Disappointing (lack of) response/fix Would have assumed they'd do better given how polished their consumer products are
Could someone explain in the most accessible language, how a problem like this could even be fixed?
[deleted]
Blizzard games were vulnerable to DNS rebinding attack
31–40 of 94 posts
Re: Blizzard games were vulnerable to DNS rebinding attack
#32Earlier quoted context omitted.
That's because for decades binding to localhost has been taken to mean "only users on the local machine can access this". Now chrome is breaking that assumption through a leaky sandbox, and demanding everyone else change rather than fixing their own security issues.
Can you explain why this is a Chrome-specific issue? I believe that it applies to all web browsers, including Internet Explorer for UNIX (which I do have access to and I can test if you would like me to confirm). I remember this being a vulnerability class with CUPS, which listens on http://localhost:631/ , about 10 years ago. In particular, note that the request is not made to localhost, it's made to a DNS name that…
How about caching a DNS result for the duration of a tab? Doesn't solve everything but probably good enough. I don't think it'd break many things (sure it may affect some round robin DNS things for long-open pages that are Ajax'ing back home frequently, but that should be minimal)
Re: Blizzard games were vulnerable to DNS rebinding attack
#33Earlier quoted context omitted.
It looks like is an HTTP API server that's only intended to be used by other programs on the local machine that explicitly know about it, not by any HTTP client that happens to run on the local machine (like a web browser, or an embedded web browser in some random app). They appear to have an authentication step by having the first URL return a token, and requiring you pass the token to all other URLs, but that doesn…
It could also be an attempt at actually integrating with a regular web browser on regular web pages. Perhaps for things like launching a locally installed game to join a multiplayer match by clicking a start button on a match-making website, by triggering the local http server with a cors request? I know that at least spotify has something similar for interfacing with your locally installed desktop client on a regula…
If you want to do that, just do a normal cryptographic signature thing - have the website sign requests with a private key that's kept by Blizzard, and have clients check that requests are signed.
(It sounds like that's not what's happening here because the patch checks for browser EXE names and refuses connections from them, but I'm not quite sure.)
Re: Blizzard games were vulnerable to DNS rebinding attack
#34Developer 101: if you want to do a blacklist, do a whitelist instead.
Ok i need a whitelist of every url but ones that start with facebook ... go
Re: Blizzard games were vulnerable to DNS rebinding attack
#35> Any website can simply create a dns name that they are authorized to communicate with, and then make it resolve to localhost. So if I understand this correctly, websites can now bypass all firewalls and send traffic to any _local_ port at will? It also seems that this same trick would apply to local/intranet IPs (e.g. have domains that redirect to 192.168.0.x) allowing interaction with things like printers. While B…
Agreed. Not that lost ago, there was a post about how a BitTorrent client had a similar issue. Just like in that case, the real vulnerability was in browsers. I wonder how many programs are going to be discovered to be “vulnerable” before people realize that they are missing the point.
Re: Blizzard games were vulnerable to DNS rebinding attack
#36> Any website can simply create a dns name that they are authorized to communicate with, and then make it resolve to localhost. So if I understand this correctly, websites can now bypass all firewalls and send traffic to any _local_ port at will? It also seems that this same trick would apply to local/intranet IPs (e.g. have domains that redirect to 192.168.0.x) allowing interaction with things like printers. While B…
Yes. This same thing can be used to attack web crawlers: you can cajole the crawler into making web requests to localhost or private networks.
Re: Blizzard games were vulnerable to DNS rebinding attack
#37Earlier quoted context omitted.
That's because for decades binding to localhost has been taken to mean "only users on the local machine can access this". Now chrome is breaking that assumption through a leaky sandbox, and demanding everyone else change rather than fixing their own security issues.
Can you explain why this is a Chrome-specific issue? I believe that it applies to all web browsers, including Internet Explorer for UNIX (which I do have access to and I can test if you would like me to confirm). I remember this being a vulnerability class with CUPS, which listens on http://localhost:631/ , about 10 years ago. In particular, note that the request is not made to localhost, it's made to a DNS name that…
> I believe that it applies to all web browsers
It does not apply to late versions of Presto, where there was similar treatment of requests to various special-use addresses (after hostname resolution, if applicable) as to requests that result in TLS failures.
I believe, though it's been years since I dealt with this, that this caused various enterprise sites to stop working, many of which assumed they could access intranet hosts (which resolved to private IPs) from remotely hosted websites.
Re: Blizzard games were vulnerable to DNS rebinding attack
#38> Any website can simply create a dns name that they are authorized to communicate with, and then make it resolve to localhost. So if I understand this correctly, websites can now bypass all firewalls and send traffic to any _local_ port at will? It also seems that this same trick would apply to local/intranet IPs (e.g. have domains that redirect to 192.168.0.x) allowing interaction with things like printers. While B…
Agreed. Not that lost ago, there was a post about how a BitTorrent client had a similar issue. Just like in that case, the real vulnerability was in browsers. I wonder how many programs are going to be discovered to be “vulnerable” before people realize that they are missing the point.
What do you think browsers should do instead?
Re: Blizzard games were vulnerable to DNS rebinding attack
#39Developer 101: if you want to do a blacklist, do a whitelist instead.
Ok i need a whitelist of every url but ones that start with facebook ... go
Its not a whitelist of domains, but of applications allowed to use the agent. Right now Blizzard is blacklisting only the browsers from using it, but that still leaves a bunch of other things like slack and whatnot.
Its indeed a very strange patch from Blizzard. As if they hastily assigned an intern to it and then called it a day.