Sky is intercepting and throtles traffic

dimko · 31-10-2019 9:41pm #1

I know, it's a bold statement.
But I have technical facts to back it up.

1 picture says better than 1000 of words.

1 five minute Video says better than thousands of pictures. Whic my video is 3-4 minutes, but you get the idea.

https://www.youtube.com/watch?v=xW5bP2IQIew&feature=youtu.be

A little dry theory.

1. DNS SEC. Allows you to know if someone messed with DNS settings in transition, between owner of DNS record and user of such record. Only works if specifically enabled in DNS records of specific site.

2. VPN. A way to make all traffic pass through over ISP and appear in other country.

3. VM. Virtual Machine. Is like operating system running inside of other Operating system, but as a program. Think of it as if it's Matroska.(russian doll inside of other inside of other)

So, my set up.

My Host, OS, Linux.(yep Linux as desktop), nothing unusual. Uses my Guest VM as DNS server. I don't always switch on my Guest, so DNS falls back to my standard router, which is SKY router.

My guest VM. Also Linux.(Surprise!!!) It has a DNS server, Proxy server and Tunnel. So once I switch it on and enable tunnel, i can connect all of my devices in the house to it and use tunnel. Which is mostly used for better DNS these days.

So...
proof that Sky messes with your settings. Note different hostnames in copy paste.

this is host:(none)dimko's Desktop /home/dimko

this is guest: [root@localhost dimko]#

first lets test my router on both: my host and guest.

(none)dimko's Desktop /home/dimko # dig pir.org +dnssec +multi @192.168.0.1

; <<>> DiG 9.12.3-P4 <<>> pir.org +dnssec +multi @192.168.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11886
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 9

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 1 IN A 97.107.141.235

;; AUTHORITY SECTION:
pir.org. 2 IN NS ns1.mia1.afilias-nst.info.
pir.org. 2 IN NS ns1.yyz1.afilias-nst.info.
pir.org. 2 IN NS ns1.sea1.afilias-nst.info.
pir.org. 2 IN NS ns1.ams1.afilias-nst.info.

;; ADDITIONAL SECTION:
ns1.ams1.afilias-nst.info. 5003 IN A 65.22.6.79
ns1.ams1.afilias-nst.info. 5003 IN AAAA 2001:500:6::79
ns1.mia1.afilias-nst.info. 5003 IN A 65.22.7.1
ns1.mia1.afilias-nst.info. 5003 IN AAAA 2a01:8840:7::1
ns1.sea1.afilias-nst.info. 5003 IN A 65.22.8.1
ns1.sea1.afilias-nst.info. 5003 IN AAAA 2a01:8840:8::1
ns1.yyz1.afilias-nst.info. 5003 IN A 65.22.9.1
ns1.yyz1.afilias-nst.info. 5003 IN AAAA 2a01:8840:9::1

;; Query time: 63 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Thu Oct 31 20:17:29 GMT 2019
;; MSG SIZE rcvd: 336

[root@localhost dimko]# dig pir.org +dnssec +multi @192.168.0.1

; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.2 <<>> pir.org +dnssec +multi @192.168.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43295
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 1 IN A 97.107.141.235

;; Query time: 192 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Thu Oct 31 20:15:29 GMT 2019
;; MSG SIZE rcvd: 52

So Far so bad. DNS sec is not working for the site pir.org right or servers don't support it, right?

Now lets assume that domain pir.org doesn't support - problems solved. Or not. It does support, look further.

So out of two questions left, my ISP is not competent to run reasonably old DNS server from BIND, from FREE AS IN BEER AND AS IN FREEDOME OF SPEACH, Free Software Foundation. De facto standard DNS for probably 90% of all traffic out there.

Lets take it on face value. Lets assume someone does better job at it. Someone like... Google? They are good at things right?

