Protection
The following techniques attempt to prevent DNS rebinding attacks:
- Web browsers can implement DNS pinning: the IP address is locked to the value received in the first DNS response. This technique may block some legitimate uses of Dynamic DNS, and may not work against all attacks.
- Private IP addresses can be filtered out of DNS responses.
- External public DNS servers with this filtering e.g. OpenDNS.
- Local sysadmins can configure the organization's local nameservers to block the resolution of external names into internal IP addresses.
- DNS filtering in a firewall or daemon e.g. dnswall.
- Web servers can reject HTTP requests with an unrecognized Host header.
- The Firefox NoScript extension provides partial protection (for private networks) using its ABE feature, which blocks web traffic from external addresses to local addresses.
Read more about this topic: DNS Rebinding
Famous quotes containing the word protection:
“A man with convictions finds an answer for everything. Convictions are the best form of protection against the living truth.”
—Max Frisch (1911–1991)
“Innocence does not find near so much protection as guilt.”
—François, Duc De La Rochefoucauld (1613–1680)
“Without infringing on the liberty we so much boast, might we not ask our professional Mayor to call upon the smokers, have them register their names in each ward, and then appoint certain thoroughfares in the city for their use, that those who feel no need of this envelopment of curling vapor, to insure protection may be relieved from a nuisance as disgusting to the olfactories as it is prejudicial to the lungs.”
—Harriot K. Hunt (1805–1875)