EXPERT RESPONSE
Anti-DNS pinning, also known as DNS rebinding, is more of an attack against the end user. To say "my Web application is vulnerable to anti-DNS pinning" would not make sense. The attack takes advantage of deficiencies in the Web browser and fools it into executing JavaScript code that makes hidden Web requests without the user's knowledge.
One defense from the Web application side is to verify that the HTTP host header is correct; however, there are attacks to circumvent this as well, depending on which Web browser the victim is using. Users will likely always be vulnerable to anti-DNS pinning until the browsers (and other client-side components such as Flash) fix the issue.
If I'm the owner of a Web application, say Gmail, the best way to protect my users from the effects of anti-DNS pinning attacks is to eliminate cross-site request forgery (CSRF or XSRF) vulnerabilities in my application. While this doesn't prevent anti-DNS pinning itself, it prevents an anti-DNS pinning attack from being able to target users of my particular Web application.
-- Chris Eng, director of security services at Veracode, contributed to this response.
|