[root@localhost dimko]# dig pir.org +dnssec +multi @8.8.8.8

; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.2 <<>> pir.org +dnssec +multi @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58194
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 299 IN A 97.107.141.235
pir.org. 299 IN RRSIG A 5 2 300 (
20191114084004 20191031084004 18045 pir.org.
PI8B4i3MSf+mBSwYqJtolUYnVxDDS31oJqbAMxNmKdrL
9MYTF+Rl9jHbs82ARIr6R/oLpr9WZ7lnFgVq/reXsuXr
1mJbzrqBi9k8lEJ9jEbSZ6ZaGQkPgIMEG6Yf3C+ssLMB
+P064ZpgSB5g2mstrFDbO3atnV3o528TRi6akuU= )

;; Query time: 231 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 31 20:24:56 GMT 2019
;; MSG SIZE rcvd: 219

Ineed, Google are good at what they do.

So Sky are incompetent. Confirmed right here right now. But are they?

Don't attribute to incompetence, what you can attribute to maliciousness.

because if my VM over tunnel can do that, average Sean or Sinead can also do, right? Just use competent server of Google, right? 8.8.8.8

Now lets see on my host:

[root@localhost dimko]# dig pir.org +dnssec +multi @8.8.8.8

; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.2 <<>> pir.org +dnssec +multi @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58194
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 299 IN A 97.107.141.235
pir.org. 299 IN RRSIG A 5 2 300 (
20191114084004 20191031084004 18045 pir.org.
PI8B4i3MSf+mBSwYqJtolUYnVxDDS31oJqbAMxNmKdrL
9MYTF+Rl9jHbs82ARIr6R/oLpr9WZ7lnFgVq/reXsuXr
1mJbzrqBi9k8lEJ9jEbSZ6ZaGQkPgIMEG6Yf3C+ssLMB
+P064ZpgSB5g2mstrFDbO3atnV3o528TRi6akuU= )

;; Query time: 231 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 31 20:24:56 GMT 2019
;; MSG SIZE rcvd: 219

Well... huston we got a problem. Anyone half familiar with encryption and how TCP/IP works, knows, that my guest and host must have more or less same output. Could it be intermediate server is hacked somewhere between my ISP and and Google? Well,that can be case. But surely other servers are not, right?

So lets see other servers:

[root@localhost dimko]# dig pir.org +dnssec +multi @9.9.9.9

; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.2 <<>> pir.org +dnssec +multi @9.9.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37247
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 300 IN A 97.107.141.235
pir.org. 300 IN RRSIG A 5 2 300 (
20191114084004 20191031084004 18045 pir.org.
PI8B4i3MSf+mBSwYqJtolUYnVxDDS31oJqbAMxNmKdrL
9MYTF+Rl9jHbs82ARIr6R/oLpr9WZ7lnFgVq/reXsuXr
1mJbzrqBi9k8lEJ9jEbSZ6ZaGQkPgIMEG6Yf3C+ssLMB
+P064ZpgSB5g2mstrFDbO3atnV3o528TRi6akuU= )

;; Query time: 280 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Thu Oct 31 20:30:08 GMT 2019
;; MSG SIZE rcvd: 219

So far so good on guest.
lets see host:

(none)dimko's Desktop /home/dimko # dig pir.org +dnssec +multi @9.9.9.9

; <<>> DiG 9.12.3-P4 <<>> pir.org +dnssec +multi @9.9.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52107
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 1 IN A 97.107.141.235

;; Query time: 25 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Thu Oct 31 20:30:31 GMT 2019
;; MSG SIZE rcvd: 52

Well... that did not go well at all.

Coincidence. Lets see others.

