The VIP list vs the bouncer's ban list
The great Blizzard DNS rebinding bypass
When video players go rogue
The whitelist in your daily digital life
YOUR GOAL
Master of Securing the world with the whitelist fix
007skaty Host Header Whitelisting
We match the incoming domains to our whitelist to block the fake requests.
007skaty The Blizzard Update Agent listened for commands on a local port without verification, allowing any visited website to hijack the program.
007skaty The whitelist fix prevents unauthorized domains from sending commands to local applications
007skaty Slide trusted apps onto the approved list to learn how whitelisting protects your network.
DNS rebinding speed: A DNS rebinding attack can hijack a local app in less than three seconds once a user visits a malicious page.
A cyberattack that manipulates DNS resolution to bypass a web browser's same-origin policy. In 2018, Google researcher Tavis Ormandy demonstrated how this exploit could compromise the Blizzard Update Agent.
What was the main security issue with the Blizzard Update Agent discovered in 2018?
Who was the Google Project Zero security researcher who discovered the Blizzard Update Agent vulnerability?
What IP address does a DNS rebinding attack target to reach a victim's local machine?
Why did security researcher Tavis Ormandy criticize Blizzard's initial patch for the DNS rebinding bug?
What did Blizzard's initial, flawed patch check to determine if a request was safe?
Which version of the Blizzard Update Agent finally introduced the robust host header whitelist fix?