5 ms·

In what universe does it make sense for a DNS server to serve records that point to 127.0.0.1?? This DNS Rebinding hack should be easy to eliminate: only etc/

• k2xl 10y ago
  I could imagine there may be systems that don't connect to the internet but maybe want to use DNS protocol to coordinate to other systems.
  • EdSharkey 10y ago
    Then for that oddball one-off system, there's a kernel compilation flag that is impossible to find in obfuscated C and assembler that you can set named UNSAFE_ALLOW_REMOTE_DNS_RECORDS_DRAGONS = true where the default setting is always FALSE. Can someone who does kernel or DNS client development in operating systems comment? Am I nuts or is DNS nuts?
• nneonneo 10y ago
  DNS rebinding can also be used to attack private addresses, for which it would be perfectly legal to have real DNS names (think DNS entries for a company's intranet). Blacklisting localhost only offers a bit of security against silly devs, but arguably pivoting an attack from a public server to a private network is much more valuable and harder to stop.
  • EdSharkey 10y ago
    Well, that sounds super bad too! There should be some central network policy in the enterprise that says a DNS record coming from outside the company can't point to addresses on the 10.xx.xx.xx or 192.168.xx.xx spaces. I'm surprised that isn't already the common configuration.
    • X-Istence 10y ago
      Unbound has that as a possibility in the recursive DNS resolver. Super simple to set up too: # Enforce privacy of these addresses. Strips them away from answers. # It may cause DNSSEC validation to additionally mark it as bogus. # Protects against 'DNS Rebinding' (uses browser as network proxy). # Only 'private-domain' and 'local-data' names are allowed to have # these private addresses. No default. private-address: 10.0.0.0/8 private-address: 172.16.0.0/12 private-address: 192.168.0.0/16 private-address: 169.254.0.0/16 private-address: fd00::/8 private-address: fe80::/10 private-address: 127.0.0.0/8
• Faaak 10y ago
  Why would DNS be broken ? It's only an IP address. If you don't like the localhost part, then just change it to its IPv6 counterpart: "::1". And if you think that it should be blacklisted too, then you could use the computer's temporary IPv6. But then, you could also use 127.x.y.z (so you'd have to "blacklist" all the 127.0.0.0/8 range). And also blacklist the 192.168.x.y range (more specifically an attacker could be that your router serves 192.168.1.x with DNS starting at x=100, so serve the 192.168.1.100). Then at this point you realise that its not DNS that's broken but the underlying applications.
  • EdSharkey 10y ago
    So you're saying a remote DNS server should be able to serve up a record that points to a localhost address? This is too clever by half, we simply shouldn't allow it! Just because a localhost address is in the IPv4 address space doesn't make it just some ordinary address. And applications aren't broken, the local operating system's network software is being hacked in this case of DNS Rebinding.
• inferiorhuman 10y ago
  I'm not excusing it, but at megacorp we had an entry for localhost.megacorp.com to allow devs to get past the oauth whitelist. And, yes, it's on their public DNS (just checked). I do remember, however, that either my ISP or whatever DNS voodoo DD-WRT was doing blocked resolution of things in 127.0.0.0/8.
  • EdSharkey 10y ago
    That is super horrible.
    • inferiorhuman 10y ago
      This was only added to the whitelist for the non-production environments of course, still not great.
      • EdSharkey 10y ago
        Ah, horrible-twice-removed, then. Hehe!