05:29:34 -0700 Bruce BUJON [e-mail]:

Okay so I might need to look at tcpdump manual to find the new
request pattern to apply…

I totally don't think you can use tcpdump, DNS over TLS is thought
exactly for making useless the sniffing tools like the one you're using

DNS over TLS means it's sent encrypted, so for reading his content you
need to know the secret key decided by the application or the system
resolver

You'll need to grab address requests before they are sent to the system
resolver, and if the target application uses his own component for DNS
over TLS queries it will be useless
https://developer.android.com/about/versions/pie/android-9.0-changes-28

[Vankog]

Sounds like we need some kind of proxy with a trusted certificate, I guess.
However, maybe this issue might be resolved in future. There are rumours about a dynamic blocking approach...

[PerfectSlayer]

@TanyaEleventhGoddess

You'll need to grab address requests before they are sent to the system
resolver

I will definitely need to look more at it. I don't know (yet) how to do it.

if the target application uses his own component for DNS
over TLS queries it will be useless

I wrote a POC in the past (which was never released) based on a custom DNS over TLS resolver. The issue is it requires root to bind to the default port so I did not investigate further.

@Vankog

Sounds like we need some kind of proxy with a trusted certificate

I really don't want to do that. As AdAway is open source, if user installs a trusted certificate, anyone could get the private key from source and use it to do MITM.

There are rumours about a dynamic blocking approach...

Do you have some source or pointers here? I would love to have a look to it 😉

[TanyaEleventhGoddess]

Sat, 17 Aug 2019 23:39:00 -0700 Bruce BUJON [e-mail]:

@TanyaEleventhGoddess

You'll need to grab address requests before they are sent to the
system
resolver

I will definitely need to look more at it. I don't know (yet) how to
do it.

if the target application uses his own component for DNS
over TLS queries it will be useless

I wrote a POC in the past (which was never released) based on a
custom DNS over TLS resolver. The issue is it requires root to bind
to the default port so I did not investigate further.

@Vankog

Sounds like we need some kind of proxy with a trusted certificate

I really don't want to do that. As AdAway is open source, if user
installs a trusted certificate, anyone could get the private key from
source and use it to do MITM.

There are rumours about a dynamic blocking approach...

Do you have some source or pointers here? I would love to have a look
to it 😉

Plus a private proxy sounds very resource-consuming

It's true that it will be active for short amounts of time (monitoring)
but still

[haroon-mit]

Dear all,,

it is to request you please give info about mobile apps , like whatsapp etc i wana block mobie app on pfsense.

[willemduncan]

Came here to report exactly this issue and make this request.

In the mean time, please update the wiki page for LogDNS. It was one of the first search results I got when trying to find why it wouldn't work. First off it no longer matches the UI, and second it should state that it doesn't work with private DNS.

Maybe check private DNS status and give a warning in the app? Preferably one that can switch it off/on right there and then.

Right now it pretends to work but logs nothing, and it took me way too long to realize I'm using a private DNS, slap my forehead, and switch it off.

[Vankog]

In the mean time, please update the wiki page for LogDNS. It was one of the first search results I got when trying to find why it wouldn't work. First off it no longer matches the UI, and second it should state that it doesn't work with private DNS.

Thanks, I added a disclaimer to the page.

[willemduncan]

Thanks for updating, but it is still incorrect.

Private DNS is new in Android Pie, but it is a user option and off by default. Setting found under Settings → Network & internet → Advanced → Private DNS. As long as it is set to off the DNS logging works correct.

So basically, ensure that it is off while logging, and can switch it back on afterwards.

[Vankog]

Thanks for the info. Very valuable to work with.
I updated the page again.

Does the setting also exist/work in Android 10? I am still on 9 for the moment.

[willemduncan]

Have no devices running 10 yet, sorry.

[Ghostbird]

The option is present in Android 10/Q and has default value "Automatic". Which might mean that it automatically upgrades to DNS over TLS whenever your DNS server supports it.
You can still set it to "off", or set it to a specific TLS enabled server as which seems to mean that if you do so, it is always on.

So you might automatically be using encrypted DNS in Android 10. Switch it off if you encounter TCPDump problems.