System log:dnsmasq[58696]: possible DNS-rebind attack detected: www.okvcqqjrbzkb
-
i got this log a while ago….what does this means?does someone trying to sabotage my box?
dnsmasq[58696]: possible DNS-rebind attack detected: www.okvcqqjrbzkb.co.cc -
I have the exact same one:
Jul 25 01:01:58 dnsmasq[3499]: possible DNS-rebind attack detected: www.okvcqqjrbzkb.co.cc
Jul 25 01:01:58 dnsmasq[3499]: possible DNS-rebind attack detected: www.okvcqqjrbzkb.co.cc2.0-RC3 (amd64)
built on Fri Jul 15 05:40:33 EDT 2011pfsense: 2.1.5-RELEASE, AMD64
Running on: MB/CPU: ASUS P8H77-I / Core i3-2120T | MEM: 8GB DDR3 | HDD: WD Blue 120GB 2.5" SATA | WAN/LAN: Fujitsu D2735-2 – Intel® chip 82576NS | WLAN: Realtek® 8111F PCIe | Connection: 1000/1000Mbit (Bredband2.com)
[
/U -
DNS rebinding is a technique used to fool a router into thinking the client is on the LAN side and can access the web interface (This would allow an attacker to own your system if you were foolish enough to have a default password still set)
IIRC PFSense 1.x.x was vulnerable to this type of attack as was monowall and most home routers. There is a check in 2 to alert you and it can be triggered by your own servers doing domain forwarding if you've not excluded them.