DigitalOcean DNS/ARP Exposure

Posted by JosephRedfern on Sunday May 19, 2013 @07:50PM
from the self-post dept.

I'm not sure if this is an issue or not, but I noticed that running tcpdump on a DigitalOcean droplet shows you ARP and DNS requests. This lets you get a list of machines hosted by DigitalOcean... I might be way off here, but could this make DO vulnerable to ARP spoofing?

Made a quick video to demonstrate what I mean: http://www.youtube.com/watch?v=gmNaJCkGFOw

( 4 comments | 2 points | on HN )

Re:DigitalOcean DNS/ARP Exposure by jeff_carr on Sunday May 19, 2013 @10:11PM (#5735450)

Just FYI, I think what you are seeing is normal and arp spoofing is still being blocked. (Open a ticket anyway, We're happy to give people free hosting credits for reporting bugs and security holes.)

-- Jeff Carr Chief Architect Digital Ocean Inc.

[ Parent | on HN ]

Re:DigitalOcean DNS/ARP Exposure by JosephRedfern on Sunday May 19, 2013 @10:58PM (#5735601)

Cool, will do. I mentioned it on IRC, but I'll open a ticket too.

By the way - it's nice to see such a pro-active response from DO. Great work!

[ Parent | on HN ]

Re:DigitalOcean DNS/ARP Exposure by slyv on Sunday May 19, 2013 @08:32PM (#5735136)

It might be wise to contact DigitalOcean support (or on their forums) before posting this on a public forum that they probably will not read. Even if you are completely wrong, there is no problem in letting their support know.

[ Parent | on HN ]

Re:DigitalOcean DNS/ARP Exposure by JosephRedfern on Sunday May 19, 2013 @08:48PM (#5735179)

I mentioned it on the DO IRC channel, apparently it's being looked into.

[ Parent | on HN ]