2

Somebody else has registered a name pointing to my webserver's IP address in .ma TLD.

My domain foo.bar -> my ip address 1.2.3.4

Somebody defined:

suspiciousdomain.ma -> my ip address 1.2.3.4

So this looks like a reverse to typical DNS spoofing.

Questions:

  1. is this preparation for some other attack? Like, people log into the suspiciousdomain.ma website, then suspiciousdomain.ma changes the IP address after some time and redirects traffic to a "man in the middle" server used for stealing credentials?

  2. What is the best way to prevent this?

I was thinking about blocking HTTP requests on Host: header (that is, rejecting all the http requests that do not have Host: foo.bar header set). Would this be effective, that is, is there no reasonable way that attackers could abuse it? (is that header set by browser?)

Embedding javascript code to prevent this in the page does not have to be effective since the attackers could after all delete this code when they switch DNS to "man in the middle" server address.

1 Answer 1

5

You can easily prevent this at the webserver level by explicitly defining your ServerName directives. Non-matching hosts would simply be funneled to the default page (or whatever you choose).

It is possible to fool the Host: header, but this prevents the most common ways. More damaging is that the suspicious domain will duplicate content on your domain which hurts SEO ratings (search engines hate duplicate websites), so the Apache fix would do the trick.

6
  • That's not apache, that's a Lift/Scala app running on Tomcat 7... Apr 11, 2014 at 14:18
  • Need to be more specific in your question then ;) there should still be a way to make Tomcat answer only with certain Host headers.
    – Nathan C
    Apr 11, 2014 at 14:21
  • 1
    @John Doe For Tomcat7 have a look at the Host container : tomcat.apache.org/tomcat-7.0-doc/config/host.html
    – krisFR
    Apr 11, 2014 at 15:33
  • Turns out there's nginx in front, I managed to get it done this way: stackoverflow.com/questions/18970620/… server_name (foo.bar, .foo.bar) emphatically does NOT work for this in nginx. I'd mark your answer as accepted, except it does not contain wider info on wider security on just what kind of attack it might be. Apr 11, 2014 at 15:33
  • P.S. I know this too many comments, but what are the ways that one can fool Host: header with? Apr 11, 2014 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .