DNS Rebinding Prevention via Domain-IP Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods to prevent DNS rebinding attacks, such as DNS pinning, are not robust enough as attackers can circumvent them by exploiting non-existing ports to refresh DNS caches, allowing rebinding attacks to occur.
Innovation Solution
Implementing a browser plug-in or kernel-level DNS proxy that detects and stores domain-name records to bind a domain to its associated computing-device address, preventing rebinding until the user navigates away from the domain, and hooks the DNS query API to manage DNS queries and cache updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS pinning is used to prevent DNS rebinding attacks, then security against DNS rebinding is improved, but attackers can circumvent it by exploiting non-existing ports to refresh DNS caches
Solution Approach 1:
The patent applies preliminary action by pre-binding a domain name to its canonical IP address in the DNS cache before any rebinding attack can occur. The system proactively stores the domain-to-IP mapping and validates subsequent DNS responses against this pre-established binding, preventing attackers from successfully rebinding the domain to a different IP address even if they exploit non-existing ports to trigger cache refreshes.
2Loss of information
If the browser sends frequent DNS queries to refresh the cache, then the DNS cache remains updated, but this provides more opportunities for attackers to perform DNS rebinding
Solution Approach 1:
The patent implements feedback by continuously monitoring DNS responses and comparing them against the pre-stored canonical domain-to-IP binding. When a DNS query response is received, the system checks whether the returned IP address matches the expected canonical address. If there is a mismatch, the system detects and blocks the rebinding attempt, providing feedback that prevents the attack from succeeding while allowing legitimate cache refreshes to proceed.
3Measurement precision
If the DNS cache TTL is set to a short value, then the cache can be refreshed more often to maintain accuracy, but this increases the frequency of DNS queries that attackers can exploit
Solution Approach 1:
The patent applies preliminary action by pre-establishing the canonical domain-to-IP binding in the DNS cache with an extended or fixed TTL that overrides the server-provided TTL value. This preliminary binding is stored before any rebinding attack can occur, and subsequent DNS responses are validated against this pre-stored binding. This approach maintains DNS resolution accuracy while reducing the frequency of DNS queries, as the pre-established binding remains valid for a longer period and prevents successful rebinding even if the cache is refreshed.
Data Source
AI summary
A computer-implemented method comprising detecting a resolution of an internet address to a first computing-device address, the internet address being associated with a first domain. The method may also comprise storing a domain-name record, the domain-name record associating the internet address with the first computing-device address. The method may comprise using the domain-name record to bind the first domain to the first computing-device address and preventing, until a request to leave the first domain is detected, the first domain from being rebound to a second computing-device address. Systems and computer-readable media for addressing DNS rebinding are also disclosed.