swhx7
Premium
join:2006-07-23
Elbonia
 ·RoadRunner Cable
| Re: Anti-DNS pinning & DNS-rebinding attacks! Good stuff jansson_mark. The pdf is fascinating.
Browsers are supposed to protect against this by "pinning", i.e. requiring the IP-to-domain-name match-up to remain the same for an interval. But Jackson et al. in the pdf make clear that the major browsers don't do this very well. So even without plugins, there are some big gaps.
You can protect against outside access to other LAN devices by hardening within the LAN and by patching your firewall to not allow external names to resolve to internal addresses. But the browser can still be expoited to send spam or direct attacks at other external computers in which case the victim will appear responsible.
There's more I haven't read yet. Mozilla, Microsoft, Apple and Opera need to get on this. |
