4

In today's log summary from my SSH server, I found the following interesting entry:

Illegal users from:
  113.175.205.167 (localhost): 2 times

Doing a DNS lookup on 113.175.205.167 does indeed resolve to localhost (a DNS lookup of localhost resolves to 127.0.0.1, as expected). What could an attacker be trying to do with such an obviously-invalid DNS record?

Improve this question

1 Answer 1

Reset to default
4

An attacker could try to bypass a hostname-based whitelist on your server.

In a naive scenario, you might configure SSH or a firewall to only allow connections from "localhost", intending to lock out all remote machines for security reasons.

A smart SSH server would recognize that 113.175.205.167 is remote and block the connection attempt. Eventually, it would resolve localhost to 127.0.0.1 and see that the IPs don't match.

However, a server with a flawed implementation might first conduct a reverse DNS lookup of the IP, find the localhost entry, and reason that the hostnames match, thus allowing the connection.

NB: Resolving localhost to 127.0.0.1 is obviously done internally in most cases, skipping the DNS query (e.g. by looking it up in /etc/hosts). Hence, a malicious DNS server cannot easily attack the other way round by resolving localhost to an arbitrary IP.

Why does that particular IP resolve to localhost?

Here, it's likely not part of an attack, but because that IP is located in Hanoi and apparently, "The Country of Vietnam Resolves to Localhost". The reason seems to be an outdated technique to bypass e-mail spam filters.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .