Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 148 posts

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#81

Post by WarOnPrivacy »

TacticalCoder wrote: post #69

Wait... Can DNS resolvers be configured so that RFC1918 is respected? I mean: I don't expect anything less from Microsoft than doing stuff like that and it cannot affect me for I nullroute microsoft.com from my unbound server ( unboud takes wildcard when nullrouting or NXDOMAINing crap domains like microsoft.com or meta.com etc., which is sweet). However I'd expect my trusty DNS resolver to also prevent me from anyon…

My Unbound servers strip RFC out.

Public resolvers keep DNS answers intact because they can carry alt data like how dodgy a SMTP server is.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#82

Post by zenexer »

adolph wrote: post #80
zenexer wrote: post #50

Earlier quoted context omitted.

192.168.1.1 is gone now, but all authoritative nameservers are still offering 192.168.1.0. Oops.

A few are dropping 192.168.1.0 now: as of 1703035296: ns1-39.azure-dns.com no longer has 192.168.1.0 for microsoft.com 1.1.1.1 still has 192.168.1.0 for microsoft.com 8.8.8.8 still has 192.168.1.0 for microsoft.com 76.76.2.0 no longer has 192.168.1.0 for microsoft.com 9.9.9.9 still has 192.168.1.0 for microsoft.com 208.67.222.222 still has 192.168.1.0 for microsoft.com 185.228.168.9 still has 192.168.1.0 for microsof…

Only one of those is authoritative. All of the authoritative servers have dropped it. Microsoft has fixed the issue.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#83

Post by adolph »

CodeWriter23 wrote: post #54
bastard_op wrote: post #44

How the hell did that pass any sort of responsible review process at Microsoft? Now Microsoft owns all your home networks, only like the default address on every home router out there...

> Now Microsoft owns all your home networks Only if you’re slumming around 192.168.x.x

I for one only use Class A CIDR, 10.0.0.0/8

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#85

Post by wrboyce »

drexlspivey wrote: post #66
wrboyce wrote: post #32

Earlier quoted context omitted.

Do most DNS forwarders not block addresses that resolve to a local IP these days? I know dnsmasq does, and NextDNS too I think.

Why? Having local IPs on a public DNS is a legitimate use case.

As another reply mentioned, to prevent DNS rebinding attacks. The general expectation is you will whitelist domains from which you expect RFC1918 responses.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#86

Post by david_shaw »

_nickwhite wrote: post #25

An entry-level admin is now unemployed, just before the holidays.

> An entry-level admin is now unemployed, just before the holidays.

I highly doubt that entry-level admins at Microsoft have access to DNS for their primary domain. My guess is that this incident is a lot more interesting than that.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#87

Post by timschmidt »

wolverine876 wrote: post #71
timschmidt wrote: post #24

Earlier quoted context omitted.

Serve malicious updates from a locally controlled machine, for one. Lord knows about auth.

> Serve malicious updates from a locally controlled machine. Lord knows about auth. Wouldn't they have to break into my local machine first, plant an update service, and an update? That doesn't seem to scale well at all, and wouldn't it be easier to just break into the machine they want to 'update'?

A fairly prominent update service already runs from the domain microsoft.com Many machines come with it preinstalled.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#89

Post by nullbytes »

rasengan wrote: post #38
kotaKat wrote: post #15

Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minutes TTL ;)

This isn’t something that I think should be diluted. If it’s that simple for a stray record to be included in the dns round robin it could have been bad if it was an external ip with a machine setup by a phisherman especially since control of a domain is all you need to get an ssl cert now. Couple this with the fact that it’s Microsoft, one of the most relied on companies in our computer world, this is pretty darn ho…

Microsoft also has some of the phishiest looking domains when you are redirected around the O365 cloud.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#90

Post by rvnx »

nullbytes wrote: post #89
rasengan wrote: post #38

Earlier quoted context omitted.

This isn’t something that I think should be diluted. If it’s that simple for a stray record to be included in the dns round robin it could have been bad if it was an external ip with a machine setup by a phisherman especially since control of a domain is all you need to get an ssl cert now. Couple this with the fact that it’s Microsoft, one of the most relied on companies in our computer world, this is pretty darn ho…

Microsoft also has some of the phishiest looking domains when you are redirected around the O365 cloud.

100%. Starting with "onmicrosoft.com". A phisher wouldn't really have to control Microsoft.com to take advantage of confusion.
Post reply on HN