How to prevent a DNS Rebinding Attack on a SonicWall

03/26/2020 65 14687

DESCRIPTION:

DNS rebinding is a DNS-based attack on code embedded in web pages. Normally requests from code embedded in web pages (JavaScript, Java and Flash) are bound to the web-site they are originating from (see Same Origin Policy). A DNS rebinding attack can be used to improve the ability of JavaScript based malware to penetrate private networks, and subvert the browser's same-origin policy.

DNS rebinding attackers register a domain which is delegated to a DNS server they control. The server is configured to respond with a very short TTL parameter which prevents the result from being cached. The first response contains IP address of the server hosting the malicious code. Any subsequent requests contain IP addresses from private (RFC 1918) network, presumably behind a firewall, being target of the attacker. Because both are fully valid DNS responses, they authorize the sandbox script to access hosts in a private network. By iterating addresses in these short-term but still valid DNS replies, the script is able to scan the network and perform other malicious activities.

RESOLUTION:

 Step 1: Login to the SonicWall Management interface , go to Network | DNS.

Step 2: Select Enable DNS Rebinding Attack Prevention and Accept at the top of the screen.

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

 Step 1: Login to the SonicWall Management interface

  Step 2: Select the Manage tab at the top of the page and select  Network | DNS.

Step 2: Select Enable DNS Rebinding Attack Prevention and Accept at the top of the screen.