[root@localhost dimko]# dig pir.org +dnssec +multi @1.1.1.1

; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.2 <<>> pir.org +dnssec +multi @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36410
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1452
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 300 IN A 97.107.141.235
pir.org. 300 IN RRSIG A 5 2 300 (
20191114084004 20191031084004 18045 pir.org.
PI8B4i3MSf+mBSwYqJtolUYnVxDDS31oJqbAMxNmKdrL
9MYTF+Rl9jHbs82ARIr6R/oLpr9WZ7lnFgVq/reXsuXr
1mJbzrqBi9k8lEJ9jEbSZ6ZaGQkPgIMEG6Yf3C+ssLMB
+P064ZpgSB5g2mstrFDbO3atnV3o528TRi6akuU= )

;; Query time: 243 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Thu Oct 31 20:32:24 GMT 2019
;; MSG SIZE rcvd: 219

(none)dimko's Desktop /home/dimko # dig pir.org +dnssec +multi @1.1.1.1

; <<>> DiG 9.12.3-P4 <<>> pir.org +dnssec +multi @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48834
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 9

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 1 IN A 97.107.141.235

;; AUTHORITY SECTION:
pir.org. 300 IN NS ns1.yyz1.afilias-nst.info.
pir.org. 300 IN NS ns1.sea1.afilias-nst.info.
pir.org. 300 IN NS ns1.ams1.afilias-nst.info.
pir.org. 300 IN NS ns1.mia1.afilias-nst.info.

;; ADDITIONAL SECTION:
ns1.ams1.afilias-nst.info. 4166 IN A 65.22.6.79
ns1.ams1.afilias-nst.info. 4166 IN AAAA 2001:500:6::79
ns1.mia1.afilias-nst.info. 4166 IN A 65.22.7.1
ns1.mia1.afilias-nst.info. 4166 IN AAAA 2a01:8840:7::1
ns1.sea1.afilias-nst.info. 4166 IN A 65.22.8.1
ns1.sea1.afilias-nst.info. 4166 IN AAAA 2a01:8840:8::1
ns1.yyz1.afilias-nst.info. 4166 IN A 65.22.9.1
ns1.yyz1.afilias-nst.info. 4166 IN AAAA 2a01:8840:9::1

;; Query time: 120 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Thu Oct 31 20:31:25 GMT 2019
;; MSG SIZE rcvd: 336

(none)dimko's Desktop /home/dimko # dig pir.org +dnssec +multi @64.6.64.6

; <<>> DiG 9.12.3-P4 <<>> pir.org +dnssec +multi @64.6.64.6
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3781
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 9

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 1 IN A 97.107.141.235

;; AUTHORITY SECTION:
pir.org. 242 IN NS ns1.ams1.afilias-nst.info.
pir.org. 242 IN NS ns1.mia1.afilias-nst.info.
pir.org. 242 IN NS ns1.sea1.afilias-nst.info.
pir.org. 242 IN NS ns1.yyz1.afilias-nst.info.

;; ADDITIONAL SECTION:
ns1.ams1.afilias-nst.info. 4108 IN A 65.22.6.79
ns1.ams1.afilias-nst.info. 4108 IN AAAA 2001:500:6::79
ns1.mia1.afilias-nst.info. 4108 IN A 65.22.7.1
ns1.mia1.afilias-nst.info. 4108 IN AAAA 2a01:8840:7::1
ns1.sea1.afilias-nst.info. 4108 IN A 65.22.8.1
ns1.sea1.afilias-nst.info. 4108 IN AAAA 2a01:8840:8::1
ns1.yyz1.afilias-nst.info. 4108 IN A 65.22.9.1
ns1.yyz1.afilias-nst.info. 4108 IN AAAA 2a01:8840:9::1

;; Query time: 24 msec
;; SERVER: 64.6.64.6#53(64.6.64.6)
;; WHEN: Thu Oct 31 20:32:24 GMT 2019
;; MSG SIZE rcvd: 336

[root@localhost dimko]# dig pir.org +dnssec +multi @64.6.64.6

; <<>> DiG 9.9.4-RedHat-9.9.4-74.el7_6.2 <<>> pir.org +dnssec +multi @64.6.64.6
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44378
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;pir.org. IN A

