![](bg8.png)
SSL, can provide safety for users both in mobile and
desktop browsers. However, in many scenarios, the
victim cannot request all the nodes in their private net-
work to install SSL on their websites but Fail-rebind
protects the victim irrespective of the security of the
nodes in the internal network. A major advantage of
using browser-based solutions, including Fail-rebind,
eSOP, and INP, is that they do require neither ex-
pert knowledge nor special network devices to be in
place. Lastly, however, a user may prefer browsers
where plug-in development is not yet supported, and
accordingly, the user’s activity on one platform may
still have deleterious effects on its network’s nodes.
We also contacted the Firefox developers and shared
our findings. We have discussed possible solutions for
implementing our prototype as a preventive measure
inside the browser.
5 CONCLUSION
As far as user privacy is concerned, the importance
of halting the DNS rebinding attack cannot be over-
stated. We first showed that this attack can adversely
affect internal nodes. Then, we evaluated the current
prevention systems and discussed their weaknesses.
We also proposed a browser-based plug-in for two
popular browsers, i.e., Chrome and Firefox. Our ap-
proach functions perfectly under an encrypted con-
nection, detects DNS rebinding attacks at its initial
stages, and does not suffer from the drawbacks of pre-
vious systems. However, as the proposed solution is
a browser-specific solution, a similar approach needs
to be developed and incorporated into browsers as an
internal component.
ACKNOWLEDGMENT
We gratefully acknowledge the financial support
of the Swiss National Science Foundation for the
project “Agile Software Assistance” (SNSF project
No. 200020-181973, Feb. 1, 2019 – April 30, 2022).
REFERENCES
Afek, Y., Bremler-Barr, A., and Noy, A. (2019). Eradicating
attacks on the internal network with internal network
policy. arXiv preprint arXiv:1910.00975.
Brahmasani, S. and Sivasankar, E. (2013). Two level ver-
ification for detection of DNS rebinding attacks. In-
ternational Journal of System Assurance Engineering
and Management, 4(2):138–145.
Dai, Y. and Resig, R. (2013). FireDrill: Interactive DNS
rebinding. In Presented as part of the 7th USENIX
Workshop on Offensive Technologies.
Dean, D., Felten, E. W., and Wallach, D. S. (1996). Java
security: From HotJava to Netscape and beyond. In
Proceedings 1996 IEEE Symposium on Security and
Privacy, pages 190–200. IEEE.
Fainelli, F. (2008). The OpenWrt embedded development
framework. In Proceedings of the Free and Open
Source Software Developers European Meeting, page
106. sn.
Hazhirpasand, M. and Ghafari, M. (2018). One leak is
enough to expose them all. In International Sympo-
sium on Engineering Secure Software and Systems,
pages 61–76. Springer.
Heffner, C. (2010). Remote attacks against SOHO routers.
Blackhat USA.
Jackson, C., Barth, A., Bortz, A., Shao, W., and Boneh, D.
(2009). Protecting browsers from DNS rebinding at-
tacks. ACM Transactions on the Web (TWEB), 3(1):1–
26.
Johns, M., Lekies, S., and Stock, B. (2013). Eradicating
DNS rebinding with the extended same-origin policy.
In Presented as part of the 22nd USENIX Security
Symposium (USENIX Security 13), pages 621–636.
Lalia, S. and Moustafa, K. (2019). Implementation of web
browser extension for mitigating CSRF attack. In
World Conference on Information Systems and Tech-
nologies, pages 867–880. Springer.
Pandiaraja, P. and Parasuraman, S. (2015). Applying secure
authentication scheme to protect DNS from rebind-
ing attack using proxy. In 2015 International Confer-
ence on Circuits, Power and Computing Technologies
[ICCPCT-2015], pages 1–6. IEEE.
Rekhter, Y., Moskowitz, B., Karrenberg, D., Groot, G. d.,
and Lear, E. (1996). Rfc1918: Address allocation for
private internets.
Tatang, D., Suurland, T., and Holz, T. (2019). Study of DNS
rebinding attacks on smart home devices. In Computer
Security, pages 391–401. Springer.
Van Goethem, T., Chen, P., Nikiforakis, N., Desmet, L., and
Joosen, W. (2014). Large-scale security analysis of the
web: Challenges and findings. In International Con-
ference on Trust and Trustworthy Computing, pages
110–126. Springer.
Stopping DNS Rebinding Attacks in the Browser
603