Blizzard games were vulnerable to DNS rebinding attack
bugs.chromium.org
Blizzard games were vulnerable to DNS rebinding attack
1–10 of 94 posts
Re: Blizzard games were vulnerable to DNS rebinding attack
#2Disappointing (lack of) response/fix
Would have assumed they'd do better given how polished their consumer products are
Re: Blizzard games were vulnerable to DNS rebinding attack
#3the DNS rebinding vulnerability exists in applications other than Blizzard games, such as this one in Bittorrent Transmission also reported by Tavis Ormandy....
https://github.com/transmission/transmission/pull/468
Seems to be a quite prevalent issue...
Re: Blizzard games were vulnerable to DNS rebinding attack
#4Disappointing (lack of) response/fix Would have assumed they'd do better given how polished their consumer products are
Could someone explain in the most accessible language, how a problem like this could even be fixed?
Re: Blizzard games were vulnerable to DNS rebinding attack
#5So basically this is a local web server that is used for IPC? Is there a reason to do local IPC over TCP/IP, rather than over named pipes / unix pipes, other than not knowing about the existence of named pipes / unix pipes?
Re: Blizzard games were vulnerable to DNS rebinding attack
#6the DNS rebinding vulnerability exists in applications other than Blizzard games, such as this one in Bittorrent Transmission also reported by Tavis Ormandy.... https://github.com/transmission/transmission/pull/468 Seems to be a quite prevalent issue...
That's because for decades binding to localhost has been taken to mean "only users on the local machine can access this". Now chrome is breaking that assumption through a leaky sandbox, and demanding everyone else change rather than fixing their own security issues.
Re: Blizzard games were vulnerable to DNS rebinding attack
#7So basically this is a local web server that is used for IPC? Is there a reason to do local IPC over TCP/IP, rather than over named pipes / unix pipes, other than not knowing about the existence of named pipes / unix pipes?
In the case of Transmission I think it may have been used both as IPC and as a remote connection.
Re: Blizzard games were vulnerable to DNS rebinding attack
#8Disappointing (lack of) response/fix Would have assumed they'd do better given how polished their consumer products are
Could someone explain in the most accessible language, how a problem like this could even be fixed?
Last comment in report:
> Their solution appears to be to query the client command line, get the 32-bit FNV-1a string hash of the exename and then check if it's in a blacklist. I proposed they whitelist Hostnames, but apparently that solution was too elegant and simple.
It looks like they just block specific browsers from doing the exploit, except they have to actively maintain the blacklist, which is sub-optimal.
Re: Blizzard games were vulnerable to DNS rebinding attack
#9The vulnerable update daemon is running all of the time if you've installed any Blizzard game in the past, not just if you currently play Blizzard games?
Re: Blizzard games were vulnerable to DNS rebinding attack
#10the DNS rebinding vulnerability exists in applications other than Blizzard games, such as this one in Bittorrent Transmission also reported by Tavis Ormandy.... https://github.com/transmission/transmission/pull/468 Seems to be a quite prevalent issue...
That's because for decades binding to localhost has been taken to mean "only users on the local machine can access this". Now chrome is breaking that assumption through a leaky sandbox, and demanding everyone else change rather than fixing their own security issues.
Can you explain why this is a Chrome-specific issue? I believe that it applies to all web browsers, including Internet Explorer for UNIX (which I do have access to and I can test if you would like me to confirm). I remember this being a vulnerability class with CUPS, which listens on http://localhost:631/, about 10 years ago.
In particular, note that the request is not made to localhost, it's made to a DNS name that simply happens to resolve to 127.0.0.1. Should Chrome and also all other web browsers add a special case for DNS names that resolve to 127.0.0.1?