4 ms·
In a past life I had to write some DNS rebind attacks for some CPE testsuite software that is out there. It was very easy to write some javascript that hangs o
by digitalsushi 10y ago
In a past life I had to write some DNS rebind attacks for some CPE testsuite software that is out there.
It was very easy to write some javascript that hangs out in the browser, gets the updated DNS host as the 192.168.0.1 address (sure sure, you can go crazy guessing other addresses) and then about 60% of everyone was on admin:admin or something as common; the first 12 or so bits of an ethernet address are the vendor identifier, which makes the process even easier to assume. Then you just start posting data to well-known web admin interfaces and update the router password.
I have no idea how well this works, three or four years later...
- nathan_f77 10y agoWOW. That's just... wow. You might even be to upload new firmware. And you could do all of that inside a hidden iframe with it's own domain, so the parent page DNS never needs to change.
- jacobsenscott 10y agoPretty sure it still works just fine.
- richardwhiuk 10y agoI wonder there's a solution by requiring a PTR record pointing at each A record which should have Same Origin Policy applied.
- linkregister 10y agoThis would break shared hosting, load balancers, or any other architecture without a unique IP address per hostname. I don't think this is feasible unless it's applied to IPv6 only due to IPv4 scarcity.
- richardwhiuk 10y agoYou can have multiple PTR records.
- IshKebab 10y agoFortunately most routers have a random default password now, rather than admin or changeme or whatever. At least that's what I've found; I guess it might be regional.