The DNS pinning bugs just keep coming: A researcher has proven you can bypass the corporate firewall by converting the victim's browser into a proxy server. (See Old Flaw Threatens Web 2.0.)
David Byrne, security architect for EchoStar Satellite, will demonstrate next month at Black Hat USA how the DNS pinning (a.k.a. DNS rebinding) vulnerability in Java can be used to leap past the perimeter firewall and access the corporate intranet. The browser basically becomes a proxy server for the attacker.
"Everyone is at risk, and for a long time they've been relying on their network firewalls to protect them from an attack like this," Byrne says. "This is one method of bypassing perimeter firewalls... In the end, you can't completely trust your perimeter firewalls."
DNS pinning/rebinding is not a new vulnerability, but it will be one of the big topics at Black Hat, thanks to a resurgence of research on the bug in the past few months. It's found in browsers, Java, Flash, and Adobe, and has some serious implications for Web 2.0-type apps that pack more code and action onto the client.
Another Black Hat researcher, Dan Kaminsky, director of penetration testing for IOActive, will demonstrate a proof-of-concept exploit that lets attackers set up a VPN connection straight to the victim's corporate network.
Kelly Jackson Higgins, Senior Editor, Dark Reading