Path: csiph.com!aioe.org!nntp.terraraq.uk!nntp-feed.chiark.greenend.org.uk!ewrotcd!usenet-its.stanford.edu!usenet.stanford.edu!not-for-mail
From: Lee <ler762@gmail.com>
Newsgroups: comp.protocols.dns.bind
Subject: Re: Fwd: DNS Misconfiguration on- http://cyberia.net.sa/
Date: Fri, 5 Jun 2020 20:33:21 -0400
Lines: 37
Approved: bind-users@lists.isc.org
Message-ID: <mailman.498.1591403585.942.bind-users@lists.isc.org>
References: <CALAvY8mCB8aC4fqH+x+8Y5C2mS2i5_OZxOROpgp1gQ9yTx3g-w@mail.gmail.com> <CAESnv-YsFi1cq6SFEgijq5=6TET20b6enWU9foa07AfBmVp3Fg@mail.gmail.com> <CAESnv-az+HJ6N5-GMuzd=NrTOvv_xyHWuq=yRp1cy25W+evmPQ@mail.gmail.com> <alpine.LSU.2.21.2006050904310.20305@flame.m3047> <CAD8GWsv7rbkBLc7vzqnoO9xy+vDU08ss215k_wcpzZztma7pyw@mail.gmail.com>
NNTP-Posting-Host: lists.isc.org
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Cc: "bind-users@lists.isc.org" <bind-users@lists.isc.org>
To: Fred Morris <m3047@m3047.net>
In-Reply-To: <alpine.LSU.2.21.2006050904310.20305@flame.m3047>
Precedence: list
Xref: csiph.com comp.protocols.dns.bind:15822

On 6/5/20, Fred Morris <m3047@m3047.net> wrote:
> Hrmmm... I'm reminded of something else I've seen reported on recently...
>
> On Fri, 5 Jun 2020, Ejaz Ahmed wrote:
>> localhost.cyberia.net.sa
>
> I don't know if you've been paying attention, but it's been reported that
> among others EBay has been port scanning visitor's devices [0]. Having
> localhost.ebay.com could be handy for them in terms of circumventing some
> rules on setting of cookies and the execution of scripts. Not saying
> that's what they're doing, heaven forbid.
>
> Any domain you visit could have entries in it which point to e.g.
> localhost or nonrouting addresses commonly used for gateways, things like
> that.
>
> This is not a DNS problem, it's a problem in what commonly used programs
> aid and abet in the name of "freedom of commerce" or something.

It's possible to block with rpz & something else that I can't recall
right now.  I did RPZ blocking first, so I didn't bother changing

;  return NXDOMAIN for any 127.0.0.0/8 answers
;    exceptions:
onea.net-snmp.org       CNAME   rpz-passthru.
twoa.net-snmp.org       CNAME   rpz-passthru.
localhost               CNAME   rpz-passthru.
8.0.0.0.127.rpz-ip      CNAME   .       ;  127.0.0.0/8
;   check:
;     localhost           127.0.0.1
;     onea.net-snmp.org   127.0.0.1
;     twoa.net-snmp.org   127.0.0.2 127.0.0.3

All my other host names that used to return 127.0.0.1 answers don't
any more :(  Anyone know some valid names I can use for testing?

Lee