Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 148 posts

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#51

Post by aaomidi »

Y'all, instead of the constant confirmed here. Just do an authoritative lookup.

dig +trace +short microsoft.com

NS a.root-servers.net. from server 100.100.100.100 in 10 ms.

NS b.root-servers.net. from server 100.100.100.100 in 10 ms.

NS c.root-servers.net. from server 100.100.100.100 in 10 ms.

NS d.root-servers.net. from server 100.100.100.100 in 10 ms.

NS e.root-servers.net. from server 100.100.100.100 in 10 ms.

NS f.root-servers.net. from server 100.100.100.100 in 10 ms.

NS g.root-servers.net. from server 100.100.100.100 in 10 ms.

NS h.root-servers.net. from server 100.100.100.100 in 10 ms.

NS i.root-servers.net. from server 100.100.100.100 in 10 ms.

NS j.root-servers.net. from server 100.100.100.100 in 10 ms.

NS k.root-servers.net. from server 100.100.100.100 in 10 ms.

NS l.root-servers.net. from server 100.100.100.100 in 10 ms.

NS m.root-servers.net. from server 100.100.100.100 in 10 ms.

RRSIG NS 8 0 518400 20240101050000 20231219040000 46780 . fG/YHtUJu3YMAm9Mlzzvp3xG4UCPG01aYNnlyF1HfAHdZpR+L88CVUcz NFHq9M45KjB7ZTlSFt2JvEyK/8FcavZLOthkXRREbJQswjLCbhiPQCbq tQLF+tKaNYUihqawCfjgZy1i5YwYjmphbjfzwoKo1POtepf0YCIcuLBi nQFw4Lr79O6cjyg6qlYnqaK6z4Xi5qt6ocohJafjs86LuuRo2WvmJ1IK k0ZUoAC6Qyjz4MVhqHMvQGdp7EnzjoL8Y9PTXeUuD6Ixp/Aklj2psLjD TZDPYN1q+zDd1giFyuwNRX9DG1zrxzN2lzQiLWmGKrzP3DvFWL1L2Ts1 FWjy/Q== from server 100.100.100.100 in 10 ms.

;; UDP setup with 2001:502:7094::30#53(2001:502:7094::30) for microsoft.com failed: network unreachable.

;; UDP setup with 2001:502:7094::30#53(2001:502:7094::30) for microsoft.com failed: network unreachable.

;; UDP setup with 2001:502:7094::30#53(2001:502:7094::30) for microsoft.com failed: network unreachable.

A 20.112.250.133 from server 150.171.10.39 in 20 ms.

A 20.231.239.246 from server 150.171.10.39 in 20 ms.

A 20.76.201.171 from server 150.171.10.39 in 20 ms.

A 20.70.246.20 from server 150.171.10.39 in 20 ms.

A 20.236.44.162 from server 150.171.10.39 in 20 ms.

A 192.168.1.0 from server 150.171.10.39 in 20 ms.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#52

Post by nightfly »

bastard_op wrote: post #44

How the hell did that pass any sort of responsible review process at Microsoft? Now Microsoft owns all your home networks, only like the default address on every home router out there...

Any risk here is nearly the opposite of what you seem to think it is

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#53

Post by YetAnotherNick »

bastard_op wrote: post #44

How the hell did that pass any sort of responsible review process at Microsoft? Now Microsoft owns all your home networks, only like the default address on every home router out there...

No, it's that when you open microsoft.com it could open your router page.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#54

Post by CodeWriter23 »

bastard_op wrote: post #44

How the hell did that pass any sort of responsible review process at Microsoft? Now Microsoft owns all your home networks, only like the default address on every home router out there...

> Now Microsoft owns all your home networks

Only if you’re slumming around 192.168.x.x

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#55

Post by statictype »

rasengan wrote: post #38
kotaKat wrote: post #15

Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minutes TTL ;)

This isn’t something that I think should be diluted. If it’s that simple for a stray record to be included in the dns round robin it could have been bad if it was an external ip with a machine setup by a phisherman especially since control of a domain is all you need to get an ssl cert now. Couple this with the fact that it’s Microsoft, one of the most relied on companies in our computer world, this is pretty darn ho…

For all this to work you need to control the domain. Is that easier than simply breaking into their systems and owning their servers?

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#56

Post by plorkyeran »

bastard_op wrote: post #44

How the hell did that pass any sort of responsible review process at Microsoft? Now Microsoft owns all your home networks, only like the default address on every home router out there...

You have the danger of this backwards: this is a very bad security problem for Microsoft, and not a problem for people outside of MS (except to the extent that we're all indirectly reliant on MS being secure). Pointing a domain at an IP address does not give you any power over than IP address, and you can point a domain at anything you want.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#57

Post by YetAnotherNick »

stop50 wrote: post #36
quickthrower2 wrote: post #30

For the uninitiated, can some traffic get sent to 192.168.1.1. Is it round robin?

Yes it is.

I could be wrong but in my experience OS just selects one random and uses that for some time not round robins it.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#58

Post by wrboyce »

donmcronald wrote: post #47
wrboyce wrote: post #32

Earlier quoted context omitted.

Do most DNS forwarders not block addresses that resolve to a local IP these days? I know dnsmasq does, and NextDNS too I think.

I think most will see it as a DNS rebinding attack [1]. 1. https://en.wikipedia.org/wiki/DNS_rebinding

That’s the phrase I was looking for!

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#60

Post by charcircuit »

timschmidt wrote: post #24
edgineer wrote: post #19

What could a TLA do with this if it had time to plan ahead?

Serve malicious updates from a locally controlled machine, for one. Lord knows about auth.

Why doesn't windows update use authentication (eg https)?
Post reply on HN