4 ms·

> In this part you’re confusing what a rebinding attack is: by serving a DNS response with a short TTL an attacker is able to associate two different IPs But i

> In this part you’re confusing what a rebinding attack is: by serving a DNS response with a short TTL an attacker is able to associate two different IPs But it doesn't really work. I query my DNS, on my home router, not your DNS. And the DNS on my home router query the ISP's DNS, which caches requests. I bet you can't go below few minutes resolution. I had this problem when validating the Letsencrypt DNS challenge, I had to let certbot run for almost 20 minutes before my home router picked up the new value. When I'm at work, I use the company's DNS, which ignores non standard TTLs and caches the first answer forever (well... almost) and disallow external domains that resolve to reserved IP addresses.

tgragnato 7y ago
Depends on the resolver configuration. E.g.: unbound has cache-min-ttl, a way to increase cache efficiency (and a mitigation for attacks such as rebinding). > Time to live minimum for RRsets and messages in the cache. Default is 0. If the the minimum kicks in, the data is cached for longer than the domain owner intended, and thus less queries are made to look up the data. Zero makes sure the data in the cache is as the domain owner intended, higher values, especially more than an hour or so, can lead to trouble as the data in the cache does not match up with the actual data any more. Which is one of the reasons I think this is manly effective against home networks.
OvermindDL1 7y ago
Wait, doesn't the certbot DNS challenge query the nameservers of the domain being checked, not your local DNS resolver, otherwise my fast DNS challenges should fail?
- lostjohnny 7y ago
  Not by default [1], but you can set it to what you prefer. But in my case my network is configured to always reach the in house DNS first, to keep latency low [1] https://github.com/letsencrypt/boulder/blob/8167abd5e3c7a1427b1cfb459f50b18b44e45d5b/bdns/dns.go#L244 https://github.com/letsencrypt/boulder/blob/8167abd5e3c7a142...

tgragnato 7y ago

Depends on the resolver configuration. E.g.: unbound has cache-min-ttl, a way to increase cache efficiency (and a mitigation for attacks such as rebinding). > Time to live minimum for RRsets and messages in the cache. Default is 0. If the the minimum kicks in, the data is cached for longer than the domain owner intended, and thus less queries are made to look up the data. Zero makes sure the data in the cache is as the domain owner intended, higher values, especially more than an hour or so, can lead to trouble as the data in the cache does not match up with the actual data any more. Which is one of the reasons I think this is manly effective against home networks.

OvermindDL1 7y ago

Wait, doesn't the certbot DNS challenge query the nameservers of the domain being checked, not your local DNS resolver, otherwise my fast DNS challenges should fail?

lostjohnny 7y ago
Not by default [1], but you can set it to what you prefer. But in my case my network is configured to always reach the in house DNS first, to keep latency low [1] https://github.com/letsencrypt/boulder/blob/8167abd5e3c7a1427b1cfb459f50b18b44e45d5b/bdns/dns.go#L244 https://github.com/letsencrypt/boulder/blob/8167abd5e3c7a142...