;; ANSWER SECTION:
pir.org. 300 IN A 97.107.141.235
pir.org. 300 IN RRSIG A 5 2 300 (
20191114084004 20191031084004 18045 pir.org.
PI8B4i3MSf+mBSwYqJtolUYnVxDDS31oJqbAMxNmKdrL
9MYTF+Rl9jHbs82ARIr6R/oLpr9WZ7lnFgVq/reXsuXr
1mJbzrqBi9k8lEJ9jEbSZ6ZaGQkPgIMEG6Yf3C+ssLMB
+P064ZpgSB5g2mstrFDbO3atnV3o528TRi6akuU= )

;; Query time: 189 msec
;; SERVER: 64.6.64.6#53(64.6.64.6)
;; WHEN: Thu Oct 31 20:33:21 GMT 2019
;; MSG SIZE rcvd: 219

I can dooooo it aaaaaal daaaaay.

[root@localhost dimko]# date
Thu Oct 31 20:34:19 GMT 2019

(none)dimko's Desktop /home/dimko # date
Thu 31 Oct 2019 08:34:06 PM GMT

(none)dimko's Desktop /home/dimko # ip -4 add |grep inet
inet 127.0.0.1/8 scope host lo
inet 192.168.0.77/24 scope global br0

[root@localhost dimko]# ip -4 addr |grep inet
inet 127.0.0.1/8 scope host lo
inet 192.168.0.37/24 brd 192.168.0.255 scope global noprefixroute dynamic eth0
inet 45.74.^^^^^/26 brd 45.74.1.191 scope global tun0

and no, i wont give full ip address of my tunnel output. Because why would i?

But I demonstrated categorically with no mistake, that SKY messes with my and probably everyone else's traffic.

Now, how did I find it?

Steam. if I use vanilla router DNS server, or any other server. my download speed is like 5meg a second.

If I use my own DNS server, speed SKYROCKETS(pun intended)

SKY reps, care to comment being caught red-handed?

ED E · 31-10-2019 11:05pm

All that and yet you can't even post it in the correct sub....

joe_99 · 31-10-2019 11:18pm

Probably to do with their Sky Buddy parental control app. You can get that firmware removed from your Hub if you ask.

killbillvol2 · 31-10-2019 11:45pm

joe_99 wrote: »

Probably to do with their Sky Buddy parental control app. You can get that firmware removed from your Hub if you ask.

Haha. That information would have saved him a lot of time!

dimko · 01-11-2019 6:20pm

joe_99 wrote: »

Probably to do with their Sky Buddy parental control app. You can get that firmware removed from your Hub if you ask.

Hm...
What exactly does it do this parental app?

I checked web interface of router, nothing with regards to parental settings.

I reset it before as well.

Adult content is available to me at my whim.

If it's adult content blocker its worst kind. Because:
1. It doesn't work.
2. It creates False positives
3. It creates false positives silently.
4. Reduces users protection for no good reason at all.

joe_99 · 01-11-2019 7:29pm

dimko wrote: »

Hm...
What exactly does it do this parental app?

I checked web interface of router, nothing with regards to parental settings.

I reset it before as well.

Adult content is available to me at my whim.

If it's adult content blocker its worst kind. Because:
1. It doesn't work.
2. It creates False positives
3. It creates false positives silently.
4. Reduces users protection for no good reason at all.

It's just firmware on modem that is needed if you sign up to Sky Buddy. Doesn't work until you sign up.

dimko · 01-11-2019 7:52pm

joe_99 wrote: »

It's just firmware on modem that is needed if you sign up to Sky Buddy. Doesn't work until you sign up.

OK, lets imagine its firmware that messes with DNS setting of router.

questioning 8.8.8.8 is entirely outside of firware scope, wouldn't it be?

