DNS Abuse Detection: DNS rebinding
Definition
DNS rebinding is a type of attack where a malicious website directs a client to a local network
address, allowing the attacker to bypass the same-origin policy and gain access to the victim's
local resources. - https://capec.mitre.org/data/definitions/275.html
Advice
Monitor domain names which have a low TTL value. In order to do this, DNS telemetry would need to be collected in a passive manner using something like dnstap (https://dnstap.info/) or Zeek (https://zeek.org/).
It is also important to take into account false positives - i.e a large number of legitimate domain names are configured with a low TTL value.
Another method to detect DNS rebinding is to use DNS Response Policy Zones (RPZ) and log/block domain names pointing at RFC1918/private address space.
Specifically, by using Response IP Address Policy Trigger (https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-dns-rpz-00#section-4.3) in a recursive resolver and a corresponding zone file containing a list of RFC1918/private address space.
Examples
SpaceX Wi-Fi Router Vulnerability
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52235
SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Rebinding attack.
Omise.co
https://hackerone.com/reports/1379656
