You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Hardin <jh...@impsec.org> on 2008/10/08 20:52:36 UTC
[OT?] rDNS tomfoolery - "localhost"
All:
I've recently come across some anomalous behavior in Vista and Win2k3 when
confronted with a host's rDNS returning "localhost". It seems Vista and
Win2k3 replace this with the local hostname. To illustrate:
ping -a 123.30.74.2
(Note: this isn't new, some searching reveals a blog post about it a year
ago.)
Is this a recognized spammer tactic to try to take advantage of
poorly-implemented whitelisting?
Does anybody know if this is a known security risk? (e.g. can a webserver
with rDNS set to "localhost" bypass any IE security features?)
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
We are now seeing the disastrous consequences of government
dictating behavior to the mortgage lending industry over the past
two decades. Why do some think government dictating behavior to
the health care industry would be any less disastrous?
-----------------------------------------------------------------------
27 days until the Presidential Election
Re: [OT?] rDNS tomfoolery - "localhost"
Posted by mouss <mo...@netoyen.net>.
John Hardin a écrit :
> On Wed, 8 Oct 2008, mouss wrote:
>
>> John Hardin a écrit :
>>
>>> I've recently come across some anomalous behavior in Vista and Win2k3
>>> when confronted with a host's rDNS returning "localhost". It seems
>>> Vista and Win2k3 replace this with the local hostname. To illustrate:
>>>
>>> ping -a 123.30.74.2
>>
>> AFAIK, "-a" doesn't change how ping works. the only thing it adds is to
>> show the PTR. but ping will contact the IP.
>
> That's what's intended - to do a rDNS lookup and display the results
> using a tool less sophisticated than dig.
>
> Sorry I wasn't explicit with what that was to illustrate - I was
> intending those on Vista or W2k3 to run that command and say "WTF?"
>
>>> Does anybody know if this is a known security risk? (e.g. can a
>>> webserver with rDNS set to "localhost" bypass any IE security
>>> features?)
>>
>> While shit has happened too many times, I don't see why a browser would
>> do PTR lookup when given an IP.
>
> If security settings are defined by the server's hostname or domain
> name you'd kinda have to, or else say that all numeric-IP URLs are
> inherently untrustworthy.
I'd speculate that the lookup is "textual" (not DNS based). so you'd
specify "http://*.google.com", "http://127.0.0.1" ... etc. but I may be
wrong.
BTW. There was a bug a long time ago when IE used to trust URLs with
dotless numeric-IPs.
http://www.microsoft.com/technet/security/Bulletin/MS01-051.mspx
so I hope the developers don't get into such traps again (but I'm
dreaming...).
Re: [OT?] rDNS tomfoolery - "localhost"
Posted by Kelson <ke...@speed.net>.
John Hardin wrote:
>> While shit has happened too many times, I don't see why a browser would
>> do PTR lookup when given an IP.
>
> If security settings are defined by the server's hostname or domain name
> you'd kinda have to, or else say that all numeric-IP URLs are inherently
> untrustworthy.
In that case, though, they *should* re-check the DNS of the hostname
that's been kicked back.
123.30.74.2 -> localhost -> 127.0.0.1 = mismatch
Assuming, of course, that (a) the DNS server being used doesn't do
something stupid like assume that the PTR result is symmetric, and (b)
the client has the sense to do that verification step.
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: [OT?] rDNS tomfoolery - "localhost"
Posted by John Hardin <jh...@impsec.org>.
On Wed, 8 Oct 2008, mouss wrote:
> John Hardin a écrit :
>
>> I've recently come across some anomalous behavior in Vista and Win2k3
>> when confronted with a host's rDNS returning "localhost". It seems
>> Vista and Win2k3 replace this with the local hostname. To illustrate:
>>
>> ping -a 123.30.74.2
>
> AFAIK, "-a" doesn't change how ping works. the only thing it adds is to
> show the PTR. but ping will contact the IP.
That's what's intended - to do a rDNS lookup and display the results using
a tool less sophisticated than dig.
Sorry I wasn't explicit with what that was to illustrate - I was intending
those on Vista or W2k3 to run that command and say "WTF?"
>> Does anybody know if this is a known security risk? (e.g. can a
>> webserver with rDNS set to "localhost" bypass any IE security features?)
>
> While shit has happened too many times, I don't see why a browser would
> do PTR lookup when given an IP.
If security settings are defined by the server's hostname or domain name
you'd kinda have to, or else say that all numeric-IP URLs are inherently
untrustworthy.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
They didn't add pork to the bailout, they added the bailout to pork.
-- seen at saysuncle.com
-----------------------------------------------------------------------
27 days until the Presidential Election
Re: [OT?] rDNS tomfoolery - "localhost"
Posted by mouss <mo...@netoyen.net>.
John Hardin a écrit :
> All:
>
> I've recently come across some anomalous behavior in Vista and Win2k3
> when confronted with a host's rDNS returning "localhost". It seems
> Vista and Win2k3 replace this with the local hostname. To illustrate:
>
> ping -a 123.30.74.2
>
AFAIK, "-a" doesn't change how ping works. the only thing it adds is to
show the PTR. but ping will contact the IP.
> (Note: this isn't new, some searching reveals a blog post about it a
> year ago.)
>
> Is this a recognized spammer tactic to try to take advantage of
> poorly-implemented whitelisting?
if paranoia mode is on, may be. but I doubt it's the case here (setting
the PTR to updates.microsoft.com or the like may be more "effective")
Looks like a zone with a wildcard, and the PTR is set to localhost (a
default value in the tool that generated the zone?).
$ host 123.30.0.0
0.0.30.123.in-addr.arpa domain name pointer localhost.
$ host 123.31.255.255
255.255.31.123.in-addr.arpa domain name pointer localhost.
>
> Does anybody know if this is a known security risk? (e.g. can a
> webserver with rDNS set to "localhost" bypass any IE security features?)
>
While shit has happened too many times, I don't see why a browser would
do PTR lookup when given an IP.