Protect Browsers from DNS Rebinding Attacks769
Pages:
1LiquidLayer private msg quote post Address this user | ||
https://crypto.stanford.edu/dns/ Protecting Browsers from DNS Rebinding Attacks DNS rebinding attacks subvert the same-origin policy and convert browsers into open network proxies. These attacks can circumvent firewalls to access internal documents and services require less than $100 to temporarily hijack 100,000 IP addresses for sending spam and defrauding pay-per-click advertisers For information about defenses, please read our paper: Protecting Browsers from DNS Rebinding Attacks [BIBTEX] Collin Jackson, Adam Barth, Andrew Bortz, Weidong Shao, and Dan Boneh In Proceedings of ACM CCS 07 Disclosure Timeline April 28, 2007 Stanford security lab notifies vendors July 24, 2007 Stanford paper and vulnerability check posted August 15, 2007 Firewall defense tool dnswall and Firefox patch released October 3, 2007 DNS rebinding fix for Java released by Sun October 22, 2007 DNS rebinding protection patch for dnsmasq released October 29, 2007 Stanford presentation at ACM CCS 07 December 3, 2007 DNS rebinding fix for Flash Player released by Adobe Implementation dnswall: daemon that filters out private IP addresses in DNS responses prnetdb.c.patch: host name authorization check for Firefox Related Work LocalRodeo - RFC1918 Pinning for JavaScript (Martin Johns) LiveConnect Rebinding (Martin Johns) LiveConnect Rebinding (Kanatoko Anvil) Flash Rebinding (Kanatoko Anvil) Forcing Browsers to Unpin (Kanatoko Anvil) See source post with active links: https://crypto.stanford.edu/dns/ |
||
Post 1 IP flag post |
Pages:
1