4 ms·

I will never stop being infuriated by responses like this from companies - how many more megaleaks have to happen before they realize that they need to embrace

I will never stop being infuriated by responses like this from companies - how many more megaleaks have to happen before they realize that they need to embrace white hats, not ban their accounts, not sue them, not swat them / have them arrested, not silence them. Great find / writeup.

IanCal 10y ago
Why, when the author realised this was likely to be possible, didn't they get in touch with DO? Or try with a domain they knew was OK to use? Or at least just try with one domain. They took almost twenty thousand, sent all the requests to their own server and logged them. That's surely not your first step.
- mandatory 10y ago
  See my response below and the logs were secure removed shortly after (as stated in the blog post).
  - xuki 10y ago
    Not that I don't believe you, but you already lost white hat status in this case the moment you log traffic on 20k domains. Just do an attack on another domain you own is white hat, 20k domains is not.
    - mandatory 10y ago
      You're probably right about the logging being a bit too far, it was mainly my curiosity getting the best of me. One of my big assumptions was that all of these domains were just owned by one domain broker and this wasn't actually a systemic problem with the implemented importation methodology. I also thought it would be mild because if they had been deleted from an account they were likely no longer used (or so I had wrongfully assumed).
      - IanCal 10y ago
        I certainly don't attribute malice on your part, and I'm sorry if my comment came across this way. My point was (at least intended to be) that I'm not really surprised at DO banning you. I would be careful about doing something like this on a large scale, I would actually be surprised if this doesn't technically violate some laws. Please be careful, you don't want to end up trying to explain nameservers to a judge. [edit - and the rest of us don't want that either, even just selfishly I would like as many security researchers practicing their craft as possible, but also I don't want people being punished for trying to do the right thing]
- arkadiyt 10y ago
  Domains can only be added if they are not in another account, so he added only domains which were previously deleted but still pointed to DO nameservers (hence almost certainly not being used). And if DO was really concerned about the damage then they would have removed the added A records, but they didn't, they banned the author and continued to let all traffic go to his server.
  - IanCal 10y ago
    > (hence almost certainly not being used) Well they were still being accessed by real people. > And if DO was really concerned about the damage then they would have removed the added A records, but they didn't, they banned the author and continued to let all traffic go to his server. Both seem reasonable. And it does sound like the security team are actually doing something about it. > I reached out to DigitalOcean’s team to see if they can assist in deleting the domains from my account (sadly leaving them vulnerable again) or sinkholing the DNS to 127.0.0.1. I received a very helpful response from someone on the security team and it appears they will look into it. I assume these things happened from different departments. Banning an account because you saw it make 20k requests to your API adding domains seems pretty reasonable, and it was a few hours before they reached out. If you saw that activity, would you ban the account or leave it open hoping that they'd be doing something nice and reach out?
    - wongarsu 10y ago
      > Banning an account because you saw it make 20k requests to your API adding domains seems pretty reasonable, and it was a few hours before they reached out. If you saw that activity, would you ban the account or leave it open hoping that they'd be doing something nice and reach out? If I was a domain reseller, adding my 20k domains to digital ocean just to get banned without warning, explaination or option for reconsideration I would be rightfully upset. If they didn't want people adding large numbers of domains they could just have limited the feature instead of banning people who reach some arbitrary threshold. If on the other hand the department that executed the ban knew that the registrations weren't made by the domain owners, they should be discussing such a huge incident with the security team. That discussion would naturally lead to them knowing about the specifics of this case, unless this case wasn't widely shared in the security team. So the options are: 1. Digital Ocean bans legitimate customers without warning or option for reconsideration; for no obvious reason 2. Big security incidents don't get reported to the security team 3. The responsible people thought that this was not a big security incident 4. This incident wasn't discussed in the security team 5. They knowingly banned a white hat hacker (who may or may not have gone too far) Of all those options, the last one is by far the one that looks best for Digital Ocean.
treehau5 10y ago
Because it can still cause real damage, even if the intentions were good.
empath75 10y ago
I wouldn't call redirecting 10s of thousands of accounts 'white-hat' hacking. He could have just done like, I dunno, 3, to prove his point.

