So the fine writeup of SIGRed (CVE-2020-1350) includes a brief discussion of a neat technique to make a Microsoft browser perform DNS lookups to arbitrary nameservers, which can then also be infected. /cc @EyalItkin & @omriher 1/9 research.checkpoint.com/2020/resolving…
Normally, you can't really do DNS lookups using the DNS protocol from browsers. Sure, the browser will resolve names for you, but it chooses how to do that. You can't direct the query anywhere, or do non-standard lookups. This is pretty good. 2/9
But what if you really really want to talk to a nameserver, for example to attack it? Browsers do speak HTTP, and do so very well. Some browsers, notably from Microsoft, are even prepared to send HTTP queries to the DNS port (53). 3/9
But, HTTP queries will typically confuse nameservers, as they look nothing like DNS queries. A DNS query over TCP always starts with a two byte length field. We don't really control the beginning of an HTTP request, it starts with GET or POST. Let's assume POST. 4/9
A nameserver will treat the first two bytes 'P' and 'O' as a length field. And this offers us an opening. After the POST come a lot of headers we can't control, but we can guess how long they will be. 'P' and 'O' correspond to a 20559 byte length field. 5/9
This means the nameserver will first read 20559 bytes as a DNS message, fail to parse the DNS message (because it is a bunch of HTTP).. and then read another two-byte length field for the next message. But by now we are in part of the HTTP session we fully control! 6/9
This is how the SIGRed writeup proposes to make browsers scan (local) networks for further nameservers to infect, even if they aren't configured as system resolvers. It is very clever. Most non-Microsoft browsers however are on to this trick and block HTTP attempts to port 53 7/9
But that doesn't matter since this attack is only going to work in enterprise environments that run the Microsoft nameservers. And many of those will also run Microsoft browsers! 8/9
So in this way, the SIGRed vulnerability can not only "worm" itself via the Microsoft DNS server, it can also use Javascript in Microsoft browsers to scan your network for DNS servers you might not even be aware of. SO UPDATE TODAY PLEASE! 9/9
Addendum to tweet 6: because we fully control the contents of the HTTP session from that point, this is where we can insert our special DNS query that will help infect the name server.
Update via @rsedmonds, turns out this "cross-protocol scripting" was well known back in 2001. But it still works today! /cc @SteveBellovin kb.cert.org/vuls/id/476267 
