4 ms·
What could a TLA do with this if it had time to plan ahead?
by edgineer 3y ago
What could a TLA do with this if it had time to plan ahead?
- timschmidt 3y agoServe malicious updates from a locally controlled machine, for one. Lord knows about auth.
- wrboyce 3y agoDo most DNS forwarders not block addresses that resolve to a local IP these days? I know dnsmasq does, and NextDNS too I think.
- donmcronald 3y agoI think most will see it as a DNS rebinding attack [1]. 1. https://en.wikipedia.org/wiki/DNS_rebinding https://en.wikipedia.org/wiki/DNS_rebinding
- wrboyce 3y agoThat’s the phrase I was looking for!
- drexlspivey 3y agoWhy? Having local IPs on a public DNS is a legitimate use case.
- wolverine876 3y agoIn fact, some people block domains by routing them to 127.0.0.1 in their host files. I've used private ranges too, in places where loopback might possibly do something funky.
- wrboyce 3y agoAs another reply mentioned, to prevent DNS rebinding attacks. The general expectation is you will whitelist domains from which you expect RFC1918 responses.
- charcircuit 3y agoWhy doesn't windows update use authentication (eg https)?
- acdha 3y agoThey do: the updates are signed so our hypothetical spies would need to have a zero day in Authenticode or to have compromised the signing keys.
- wolverine876 3y ago> Serve malicious updates from a locally controlled machine. Lord knows about auth. Wouldn't they have to break into my local machine first, plant an update service, and an update? That doesn't seem to scale well at all, and wouldn't it be easier to just break into the machine they want to 'update'?
- timschmidt 3y agoA fairly prominent update service already runs from the domain microsoft.com Many machines come with it preinstalled.
- wolverine876 3y agoThe erroneous DNS change wouldn't help that sort of exploit. It just redirects attempts to contact microsoft.com to a local address, probably a router.
- timschmidt 3y agoThat's exactly what I said in the first post.