Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 904143" data-attributes="member: 32260">If I correctly recall, in this video authors claim that the router protections against DNS Rebainding are usually insufficient. It is necessary to know what protection has been applied (see pages 45-50 and pages 73-74 in the Presentation). I have seen several Infos from this year in Google that router vendors submitted updates to protect against DNS Rebainding (but I do not know details).&quot;How do common DNS protections work?<ul>
<li data-xf-list-type="ul">The most common form of protection is to block private IP addresses as defined in RFC 1918</li>
<li data-xf-list-type="ul">Some tools allow to additionally block localhost, local (internal) networks, or 0.0.0.0</li>
<li data-xf-list-type="ul">Dnsmasq &amp; Unbound open source DNS servers are very popular and are used in many widely used applications such as the pfSense firewall, the OpenWRT embedded operating system, and some home routers from FRITZ!Box or ASUS</li>
<li data-xf-list-type="ul">There are also free DNS services such as OpenDNS which has a setting to block internal IP addresses.</li>
<li data-xf-list-type="ul">Most tools tools or services that have try to block DNS rebinding attacks do not enable it by default. pfSense and Google Home seem to enable it by default. But there are several tool &amp; services that allow you to configure DNS rebinding protections.&quot;</li>
</ul>&quot;How to really protect from DNS rebinding:<ol>
<li data-xf-list-type="ol">Use TLS on all services, external and internal including localhost</li>
<li data-xf-list-type="ol">Always use authentication.</li>
<li data-xf-list-type="ol">Validate the Host header of HTTP requests for correct values e.g. 127.0.0.1 (whitelisting).&quot;</li>
</ol>See also:[URL unfurl=&quot;true&quot;]https://github.com/nccgroup/singularity/wiki/Preventing-DNS-Rebinding-Attacks[/URL]</blockquote>

[QUOTE="Andy Ful, post: 904143, member: 32260"] If I correctly recall, in this video authors claim that the router protections against DNS Rebainding are usually insufficient. It is necessary to know what protection has been applied (see pages 45-50 and pages 73-74 in the Presentation). I have seen several Infos from this year in Google that router vendors submitted updates to protect against DNS Rebainding (but I do not know details). "[I]How do common DNS protections work?[/I] [LIST] [*][I]The most common form of protection is to block private IP addresses as defined in RFC 1918[/I] [*][I]Some tools allow to additionally block localhost, local (internal) networks, or 0.0.0.0[/I] [*][I]Dnsmasq & Unbound open source DNS servers are very popular and are used in many widely used applications such as the pfSense firewall, the OpenWRT embedded operating system, and some home routers from FRITZ!Box or ASUS[/I] [*][I]There are also free DNS services such as OpenDNS which has a setting to block internal IP addresses.[/I] [*][I]Most tools tools or services that have try to block DNS rebinding attacks do not enable it by default. pfSense and Google Home seem to enable it by default. But there are several tool & services that allow you to configure DNS rebinding protections."[/I] [/LIST] [I]"How to really protect from DNS rebinding:[/I] [LIST=1] [*][I]Use TLS on all services, external and internal including localhost[/I] [*][I]Always use authentication.[/I] [*][I]Validate the Host header of HTTP requests for correct values e.g. 127.0.0.1 (whitelisting)[/I]." [/LIST] See also: [URL unfurl="true"]https://github.com/nccgroup/singularity/wiki/Preventing-DNS-Rebinding-Attacks[/URL] [/QUOTE]

Verification