4 ms·

>PS: This has been reported to the ethereum foundation but they don’t consider it a valid vulnerability. How are DNS rebinding attacks not a valid vulnerabilit

>PS: This has been reported to the ethereum foundation but they don’t consider it a valid vulnerability. How are DNS rebinding attacks not a valid vulnerability?

sneak 9y ago
The user chose to run an unauthenticated service on localhost. Anything on localhost (eg a browser) can access it without authentication. The vulnerability is allowing the service to run without authentication.
- shawnz 9y ago
  Yes, the same-origin policy is just meant to prevent one website from accessing/using the cookies of another website. It is not designed to prevent web applications from accessing network resources.
- Drdrdrq 9y ago
  This is not how I understood OP - victim just happens to visit attacker.com, everything else is up to attacker. Or am I missing something?
  - scottydelta 9y ago
    The victim needs to be running a local geth node(with his wallet unlocked for hacker to actually steal funds) which will give the attacker the wallet addresses atleast.
tscs37 9y ago
They are but it's not a problem of the ethereum foundation. Rather, it's a problem of DNS resolvers and browsers.
- tinus_hn 9y ago
  Having a service accepting commands with no authorization is a vulnerability. If there are multiple users on the machine they can empty each other’s wallets.
  - tscs37 9y ago
    Localhost is, to some extend, a trusted context. Additionally this requires not having a password on your wallet.
    - tinus_hn 9y ago
      In most cases, especially ones like this, that trust is misplaced and dangerous.
      - tscs37 9y ago
        That's more fault of the browser to allow an untrusted context to access a trusted context while circumventing the usual protections (ie, CORS; SOP)
        tinus_hn 9y ago
        These ‘protections’ do not provide a ‘trusted context’ and cannot defend you from another user on the same computer. Now your next mistake will be saying ‘but typically there’s only one user’ which is irrelevant because the system runs services as different users for isolation purposes and this vulnerability ignores this isolation.

>PS: This has been reported to the ethereum foundation but they don’t consider it a valid vulnerability. How are DNS rebinding attacks not a valid vulnerability?

sneak 9y ago

The user chose to run an unauthenticated service on localhost. Anything on localhost (eg a browser) can access it without authentication. The vulnerability is allowing the service to run without authentication.

shawnz 9y ago
Yes, the same-origin policy is just meant to prevent one website from accessing/using the cookies of another website. It is not designed to prevent web applications from accessing network resources.
Drdrdrq 9y ago
This is not how I understood OP - victim just happens to visit attacker.com, everything else is up to attacker. Or am I missing something?
- scottydelta 9y ago
  The victim needs to be running a local geth node(with his wallet unlocked for hacker to actually steal funds) which will give the attacker the wallet addresses atleast.

tscs37 9y ago

They are but it's not a problem of the ethereum foundation. Rather, it's a problem of DNS resolvers and browsers.

tinus_hn 9y ago
Having a service accepting commands with no authorization is a vulnerability. If there are multiple users on the machine they can empty each other’s wallets.
- tscs37 9y ago
  Localhost is, to some extend, a trusted context. Additionally this requires not having a password on your wallet.
  - tinus_hn 9y ago
    In most cases, especially ones like this, that trust is misplaced and dangerous.
    - tscs37 9y ago
      That's more fault of the browser to allow an untrusted context to access a trusted context while circumventing the usual protections (ie, CORS; SOP)
      - tinus_hn 9y ago
        These ‘protections’ do not provide a ‘trusted context’ and cannot defend you from another user on the same computer. Now your next mistake will be saying ‘but typically there’s only one user’ which is irrelevant because the system runs services as different users for isolation purposes and this vulnerability ignores this isolation.