Live data from Hacker News

Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

news.ycombinator.com

41–50 of 148 posts

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#41
post #15

Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minutes TTL ;)

TTL appears to be set to an hour. But either way, its been 45 min and the primary ns1-39.azure-dns.com is still offering up 0.1

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#42
post #16

for uninitiated (me), why is it bad?

Well in my case (and a lot of other people), 192.168.1.1 is the local address of my home router. So if I go to microsoft.com I have a 1 in 7 chance of getting my home router instead (if I ignore the certificate warning). Other random breakage will happen depending on what that local address is assigned to for you.

In theory this could be leveraged for hacking, but I think that would require setup in advance.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#45

An entry-level admin is now unemployed, just before the holidays.

I'm wondering how such a change would get "merged" in to begin with. I imagine even non-network engineers would get this huge itch having a large corporate contain a private IP in the changelist (I'm the non network engineer and can't really explain why it's bad. But it FEELS wrong and sometimes you at least need to use instinct to get another pair of eyes on something).

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#47
post #32

Earlier quoted context omitted.

Serve malicious updates from a locally controlled machine, for one. Lord knows about auth.

Do most DNS forwarders not block addresses that resolve to a local IP these days? I know dnsmasq does, and NextDNS too I think.

I think most will see it as a DNS rebinding attack [1].

1. https://en.wikipedia.org/wiki/DNS_rebinding

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#48

An entry-level admin is now unemployed, just before the holidays.

I hope not. Failures are on a spectrum and this was unfortunate but probably not malicious. All things considered this should be a lesson learned. There should be more failsafe mechanisms in place so juniors can fail safely and learn from them. The absolute worst thing we can do is shame an individual so they don’t attempt to try new things in fear of ridicule.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#49
post #35
post #15

Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minutes TTL ;)

30 minutes minutes or 30 Windows minutes? :P

Actually, it’s looking more like 6 days. No wait, 30 seconds.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#50
post #15

Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minutes TTL ;)

192.168.1.1 is gone now, but all authoritative nameservers are still offering 192.168.1.0. Oops.
Post reply on HN