Security Samizdat

Researchers from Stanford University have published a paper titled “Protecting browsers from DNS rebinding attacks“. Abstract:

DNS rebinding attacks subvert the same-origin policy of browsers and convert them into open network proxies. We survey new DNS rebinding attacks that exploit the interaction
between the browser and browser plug-ins such as Flash and Java LiveConnect. These attacks can be used to circumvent firewalls and are highly cost-effective for sending
spam e-mail and defrauding pay-per-click advertisers, requiring less than $100 to temporarily hijack 100,000 IP addresses. We show that a well-known, existing defense
against these attacks, called “DNS pinning,” is ineffective in modern browsers. The primary focus of this work, however, is the design of strong defenses against DNS rebinding attacks that protect modern browsers. For the near-term, we suggest easy-to-deploy defenses that prevent large-scale exploitation by patching individual plug-ins and improving the robustness of browser DNS pinning strategies. For the longterm, we propose two solutions, circumvention-resistant firewalls
and host name authorization, that fix the root cause of DNS rebinding vulnerabilities by preventing the attacker from naming a target server.

You can download the paper (PDF) here.