1 Temat przez byku

  • byku
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2013-04-28
  • Posty: 96

Temat: dnsmasq possible DNS-rebind attack detected - co to jest

Nawet użyłem wyszukiwarki i nikt nie założył takiego tematu tutaj.
Co to jest, wiem, że ta osoba ma przenośny dysk.
1) jak to dodać na białą listę, czemu dnsmasq odrzuca western digital, western digital nie wie co robi?
2) może urządzenie jest źle ustawione i używa puli lolalnej ip?

Sun Jul 21 04:19:10 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:21:19 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:23:14 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:24:40 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:26:20 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:28:06 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:30:15 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:32:11 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:34:06 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:35:47 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:37:12 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:39:07 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:41:17 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:43:13 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:46:13 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:48:09 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:50:04 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:51:44 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:53:10 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:55:05 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:57:16 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:59:12 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 04:59:12 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:00:51 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:03:16 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:05:12 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:06:52 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:09:18 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:11:04 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:12:44 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:13:15 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan) 192.168.1.134 2e:15:c3:c2:b1:6f
Sun Jul 21 05:13:15 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan) 192.168.1.134 2e:15:c3:c2:b1:6f realme-C53
Sun Jul 21 05:14:10 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:15:50 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:18:14 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:20:10 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:21:49 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:24:15 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:26:10 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:27:51 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:30:16 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:32:12 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:33:52 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:36:18 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:38:12 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:39:53 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:42:18 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:44:04 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:45:45 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:47:10 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:48:56 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:51:06 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:53:16 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:55:11 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:56:52 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 05:59:17 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:01:13 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:02:53 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:05:19 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:07:05 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:08:45 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:10:11 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:13:12 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:15:07 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:17:02 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:18:11 2024 kern.info kernel: [280383.808963] mt7530-mdio mdio-bus:1f lan2: Link is Down
Sun Jul 21 06:18:11 2024 kern.info kernel: [280383.814803] br-lan: port 2(lan2) entered disabled state
Sun Jul 21 06:18:11 2024 daemon.notice netifd: Network device 'lan2' link is down
Sun Jul 21 06:18:43 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:20:08 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:22:03 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:24:14 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:26:09 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:27:49 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:30:15 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:32:09 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:33:35 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:35:15 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:37:01 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:39:10 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:41:06 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:42:46 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:45:03 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:47:03 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:49:13 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:51:08 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:52:49 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:55:06 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:57:16 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 06:59:02 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:00:44 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:00:44 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:02:08 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:03:55 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:06:03 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:08:14 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:10:09 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:11:49 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:14:15 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:16:10 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:18:05 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:19:46 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:21:11 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:23:07 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:25:17 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:27:03 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:28:43 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:30:09 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:31:29 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan) 192.168.1.230 22:d8:29:c5:97:bb
Sun Jul 21 07:31:29 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan) 192.168.1.230 22:d8:29:c5:97:bb
Sun Jul 21 07:32:04 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:34:14 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:36:10 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:37:54 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:40:05 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:42:00 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:43:37 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:45:02 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:47:13 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:49:08 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:50:48 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:53:14 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:55:00 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:56:40 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 07:58:05 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com
Sun Jul 21 08:00:00 2024 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: device4324324-3440a3f9-local.wd2go.com

2 Odpowiedź przez piomark

  • Zarejestrowany: 2010-09-07
  • Posty: 25

Odp: dnsmasq possible DNS-rebind attack detected - co to jest

http://eko.one.pl/forum/viewtopic.php?pid=62413#p62413

3 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,362

Odp: dnsmasq possible DNS-rebind attack detected - co to jest

Robisz 

uci set dhcp.@dnsmasq[0].rebind_protection=1
uci add_list dhcp.@dnsmasq[0].rebind_domain=device4324324-3440a3f9-local.wd2go.com
uci commit
/etc/init.d/dnsmasq restart

Ta domena zwraca lokalny adres IP (a nie powinna), więc dnsmasq z natury się drze o takie rzeczy

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

4 Odpowiedź przez byku (edytowany przez byku 2024-07-25 03:13:31)

  • byku
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2013-04-28
  • Posty: 96

Odp: dnsmasq possible DNS-rebind attack detected - co to jest

dalej tego nie kumam, jak to jest możliwe, żeby lokalny "system" wysyłał do jakichś RIPE czy innych lokalny (blędny) zakres ip 192.168.0.4
ps. Cezary sfalszowałem numery, sorry za to, ale wiesz o co chodzi z tym wd2go.

5 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,362

Odp: dnsmasq possible DNS-rebind attack detected - co to jest

Chcesz to sobie zobacz - jakie masz serwery dns, co one odpowiadają jak spytasz się o tą domenę itd.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona