Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard games were vulnerable to DNS rebinding attack

bugs.chromium.org

Post reply on HN
Print view View original

61–70 of 94 posts

Re: Blizzard games were vulnerable to DNS rebinding attack

#61

Post by jdoliner »

Nadya wrote: post #55
jdoliner wrote: post #43

Earlier quoted context omitted.

This is a blacklist though.

Functionally - yes. By definition - no. A blacklist won't allow items that match and a whitelist only allows items that match. Blacklists include by default and whitelists exclude by default. Since the regex needs to match to be included - it is, by definition, a whitelist. It excludes by default anything that doesn't match. It just so happens the net being cast is so wide as to be "all except ____" where a whitelist…

I think part of the definition blacklist and whitelist is being a list.

Re: Blizzard games were vulnerable to DNS rebinding attack

#62

Post by DrJokepu »

catfood wrote: post #44
DrJokepu wrote: post #5

So basically this is a local web server that is used for IPC? Is there a reason to do local IPC over TCP/IP, rather than over named pipes / unix pipes, other than not knowing about the existence of named pipes / unix pipes?

That's how it should be done yeah. Developers on Windows seem to be really loose in their use of TCP or UDP for IPC. Even my mouse driver opens up a port on 0.0.0.0.

UDP for IPC seems to be especially crazy to me. I mean sending data over TCP to localhost is basically a memcpy(), what advantages could UDP possibly have in that context?

Re: Blizzard games were vulnerable to DNS rebinding attack

#63

Post by SahAssar »

benchaney wrote: post #35
dooglius wrote: post #21

> Any website can simply create a dns name that they are authorized to communicate with, and then make it resolve to localhost. So if I understand this correctly, websites can now bypass all firewalls and send traffic to any _local_ port at will? It also seems that this same trick would apply to local/intranet IPs (e.g. have domains that redirect to 192.168.0.x) allowing interaction with things like printers. While B…

Agreed. Not that lost ago, there was a post about how a BitTorrent client had a similar issue. Just like in that case, the real vulnerability was in browsers. I wonder how many programs are going to be discovered to be “vulnerable” before people realize that they are missing the point.

The vulun is in the fact that the program blindly trusts incoming HTTP based only on a nonce being in both the body and a header.

Re: Blizzard games were vulnerable to DNS rebinding attack

#64

Post by Nadya »

jdoliner wrote: post #61
Nadya wrote: post #55

Earlier quoted context omitted.

Functionally - yes. By definition - no. A blacklist won't allow items that match and a whitelist only allows items that match. Blacklists include by default and whitelists exclude by default. Since the regex needs to match to be included - it is, by definition, a whitelist. It excludes by default anything that doesn't match. It just so happens the net being cast is so wide as to be "all except ____" where a whitelist…

I think part of the definition blacklist and whitelist is being a list.

Think of it as shorthand for a list that expands to be infinitely large. [0]

People would consider a blacklist that includes ` * .example.com` to be a list that contains all potential subdomains of `example.com`. With ` * ` being seen as shorthand.

E: Spaces around the asterisk added to avoid HN formatting.

[0] Technical limitations aside, especially in the context of URL matching since URLs have a maximum character length.

Re: Blizzard games were vulnerable to DNS rebinding attack

#65

Post by eropple »

jdoliner wrote: post #61
Nadya wrote: post #55

Earlier quoted context omitted.

Functionally - yes. By definition - no. A blacklist won't allow items that match and a whitelist only allows items that match. Blacklists include by default and whitelists exclude by default. Since the regex needs to match to be included - it is, by definition, a whitelist. It excludes by default anything that doesn't match. It just so happens the net being cast is so wide as to be "all except ____" where a whitelist…

I think part of the definition blacklist and whitelist is being a list.

A list of regexes is a list.

A list with one entry is also a list.

Re: Blizzard games were vulnerable to DNS rebinding attack

#66

Post by hug »

iteriteratedone wrote: post #57
hug wrote: post #50

Earlier quoted context omitted.

How do you define a whitelist? A list of items, that, if matched, are allowed? That regex will only positively "match" non-facebook items, and will only block facebook if implemented in a whitelist. I'm just playing the straight man to your joke. Of course it's functionally a blacklist: That's what you asked for.

Sorry cant drop this one yet My comment is not a joke but a challenge to the parent ... that they are wrong Yes whitelist are safer ... but whitelists can be cumbersome to generate/maintain and slow you down at runtime ... On reddit let this slide , but here we have to correct the flawed thinking. You cant run from engineering problems without consequece So now we have graduated to course 202: how to make a blacklist…

If it's not a joke, it's at least an exercise in absurdity.

I wrote a regex that would allow things that aren't facebook, and then you said "No, you're not allowing things that aren't facebook, you're not allowing things that don't match not being facebook".

If it's not a white-list, it's at least an opposite-of-black-list.

Re: Blizzard games were vulnerable to DNS rebinding attack

#67

Post by rhizome »

squiguy7 wrote: post #27
Jyaif wrote: post #11

Developer 101: if you want to do a blacklist, do a whitelist instead.

I think it depends mostly on the context. If you only want to allow a known subset of items, prefer a whitelist. If you want to avoid a subset of items, prefer a blacklist.

My personal heuristic is to always favor the positive collection, which comes from databases where retrieving a set of data is much easier and more efficient than retrieving a set of data EXCEPT THESE. I always figured there was math to back this up.

Re: Blizzard games were vulnerable to DNS rebinding attack

#68

Post by jonny_eh »

DrJokepu wrote: post #5

So basically this is a local web server that is used for IPC? Is there a reason to do local IPC over TCP/IP, rather than over named pipes / unix pipes, other than not knowing about the existence of named pipes / unix pipes?

Better cross-platform support?

Re: Blizzard games were vulnerable to DNS rebinding attack

#70

Post by aplorbust »

A mischievous person renting a domainname can list any public or private IP addresses in her A records; and she can list any nameservers, including ones with which she has no relationship. She can list an IP address that the user may be utilising or renting.

I use a fast DNS resolution solution that only queries authoritative servers and stores IPs in constant, perfect hash databases, then in kdb+. No caches. I see the IP addresses that are returned in DNS packets not as ephemeral and inconseqential, but as entries in a database that need to be validated before insert.

If I see some nonsense like 127.0.0.1 in an A record, let alone a public IP address that Im using, it is rejected. I have seen NS records with 127.0.0.1 as well.

Are there DNS rebinding attacks that do not use iframes, Javascript or some other way to trigger automatic lookups without user interaction? In theory perhaps. But every attack I have seen relies on triggering lookups automatically.

Its too bad the popular browsers make automatic requests for resources, automatically follow redirects and do not allow users to disable this default behavior.

However users can make use of less complex HTTP clients that do not make such automatic requests and where redirects can be disabled. These can be used in tandem with the popular browsers to give users more transparency and control.

Also isnt it possible to use SSL/TLS for localhost JSON-RPC? Theoretically couldnt users make use of client certificates?

Just a thought.

Post reply on HN