4 ms·
This can be pretty bad in a world where AWS ELB IP addresses change regularly.
by zwily 10y ago
This can be pretty bad in a world where AWS ELB IP addresses change regularly.
- cjbprime 10y agoWhy? The OP is only proposing using a cached result when there's no updated record available.
- toomuchtodo 10y agoServing wrong records is usually worse than serving no records. EDIT: It would be fine as long as your site only served HTTPS content and HSTS was enabled for your domain, preventing any sort of MITM attack.
- cjbprime 10y agoIf your DNS server is offline, is the last record it returned when it was online really the "wrong" one? There'd be no right one in that case.
- detaro 10y agoExactly. You can't know if it is still valid, so you might send clients to an IP that's now controlled by somebody else. Worst case, they know and set up a phishing site. DNS generally has been reliable enough that the trade-off is not worth it.
- mynameisvlad 10y ago> Worst case, they know and set up a phishing site. They'd need to specifically gain access to the last known good IP address, which might be different depending on which DNS resolver you talk to (geodistribution, when the record was last updated, etc). I wouldn't really consider that a realistic attack vector.
- romaniv 10y agoWithing a small hosting provider this might be pretty simple. Attacker might lease a bunch of new servers and get the IP that was recently released. Then they could launch a DDoS to force address resolution in their favor. It's a bit far-fetched, but a lot of very successful attacks seem that way until someone figures out a way to pull them off.
- mynameisvlad 10y agoSure, within a small host or ISP, that may be doable; even then, I'd consider it a stretch. But if we were to limit it to those constraints, when will this ever be exploited except as a PoC? No entity large enough to actually want to run this exploit on has an architecture where this would be feasible (due to things like geodistribution and load balancing), nor would be hosted on a provider so small that their IP pool can be exploited in the manner described. If I were an attacker, I'd focus on something with much bigger RoI.
- Kalium 10y agoHow about DNS cache poisoning? Serving stale data combined with a DDoS on the root resolver makes DNS cache poisoning more dangerous by prolonging it.
- cakeface 10y agoI like this idea. Grab a new elastic IP on AWS. Set up an EC2 listening on 80, maybe some other interesting ports, and see if anything juicy comes in. Or just respond with some canned SPAM or phishing attempt. Repeat.
- zwily 10y agoI guarantee you'll get lots of weird traffic. We do all the time on our ELB-fronted app servers.
- Godel_unicode 10y agoYes. You either positively know the right answer, or you return the fact that you don't know the right (currently valid per the spec) answer. The right answer in the situation you posed is "I don't know".