4 ms·

Wow, this is an extremely serious vulnerability. People writing it off because it requires MitM. There's always a MitM, the internet is basically a MitM.

• webstrand 9mo ago
  MitM isn't even necessary, a rogue DHCP server configuring a malicious DNS could attack this.
  • kortilla 9mo ago
    That is a form of MiTM. It’s just changing DNS to IP bindings rather than IP to MAC or prefix to ISP.
  • burnt-resistor 9mo ago
    That's still a MITM, albeit a LAN-local one. Non-LAN WAN isn't the total scope of MITMs.
    • fulafel 8mo ago
      If my computer asks your computer what dns server to use, and you respond with the address of a nefarious one, it's not necessarily a mitm.
      • webstrand 8mo ago
        The MitM happens when the client sends packets to the fake IP, I think the argument goes.