Forescout Research
forescout.com · Company blog · on HN since 2019
Forescout's research team reports vulnerabilities in IoT, OT, and network devices, including TCP/IP stacks and power grid equipment.
What HN saysHN links it for Forescout's disclosures such as Amnesia:33, with commenters pointing to its white paper and discussing the DNS packet parsing details.
15HN people shared it
2linked it in comments
13stories submitted
23story points
1 year agolast shared
2019people per year2026
Most-shared posts
- 1Sun: Down – A Dark Side to Power Grids2 people · 3 points · first shared 2025 · 1 comments on HN
- 2Amnesia: TCP/IP Stacks Breed Critical Vulnerabilities in IoT, OT2 people · 3 points · first shared 2020 · 1 comments on HN
- 3Amnesia:33 – TCP/IP Vulnerabilities Impacting Millions of IoT, OT and IT Devices1 people · 4 points · first shared 2020 · discussion on HN
- 4Three New BGP Message Parsing Vulnerabilities Disclosed in FRRouting Software1 people · 3 points · first shared 2023 · discussion on HN
- 5Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS1 people · 3 points · first shared 2025 · discussion on HN
- 6New critical operational technology vulnerabilities found on NicheStack1 people · 2 points · first shared 2021 · discussion on HN
- 7New DNS Vulnerabilities, Impacting Millions of Enterprise and Consumer Devices1 people · 1 points · first shared 2021 · discussion on HN
- 8Forescout Discovers Multiple Vulnerabilities in DTEN Conferencing Systems1 people · 1 points · first shared 2020 · discussion on HN
- 9A probe into Chinese-connected devices in US networks1 people · 1 points · first shared 2024 · discussion on HN
- 10Sabotaging IoT Devices Like Philips Hue in Smart Home Environments1 people · 1 points · first shared 2019 · discussion on HN
- 11Forescout Labs Releases the Project Memoria TCP/IP Stack Detector1 people · 1 points · first shared 2020 · discussion on HN
- 12Amnesia33 identify and mitigate the risk from vulnerabilities lurking in millions of iot ot and it devices1 people · first shared 2020
- 13Forescout and jsof disclose new dns vulnerabilities impacting millions of enterprise and consumer devices1 people · first shared 2021
What HN people wrote when they linked it
taylorfinley · 2020-12-11
The white paper from Forescout (PDF warning):
https://www.forescout.com/company/resources/amnesia33-identify-and-mit…
cookiengineer · 2021-12-04
Multiple questions inside the same packet are quite common in DNS-SD based multicast queries.
The idea there is to save DNS packets so that you only ask for a pointer (PTR) to a service identifier and get as a response all information that you need (address via A/AAAA, hostname and port via SRV, API version and necessary parameters via TXT etc).
My point was exactly about the QDCOUNT field because its intent clearly was to be able to save unnecessary packets, but in practice, nobody uses it and wastes a lot of bandwidth. Note that technically, servers have to support TCP via port 53, too...but they never actually do :)
As a sidenote: 0x0c is only appearing because it's the start of the label identifier of the first question. This can be a byte pointer to anything, and, if labels of records are crafted maliciously, even lead to an infinite loop or buffer overflow on clients/resolvers with naive implementations (see NAMEWRECK vulnerability [1]).
Regarding the ANY problem and why it's disabled: I think this is the wrong point in the architecture to fix DDoS or amplification attacks and the abuse of a public resolver. ISPs or ASNs could simply block UDP traffic which has a different source/target network. That alone would reduce most of the DDoS traffic and probably fix most of the abuse.
I mean, at some point you have to wonder: What happens when hackers start to use TXT queries to DDoS a target because their buffer size is larger, too? Just disable TXT? I hope you…