3 ms·
> DNS redirect attacks (common/easy due to social engr) combined with malicious HPKP could result in some nasty ransoming How? Someone can hijack your resolver
by nly 9y ago
> DNS redirect attacks (common/easy due to social engr) combined with malicious HPKP could result in some nasty ransoming
How? Someone can hijack your resolver but they still need a valid certificate for the name before they can install the pin?
- Laforet 9y agoOnce an attacker controls a domain it is trivial to get a DV certificate signed with their own key.
- nly 9y agoHijacking a authorative DNS server is different kettle of fish to hijacking a resolver used by a client. You need to either infiltrate a CA or do the former for a DNS attack to work and get you a DV certificate.
- user5994461 9y agoOnce a site is breached, the attacker is usually in control of the domain and he can order any legitimate certificate for it.