Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard games were vulnerable to DNS rebinding attack

bugs.chromium.org

Post reply on HN
Print view View original

41–50 of 94 posts

Re: Blizzard games were vulnerable to DNS rebinding attack

#41

Post by geofft »

kodablah wrote: post #32
geofft wrote: post #10

Earlier quoted context omitted.

Can you explain why this is a Chrome-specific issue? I believe that it applies to all web browsers, including Internet Explorer for UNIX (which I do have access to and I can test if you would like me to confirm). I remember this being a vulnerability class with CUPS, which listens on http://localhost:631/ , about 10 years ago. In particular, note that the request is not made to localhost, it's made to a DNS name that…

How about caching a DNS result for the duration of a tab? Doesn't solve everything but probably good enough. I don't think it'd break many things (sure it may affect some round robin DNS things for long-open pages that are Ajax'ing back home frequently, but that should be minimal)

I could believe that caching "is it localhost / RFC 1918 space or not" for a tab would have a sufficiently low false-positive and false-negative rate to be worth doing. It would still break the average business user who has an email half-written in OWA via an RFC-1918 address, puts their laptop to sleep, and goes home and expects OWA to still work over the public internet, but maybe OWA can figure out a solution there like local storage + document.reload(). It won't solve all the problems but it'll solve many of them.

I think caching all DNS resolutions is going to make a lot of cloud-native websites very sad (e.g., I'd imagine something like Slack would break quickly), and also cause poor performance because you don't get the benefit of a CDN's DNS server telling you that other servers are closer now. A lot of people have long-running tabs.

Re: Blizzard games were vulnerable to DNS rebinding attack

#42

Post by anyfoo »

squiguy7 wrote: post #27
Jyaif wrote: post #11

Developer 101: if you want to do a blacklist, do a whitelist instead.

I think it depends mostly on the context. If you only want to allow a known subset of items, prefer a whitelist. If you want to avoid a subset of items, prefer a blacklist.

That's just the definition of whitelist and blacklist?

Re: Blizzard games were vulnerable to DNS rebinding attack

#44

Post by catfood »

DrJokepu wrote: post #5

So basically this is a local web server that is used for IPC? Is there a reason to do local IPC over TCP/IP, rather than over named pipes / unix pipes, other than not knowing about the existence of named pipes / unix pipes?

That's how it should be done yeah. Developers on Windows seem to be really loose in their use of TCP or UDP for IPC. Even my mouse driver opens up a port on 0.0.0.0.

Re: Blizzard games were vulnerable to DNS rebinding attack

#46

Post by iteriteratedone »

hug wrote: post #40
iteriteratedone wrote: post #34

Earlier quoted context omitted.

Ok i need a whitelist of every url but ones that start with facebook ... go

In case you think this is hard: ^(?!facebook).*

Is that not a black list? ... you are not affirming equality ... you are affirming inequality

Re: Blizzard games were vulnerable to DNS rebinding attack

#47

Post by vec »

squiguy7 wrote: post #27
Jyaif wrote: post #11

Developer 101: if you want to do a blacklist, do a whitelist instead.

I think it depends mostly on the context. If you only want to allow a known subset of items, prefer a whitelist. If you want to avoid a subset of items, prefer a blacklist.

Yeah, but the hard-earned wisdom the parent post is trying to impart is that if you think you want to avoid a subset of items, you're probably wrong.

In an explicitly enumerated category, blacklists and whitelists are logically equivalent and can be used interchangeably. In almost every other case blacklists are insufficient because new items can generally be created, either maliciously or just accidentally as the size of the category grows, which are not on the blacklist but which share whatever bad trait you were hoping to protect against.

I'm sure there are a few exceptions, but generally speaking any problem that can be solved with either a blacklist or a whitelist should use the whitelist, just to be safe. A problem that can't use a whitelist is probably not actually solvable by a blacklist either, and trying to use one is likely to fail in the long run.

Re: Blizzard games were vulnerable to DNS rebinding attack

#48

Post by melq »

jrs95 wrote: post #7
DrJokepu wrote: post #5

So basically this is a local web server that is used for IPC? Is there a reason to do local IPC over TCP/IP, rather than over named pipes / unix pipes, other than not knowing about the existence of named pipes / unix pipes?

In the case of Transmission I think it may have been used both as IPC and as a remote connection.

Yeah I think this is the way you access the xml-rpc api.

Re: Blizzard games were vulnerable to DNS rebinding attack

#50

Post by hug »

iteriteratedone wrote: post #46
hug wrote: post #40

Earlier quoted context omitted.

In case you think this is hard: ^(?!facebook).*

Is that not a black list? ... you are not affirming equality ... you are affirming inequality

How do you define a whitelist? A list of items, that, if matched, are allowed?

That regex will only positively "match" non-facebook items, and will only block facebook if implemented in a whitelist.

I'm just playing the straight man to your joke. Of course it's functionally a blacklist: That's what you asked for.

Post reply on HN