3 ms·

Imagine Foo, Inc., a hot new startup disrupting $industry. DNS for foo.com (which was paid up for several more years) is hosted on Route 53. One day, they run

Imagine Foo, Inc., a hot new startup disrupting $industry. DNS for foo.com (which was paid up for several more years) is hosted on Route 53. One day, they run out of money and close up shop. Their Amazon AWS accounts get shut down. The domain gets wiped from Route 53. You come along and add foo.com as a hosted zone in Route 53. You point MX RRs towards a machine you control and begin reading the mail sent to $users@foo.com that will continue to arrive for the next several years. Perhaps you even use your new access to all @foo.com addresses to do some password resets on long forgotten accounts.

BillinghamJ 10y ago
The combination of this being fairly unlikely to be attempted, along with Foo Inc no longer existing, I really don't think this is a significant issue.
- voltagex_ 10y ago
  This would be valid for bug bounties on things like HackerOne. I wonder if this attack is in any writeups.
- jlgaddis 10y ago
  I manage some mail servers for an ISP. There have been times when I've came across domains that we still have control over but the companies are long gone. Many times I'll "recycle" domains (old ones of mine, "donated" domains, or some of these "forgotten" domains) and use them for spam traps. Typically, I wait until a domain hasn't been used legitimately for e-mail for at least one year (i.e. I'll set "null" MX records or point them to a non-existent host) before I repurpose them. You might be surprised at the types of e-mails that start flowing right back in after pointing the MX RR back to a real host: lots of it is crap (spam), but I've received travel itineraries, notifications from AmEx, appointment reminders from medical facilities, and all kinds of good stuff.
icedchai 10y ago
The same thing can happen if the domain expires and you re-register it, right?
- duskwuff 10y ago
  Correct. The only difference is that the behavior is expected when you register the domain yourself.

BillinghamJ 10y ago

The combination of this being fairly unlikely to be attempted, along with Foo Inc no longer existing, I really don't think this is a significant issue.

voltagex_ 10y ago
This would be valid for bug bounties on things like HackerOne. I wonder if this attack is in any writeups.
jlgaddis 10y ago
I manage some mail servers for an ISP. There have been times when I've came across domains that we still have control over but the companies are long gone. Many times I'll "recycle" domains (old ones of mine, "donated" domains, or some of these "forgotten" domains) and use them for spam traps. Typically, I wait until a domain hasn't been used legitimately for e-mail for at least one year (i.e. I'll set "null" MX records or point them to a non-existent host) before I repurpose them. You might be surprised at the types of e-mails that start flowing right back in after pointing the MX RR back to a real host: lots of it is crap (spam), but I've received travel itineraries, notifications from AmEx, appointment reminders from medical facilities, and all kinds of good stuff.

icedchai 10y ago

The same thing can happen if the domain expires and you re-register it, right?

duskwuff 10y ago
Correct. The only difference is that the behavior is expected when you register the domain yourself.