IanCal 10y ago

Why, when the author realised this was likely to be possible, didn't they get in touch with DO? Or try with a domain they knew was OK to use? Or at least just try with one domain. They took almost twenty thousand, sent all the requests to their own server and logged them. That's surely not your first step.

mandatory 10y ago
See my response below and the logs were secure removed shortly after (as stated in the blog post).
- xuki 10y ago
  Not that I don't believe you, but you already lost white hat status in this case the moment you log traffic on 20k domains. Just do an attack on another domain you own is white hat, 20k domains is not.
  - mandatory 10y ago
    You're probably right about the logging being a bit too far, it was mainly my curiosity getting the best of me. One of my big assumptions was that all of these domains were just owned by one domain broker and this wasn't actually a systemic problem with the implemented importation methodology. I also thought it would be mild because if they had been deleted from an account they were likely no longer used (or so I had wrongfully assumed).
    - IanCal 10y ago
      I certainly don't attribute malice on your part, and I'm sorry if my comment came across this way. My point was (at least intended to be) that I'm not really surprised at DO banning you. I would be careful about doing something like this on a large scale, I would actually be surprised if this doesn't technically violate some laws. Please be careful, you don't want to end up trying to explain nameservers to a judge. [edit - and the rest of us don't want that either, even just selfishly I would like as many security researchers practicing their craft as possible, but also I don't want people being punished for trying to do the right thing]
arkadiyt 10y ago
Domains can only be added if they are not in another account, so he added only domains which were previously deleted but still pointed to DO nameservers (hence almost certainly not being used). And if DO was really concerned about the damage then they would have removed the added A records, but they didn't, they banned the author and continued to let all traffic go to his server.
- IanCal 10y ago
  > (hence almost certainly not being used) Well they were still being accessed by real people. > And if DO was really concerned about the damage then they would have removed the added A records, but they didn't, they banned the author and continued to let all traffic go to his server. Both seem reasonable. And it does sound like the security team are actually doing something about it. > I reached out to DigitalOcean’s team to see if they can assist in deleting the domains from my account (sadly leaving them vulnerable again) or sinkholing the DNS to 127.0.0.1. I received a very helpful response from someone on the security team and it appears they will look into it. I assume these things happened from different departments. Banning an account because you saw it make 20k requests to your API adding domains seems pretty reasonable, and it was a few hours before they reached out. If you saw that activity, would you ban the account or leave it open hoping that they'd be doing something nice and reach out?
  - wongarsu 10y ago
    > Banning an account because you saw it make 20k requests to your API adding domains seems pretty reasonable, and it was a few hours before they reached out. If you saw that activity, would you ban the account or leave it open hoping that they'd be doing something nice and reach out? If I was a domain reseller, adding my 20k domains to digital ocean just to get banned without warning, explaination or option for reconsideration I would be rightfully upset. If they didn't want people adding large numbers of domains they could just have limited the feature instead of banning people who reach some arbitrary threshold. If on the other hand the department that executed the ban knew that the registrations weren't made by the domain owners, they should be discussing such a huge incident with the security team. That discussion would naturally lead to them knowing about the specifics of this case, unless this case wasn't widely shared in the security team. So the options are: 1. Digital Ocean bans legitimate customers without warning or option for reconsideration; for no obvious reason 2. Big security incidents don't get reported to the security team 3. The responsible people thought that this was not a big security incident 4. This incident wasn't discussed in the security team 5. They knowingly banned a white hat hacker (who may or may not have gone too far) Of all those options, the last one is by far the one that looks best for Digital Ocean.

treehau5 10y ago

Because it can still cause real damage, even if the intentions were good.

empath75 10y ago

I wouldn't call redirecting 10s of thousands of accounts 'white-hat' hacking. He could have just done like, I dunno, 3, to prove his point.