I have demonstrated, that simply changing DNS settings doesn't help.
Again, pornhub or whatever else is accessible no issues.
So no, I don't take 'think of the children' argument. It's not router protection. And not a bug either. Its a bug if its DNS caching doesn't work. It's not a bug when it meddles with port 53 that destined for another IP. And even if it was, why it only affects DNSSEC traffic?

tsue921i8wljb3 · 01-11-2019 7:57pm

Try the same tests with a different modem/router and it should confirm if the Sky device is the cause.

dimko · 01-11-2019 8:56pm

Brecken Old-fashioned Flashbulb wrote: »

Try the same tests with a different modem/router and it should confirm if the Sky device is the cause.

Not really

https://www.youtube.com/watch?v=xW5b...ature=youtu.be

This proves my point and my technical explanation is sufficient to say router is not a problem.

if router cant handle DNS properly, why my DNS tests that don't involve router also fail if I use third party router?

tsue921i8wljb3 · 01-11-2019 9:10pm

I think myself and joe are saying that either the router or something further into Sky's network is intercepting DNS requests, likely due to the content filtering that joe mentioned. When you tunnel these requests cannot be intercepted.

Anyway it's highly unlikely you're going to get them to change this behaviour so I suggest you move to another ISP.

dimko · 01-11-2019 9:13pm

Brecken Old-fashioned Flashbulb wrote: »

I think myself and joe are saying that either the router or something further into Sky's network is intercepting DNS requests, likely due to the content filtering that joe mentioned. When you tunnel these requests cannot be intercepted.

Anyway it's highly unlikely you're going to get them to change this behaviour so I suggest you move to another ISP.

just so its clear, i did not use 3rd party router, but i did use 3rd party DNS server.

and i am naming and shaming them.

If you dont let others know how many more will buy a sham?

tsue921i8wljb3 · 01-11-2019 9:20pm

I am aware of what you did. Fair enough if you want to shame them, however I think you're wasting your time but that's your prerogative.

joe_99 · 01-11-2019 10:27pm

https://helpforum.sky.com/t5/Broadband/Sky-dns/td-p/3039315

kaahooters · 04-11-2019 9:52am

comcast bought sky last year, and they have merged practices, throtteling, add injection , selling profiles ect ect ect, its the main reason they dont let you use a 3rd party dns server.

lotas · 04-11-2019 2:53pm

kaahooters wrote: »

comcast bought sky last year, and they have merged practices, throtteling, add injection , selling profiles ect ect ect, its the main reason they dont let you use a 3rd party dns server.

Would DOH work?

theguzman · 04-11-2019 3:40pm

Sky are basically internet for the masses and stupid people, they are not for technically proficient users like the OP, I hate to say it but EIR are the best of a bad lot with regards to this type of stuff.

dimko · 04-11-2019 5:07pm

I have looked into some things some people were saying here. I have an idea what may be happening.
May not be malicious thing to begin with, just bad implementation from SKY.

Anyway, they asked personal contacts. Will give it to them.

Ill Keep thread updated.

DeconSheridan · 04-11-2019 10:53pm

Lets see will the FTTH roll out solve all the problems with Eir/Sky Broadband.

dimko · 04-11-2019 11:36pm

DeconSheridan wrote: »

Lets see will the FTTH roll out solve all the problems with Eir/Sky Broadband.

I can probably already get it where i live(D9)
But i get my 80 megs free of charge. so why bother?

DeconSheridan · 05-11-2019 10:00am

dimko wrote: »

I can probably already get it where i live(D9)
But i get my 80 megs free of charge. so why bother?

I suppose it depends on your broadband consumption needs and what providers are available too you in your location. The throttling is alarming and id bet that they are not the only ones doing it.

dimko · 05-11-2019 4:41pm

DeconSheridan wrote: »

I suppose it depends on your broadband consumption needs and what providers are available too you in your location. The throttling is alarming and id bet that they are not the only ones doing it.

I don't know if its throtling or just pure lack of expertise.

I try not ot make assumption here. Originally i did. Which I regret. Again, I solved my problem. If they will to fix it for others, I am landing a hand. If not - so be it.

Sky is intercepting and throtles traffic

Comments