Hacker News Reader

Comment by EdSharkey | Hacker News Reader

In what universe does it make sense for a DNS server to serve records that point to 127.0.0.1??

This DNS Rebinding hack should be easy to eliminate: only etc/hosts can make records that point to localhost.

I don't care if a HUGE swath of applications are broken by this, DNS just seems broken to allow remote DNS servers to make localhost records.

Please excuse my awkward use of words, I am a combination of sick and delightfully ignorant about DNS.

View on HN

DNS rebinding can also be used to attack private addresses, for which it would be perfectly legal to have real DNS names (think DNS entries for a company's intranet). Blacklisting localhost only offers a bit of security against silly devs, but arguably pivoting an attack from a public server to a private network is much more valuable and harder to stop.

Well, that sounds super bad too!

There should be some central network policy in the enterprise that says a DNS record coming from outside the company can't point to addresses on the 10.xx.xx.xx or 192.168.xx.xx spaces. I'm surprised that isn't already the common configuration.

Unbound has that as a possibility in the recursive DNS resolver.

Super simple to set up too:

        # Enforce privacy of these addresses. Strips them away from answers.
        # It may cause DNSSEC validation to additionally mark it as bogus.
        # Protects against 'DNS Rebinding' (uses browser as network proxy).
        # Only 'private-domain' and 'local-data' names are allowed to have
        # these private addresses. No default.
        private-address: 10.0.0.0/8
        private-address: 172.16.0.0/12
        private-address: 192.168.0.0/16
        private-address: 169.254.0.0/16
        private-address: fd00::/8
        private-address: fe80::/10
        private-address: 127.0.0.0/8

I'm not excusing it, but at megacorp we had an entry for localhost.megacorp.com to allow devs to get past the oauth whitelist. And, yes, it's on their public DNS (just checked).

I do remember, however, that either my ISP or whatever DNS voodoo DD-WRT was doing blocked resolution of things in 127.0.0.0/8.

That is super horrible.

This was only added to the whitelist for the non-production environments of course, still not great.

Ah, horrible-twice-removed, then. Hehe!

Why would DNS be broken ? It's only an IP address. If you don't like the localhost part, then just change it to its IPv6 counterpart: "::1". And if you think that it should be blacklisted too, then you could use the computer's temporary IPv6.

But then, you could also use 127.x.y.z (so you'd have to "blacklist" all the 127.0.0.0/8 range).

And also blacklist the 192.168.x.y range (more specifically an attacker could be that your router serves 192.168.1.x with DNS starting at x=100, so serve the 192.168.1.100).

Then at this point you realise that its not DNS that's broken but the underlying applications.

So you're saying a remote DNS server should be able to serve up a record that points to a localhost address? This is too clever by half, we simply shouldn't allow it!

Just because a localhost address is in the IPv4 address space doesn't make it just some ordinary address. And applications aren't broken, the local operating system's network software is being hacked in this case of DNS Rebinding.

I could imagine there may be systems that don't connect to the internet but maybe want to use DNS protocol to coordinate to other systems.

Then for that oddball one-off system, there's a kernel compilation flag that is impossible to find in obfuscated C and assembler that you can set named

  UNSAFE_ALLOW_REMOTE_DNS_RECORDS_DRAGONS = true

where the default setting is always FALSE.

Can someone who does kernel or DNS client development in operating systems comment? Am I nuts or is DNS nuts?

Reply on news.ycombinator.com