3 ms·
Is there any chance that when asked to contact a service, your locked down machines first issue a DNS lookup to determine where to try to connect to, before the
by jameshart 5y ago
Is there any chance that when asked to contact a service, your locked down machines first issue a DNS lookup to determine where to try to connect to, before the connection attempt gets blocked by your aggressive whitelisting?
If so, there might still be a DNS exfiltration vulnerability even on your tightly controlled setup.
- mrweasel 5y agoThat is a good point. Staying safe is insanely difficult.
- bostik 5y agoYes, that's already been established as an exfiltration vector: https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j https://www.fastly.com/blog/digging-deeper-into-log4shell-0d... - note the ${jdni:dns:...} syntax bit in the middle. Combined with the WAF bypasses due to recursive expansion, this is going to get worse still.