Protecting browsers from DNS rebinding attacks

Authors:
Collin Jackson;Adam Barth;Andrew Bortz;Weidong Shao;Dan Boneh
Affiliations:
Stanford University, Stanford, CA;Stanford University, Stanford, CA;Stanford University, Stanford, CA;Stanford University, Stanford, CA;Stanford University, Stanford, CA
Venue:
ACM Transactions on the Web (TWEB)
Year:
2009

Citing 6
Cited 5

Linux Security Howto

Linux Security Howto
Java Security: From HotJava to Netscape and Beyond

SP '96 Proceedings of the 1996 IEEE Symposium on Security and Privacy
Puppetnets: misusing web browsers as a distributed attack infrastructure

Proceedings of the 13th ACM conference on Computer and communications security
A DNS filter and switch for packet-filtering gateways

SSYM'96 Proceedings of the 6th conference on USENIX Security Symposium, Focusing on Applications of Cryptography - Volume 6
Dynamic pharming attacks and locked same-origin policies for web browsers

Proceedings of the 14th ACM conference on Computer and communications security
The anatomy of Clickbot.A

HotBots'07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets

Browser protection against cross-site request forgery

Proceedings of the first ACM workshop on Secure execution of untrusted code
On building inexpensive network capabilities

ACM SIGCOMM Computer Communication Review
On modern DNS behavior and properties

ACM SIGCOMM Computer Communication Review
Auto-FBI: a user-friendly approach for secure access to sensitive content on the web

Proceedings of the 29th Annual Computer Security Applications Conference
Measuring the practical impact of DNSSEC deployment

SEC'13 Proceedings of the 22nd USENIX conference on Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

DNS rebinding attacks subvert the same-origin policy of browsers, converting them into open network proxies. Using DNS rebinding, an attacker can circumvent organizational and personal firewalls, send spam email, and defraud pay-per-click advertisers. We evaluate the cost effectiveness of mounting DNS rebinding attacks, finding that an attacker requires less than $100 to hijack 100,000 IP addresses. We analyze defenses to DNS rebinding attacks, including improvements to the classic “DNS pinning,” and recommend changes to browser plug-ins, firewalls, and Web servers. Our defenses have been adopted by plug-in vendors and by a number of open-source firewall implementations.