Artur Bergman posted an interesting story yesterday on O’Reilly Radar titled Your browser is a tcp/ip relay. In the post, Bergman explains a new technique that could allow malicious code to bypass the same origin browser security model. The article credits security researcher Dan Kaminsky with discovering the loophole, though it appears to have been around for a while.

The attack is fairly simple (to explain, at least). The attacker first configures their DNS server so that query results have a very short time to live (TTL) — say 10 seconds. The victim connects to attacker.com, and loads the site as usual. The DNS server is immediately reconfigured to resolve attacker.com to a different IP address (say, 10.0.0.1). After the TTL expires, JavaScript on the victim’s browser makes another request to attacker.com, in compliance with the same origin policy. But this time attacker.com resolves to an internal IP address (10.0.0.1), allowing the attacker to remotely access a private network.

I spoke briefly to OpenDNS founder David Ulevitch about the exploit. Though the concept is fairly simple, we agreed that it would be difficult to perform this sort of attack in practice. An attacker would need to have intimate knowledge of the victims internal network, or rely on Flash or other web technologies to perform a network scan. Moreover, an attack would end as soon as the victim closed their web browser.

Nevertheless, a vulnerability clearly exists, and it could be difficult to resolve. Many web sites rely on round robin DNS configurations for load distribution. Since round robin configurations may legitimately return different IP addresses for the same host name, distinguishing malicious DNS rebinding attacks from round robin configurations will be difficult, if not impossible to do.