Tweeted twitter.com/StackSecurity/status/1017648951904882688
2 edited tags; edited title
| link

Does DNS pinning protect against all DNS rebinding attackattacks?

    Post Migrated Here from superuser.com
1
source | link

Does DNS pinning protect against all DNS rebinding attack?

I found an example of a DNS rebinding attack scenario in the paper "Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers".

enter image description here

Figure 1: An example of a dynamic pharming attack against www.vanguard.com. (1) Initially, the pharmer arranges for the victim’s DNS queries for www.vanguard.com to resolve to the pharmer’s IP address, 6.6.6.6. (2) Then, when the victim visits www.vanguard.com, the pharmer returns a trojan document containing malicious Javascript and a iframe referencing Vanguard’s home page. (3) The pharmer then updates the DNS entry for www.vanguard.com to the IP address of Vanguard’s legitimate server and denies subsequent connections from the victim. (4) This causes the victim’s browser to renew its DNS entry for www.vanguard.com, and (5) load Vanguard’s legitimate home page in the iframe. (6) After the user authenticates herself, the malicious Javascript in the trojan document hijacks her session with the legitimate server.

Now it seems browsers today implement a feature called DNS pinning. From Wikipedia:

Web browsers can implement DNS pinning: the IP address is locked to the value received in the first DNS response. This technique may block some legitimate uses of Dynamic DNS, and may not work against all attacks.

My question is: does this countermeasure effectively protect against the described attack scenario? If so: what are some examples of attack scenarios that are not successfully protected against (see claim in Wikipedia quote)? If not: what's the reason why the attack succeeds and how could you succesfully protect against it?