Field notes / MadHacks 2026 / Madison, WI
It checks if your home internet is lying to you, and proves it.
Dig is an Android app. It digs down through your Wi-Fi, your router, DNS and the internet, and tells you in plain words where something is wrong. Nothing leaves your phone unless you send it.
Sample 01 / The problem / April 7, 2026
On April 7, 2026, the Justice Department and the FBI ran a court-authorized operation. It reset the DNS settings on hijacked TP-Link routers in the US so they would again obtain legitimate DNS resolvers from their ISPs.
1
The Justice Department says Russian military intelligence, GRU Unit 26165, had been stealing the logins for thousands of TP-Link routers worldwide
since at least 2024.1 The head of the FBI's Boston office said the GRU weaponized routers in more than 23 states.
1
DNS is the phone book of the internet. Your phone asks it where a website lives. A hijacked router points every device in the house at a phone book the attacker wrote. The UK's National Cyber Security Centre says the changed settings were subsequently inherited by downstream devices, for example laptops and phones.
3
Microsoft counted over 200 organizations and 5,000 consumer devices
hit by the attackers' DNS servers. In the targeted cases, it says, the attackers' server would then present an invalid TLS certificate.
2 That bad certificate is the signal Dig looks for.
None of this is new. In 2011 the DNSChanger malware re-routed more than four million computers.
5 And it will keep happening. In March 2026 the FCC put new foreign-made consumer router models on its Covered List, but the action does not impact a consumer's continued use of routers they previously acquired.
6 The old router in the closet stays in the closet.
The FBI said it was working with ISPs to provide notice
to router owners.1 So the internet provider is part of the fix. Dig is built for both ends of that phone call.
Sample 02 / The method / Layer 3, DNS
A different address proves nothing. Big sites hand out different addresses all day. So Dig makes the address prove who it is.
Step 1 / Ask twice
Dig asks the network's DNS where a site lives. Then it asks three encrypted DNS providers the same thing. It reaches them by IP address and checks their certificates, so the router has no say in it. The honest answer is the one at least two of them agree on.
Different. That is a question, not proof.
Step 2 / The certificate check
Dig connects to the address the network gave and asks for the site's certificate. It checks that certificate against the phone's own list of trusted signers, and nothing else. A real server passes. A fake one does not.
Fake, with proof
The failed certificate goes in the report. Dig only says fake when it has one.
Step 3 / The control
On the same network, google.com came back with a different address too. That is normal. Dig put that address through the same test, and it proved it is google.com. tdstelecom.com couldn't.
Different, and real
A mismatch alone is never called bad. Anything Dig can't settle is a warning or unknown.
The idea is not mine alone. Comparing a network's answer with a trusted one, and settling it with a TLS handshake, is what OONI Probe does to measure censorship, and I learned it from their spec.9 Dig's part is running it on the phone, treating the failed certificate as the proof, and then doing something about it.
Sample 03 / The fix / Phone and provider
A / On the phone
Shield is a local VPN that carries only DNS. It sends the phone's lookups over HTTPS to an encrypted DNS provider, so the router can't change the answers. Then Dig digs again on its own, and you watch the DNS layer heal.
Why a VPN? A normal Android app is not allowed to change the phone's Private DNS setting.7 Android also runs one VPN at a time, so Shield can't sit next to another one.8
B / For the support call
One page a support agent can read in 20 seconds: what is wrong, when it was found, the proof, and whether Shield is on. The full raw data rides along as dig-report.json.
You send it yourself, one ticket at a time. It is the only thing that ever leaves the phone.
Ticket T-0003 / Hijack / Demo data
Your router is sending you to fake websites.
tdstelecom.com and chase.com went to 10.42.0.1, which could not prove it is either site.
Found at 1:12 PM on Wi-Fi. Shield was off.
attached: dig-report.json
C / For the internet provider
The support desk groups tickets that name the same rogue DNS server. One ticket looks like one customer's router problem. Three tickets pointing at the same server look like an attack, and the desk says so.
From the ticket, the agent sends the customer the router fix guide. The tickets and campaigns export as CSV or JSON.
Sample 04 / Screens / From the build
Sample 05 / Lab results / Measured
Every number in this section comes from a run. Where a run has not finished, the slot says pending. I would rather show an empty slot than a number I made up.
The fuzzer feeds Dig DNS answers, packets and certificates that are broken on purpose, and checks that it never falls over.
Sample 06 / Privacy and limits / Plain words
Sample 07 / Take one home / Android
Dig is free software. Read the code, build it yourself, or install the release.
Check the file before you install it. Run sha256sum dig.apk and compare the result with the SHA-256 on this page.