Proj 3x: DNSCrypt on Windows (15 pts.)

What you need

Purpose

First you'll observe normal DNS traffic, and see how it compromises your privacy by sending domain names over the network in plaintext.

After installing a DNSCrypt client, you'll see that some private DNS traffic is now encrypted.

Stopping your DNS Server

If you are using a shared machine, or taking CNIT 40, your Winows machine may be a DNS server. Open Server manager and stop the DNS server, as shown below.

Disabling IPv6 and Using Automatic Addressing

Click Start. In the Search box, type NETWORK. Open "Network and Sharing Center".

In "Network and Sharing Center", click "Manage Network Connections" (Microsoft changes the name of this option in every version of Windows, because they are evil and cruel).

In "Network Connections", right-click "Local Area Connection" (or whatever the name of the adapter that goes to the Internet is), and click Properties.

In "Network Connections", make clear the check box next to "Internet Protocol Version 6 (TCP/IPv6)", as shown below.

In "Local Area Connection Properties", double-click "Internet Protocol Version 4 (TCP/IPv4)".

Make sure both the IP address and DNS servers are set to automatically configure, as shown below. Click OK. Click OK.

Installing Wireshark

If you don't already have Wireshark installed, get it here:

https://www.wireshark.org/

Viewing Normal DNS Traffic

Open Wireshark. On the left side of the screen, click "Local Area Connection", as shown below, (or the name of the adapter going to the Internet, if yours is different) and click Start.

At the top of the Wireshark window, in the Filter: bar, enter this code:

frame contains facebook && dns
Press Enter.

Now Wireshark will only show DNS traffic containing "facebook".

Open a web browser and go to

facebook.com

Wireshark should show DNS traffic resolving domain names at facebook, as shown below. You may need to expand the window, or scroll sideways, to see it.

From the Wireshark menu bar, click Capture, Stop.

Saving a Screen Image

Make sure Wireshark is visible, showing facebook in the captured packets, as shown above.

Capture a whole-desktop image.

Save the image with the filename "Your Name Proj 3xa". Use your real name, not the literal text "Your Name".

YOU MUST SUBMIT AN IMAGE OF THE WHOLE DESKTOP TO GET FULL CREDIT!

Privacy Implications

This is pretty nasty--anyone who inspects network traffic can see what sites each person is visiting anytime. Monitoring DNS is a common technique used to catch employees doing forbidden Web surfing at work. To maintain privacy, this traffic should be encrypted, but the DNS protocol doesn't include that option.

Downloading dnscrypt-winservicemgr

In a Web browser, go to

https://github.com/simonclausen/dnscrypt-winservicemgr

On the right side, click the green "Clone or Download" button. Click "Download ZIP".

On your Windows machine, right-click the dnscrypt-winservicemgr-master.zip file and click "Extract All...", Extract.

A "dnscrypt-winservicemgr-master" folder opens.

Double-click the dnscrypt-winservicemgr-master sub-folder to open it.

Double-click the "DNSCrypt Windows Service Manager Package" sub-folder to open it.

Right-click the dnscrypt-winservicemgr application, as shown below. Click "Run as Administrator".

Move the other windows or minimize them, to find the "DNSCrypt Windows Service Manager" box. It should say "DNSCrypt Service is Enabled", as shown below.

Although it claims to be working, it isn't, because the default DNS server in Canberra no longer works.

In the the "DNSCrypt Windows Service Manager" box, click the Disable button.

In the "Select Provider" list, select OpenDNS, as shown below.

In the the "DNSCrypt Windows Service Manager" box, click the Enable button.

Restarting Packet Capturing

In Wireshark, from the menu bar, click Capture, Start. Click "Continue without Saving".

At the top of the Wireshark window, in the Filter: bar, enter this code:

frame contains kitten && dns
Press Enter.

In a Web browser, go to

kittenwar.com

Wireshark still shows DNS requests, leaking information about the URL you are visiting, as shown below.

In Wireshark, click Capture, Stop.

Adjusting the DNS Resolver Address

Although your computer is running a DNS Proxy service, you have not configured your operating system to use it.

Click Start. In the Search box, type NETWORK. Open "Network and Sharing Center".

In "Network and Sharing Center", click "Manage Network Connections"

In "Network Connections", right-click "Local Area Connection" (or whatever the name of the adapter that goes to the Internet is), and click Properties.

In "Local Area Connection Properties", double-click "Internet Protocol Version 4 (TCP/IPv4)".

Set the DNS server to

127.0.0.1
as shown below.

Click OK. Click OK.

Restarting Packet Capturing

In Wireshark, from the menu bar, click Capture, Start. Click "Continue without Saving".

At the top of the Wireshark window, in the Filter: bar, enter this code:

frame contains msn && dns
Press Enter.

In a Web browser, go to

msn.com

Wireshark doesn't find any packets containing "msn", as shown below.

Now you have more privacy!

Viewing DNSCrypt Packets

At the top of the Wireshark window, in the Filter: bar, enter this code:
udp.port == 443
Press Enter.

In Wireshark, click Capture, Stop.

In the middle pane of Wireshark, expand the Data section (it may be labeled Payload) to show the random numbers, as shown below--this is the encrypted DNS data used by DNSCrypt.

Saving a Screen Image

Make sure these Data or Payload section is visible, showing random numbers.

Capture a whole-desktop image.

Save the image with the filename "Your Name Proj 3xb". Use your real name, not the literal text "Your Name".

YOU MUST SUBMIT AN IMAGE OF THE WHOLE DESKTOP TO GET FULL CREDIT!

Turning in your Project

Send the image to: cnit.129s@gmail.com with a subject line of "Proj 3x From Your Name", replacing Your Name with your own first and last name. Send a Cc to yourself.

Source

How to use DNSCrypt on Windows

Thanks to "var_x" for a tip that led to this project.

Rev. 10-12-16 by Sam Bowne