Create an Account
username: password:
 
  MemeStreams Logo

OpenDNS Autofix: Very Bad Idea (tm)

search

jlang
My Blog
My Profile
My Audience
My Sources
Send Me a Message

sponsored links

jlang's topics
Arts
Business
Games
Health and Wellness
Home and Garden
Miscellaneous
Current Events
Recreation
Local Information
Science
Society
Sports
Technology

support us

Get MemeStreams Stuff!


 
OpenDNS Autofix: Very Bad Idea (tm)
Topic: Miscellaneous 3:49 pm EDT, Jul 13, 2006

In return, sites like the notoriously sluggish MySpace.com load significantly faster, thanks to the way OpenDNS caches IP addresses. Users who type "wordpres.sorg" or "craigslist.or" into their browser's address field are automatically routed to the correct address, instead of getting a 404 error page.

This is such a very bad idea. Any time you have a computer try to figure out what you meant at the end of a connection, you are creating a serious security vulnerability.

Prime example: Apache's mod_speling (SIC). If I send a request for indexh.tml, mod_speling detects the mistake and will serve back index.html. The problem is any security products like an IDS/IPS won't have this intelligence to try and "fix" the request before they analyze it. The IDS/IPS simply sees and logs a request for indexh.tml Modspelling, like this feature in OpenDNS, allows an attacker to side step the attack signatures on a IDS/IPS to exploit a site because the web server will "fix" the attack once it reaches its target.

OpenDNS Autofix: Very Bad Idea (tm)



 
 
Powered By Industrial Memetics
RSS2.0