FYI - Chrome bypasses your DNS Resolvers

[TraderStf]

Hello,

Block (www.)facebook.com in routeur, /etc/hosts, littlesnitch...
All DNS Resolvers are set to e.g. : 1.1.1.1 ip4/6
8.8.8.8 or others google DNS IP4/6 are NOT existing anywhere
No VPN...

Click on a facebook.com link.

After few seconds, FaceCrooK can't be reached
LittleSnitch displays Chrome wants to connect to 8.8.8.8, Deny, 8.8.8.4

Chrome bypasses user/router/mac settings 👎

To disable this:

Chrome prefs
Google-Sync
Disable ~'display site suggestions if it can not be reached'

Thanks

MC & HNY ⛄️

[drduh]

Good eye, may make sense to sinkhole traffic to those addresses with PF as well.

[TraderStf]

Will test few others. wonder if it's chrome or chromium.

Should make a sinkhole for internet apps: chrome, ff, safari, mail...

I think to all the checking included in them: update, safe site, pw stolen... and more obvious one like 'remote-fonts' and all those little 'nice trackers' provided for our security 👀

[TraderStf]

FYI, for the sinkhole
https://developers.google.com/speed/public-dns/docs/dns64

[TraderStf]

FYI, don't want to create a new case. We should have some kind of blabla case/posts.

This might perhaps interest you
https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/

I will post asap the connections made by most browsers.

[drduh]

Updated with 7aa6381