6 ms·
The core of the problem, a lot of paragraphs down: > we have strong evidence that supports our hypothesis that the adversary gained access to our [DNS provider
by RandomTrees 9y ago
The core of the problem, a lot of paragraphs down:
> we have strong evidence that supports our hypothesis that the adversary gained access to our [DNS provider's] credentials through the compromise of a third party provider
> A factor which possibly helped the attacker was that the password had not been changed since 2013
> We chose our DNS provider 18 years ago when 2FA was neither a consideration nor a possibility
- c12 9y agoSlightly off topic but 2FA was both possible and a consideration 18 years ago, just not for the majority of people.
- chinathrow 9y agoCorrect. Banks in Europe hat various 2FA methods in place, even in the early days of online banking around year 2000.
- kybernetikos 9y agoI was using a simple form of 2FA with my retail bank in Switzerland back in the early 2000s.
- gpvos 9y agoDid any DNS providers implement it at that time?
- astura 9y agoYeah, that stuck out to me too, I know SecurID has been around since at least the early 2000s.
- pc86 9y ago18 years ago was 1999.
- ams6110 9y agoFirst time I used a 2FA device was an RSA "Safeword Card" which looked like a small handheld calculator and would display a multi-digit code that changed every minute or so. This was in 1998 and it had been put into use before that.
- deleted 9y ago[deleted]
- mc32 9y agoI think Sun Micro had deployed those to all their engs, perh others too. I think it had a PIN which when entered displayed the code which was valid for a min.
- ams6110 9y agoYeah, you're right. The rotating number device (with no PIN entry) came later.
- plussed_reader 9y agoYou never possessed a bank or credit card prior to 1998? Isn't the account on the card + your pin 2FA?
- astura 9y agoI'm well aware. I meant SecurID were fairly well established by the early 2000s for VPN access, from what I remember, so I assume they came around at least a few years earlier, which would be the late 90s, they also weren't the only option on the market.
- gist 9y ago> but 2FA was both possible and a consideration 18 years ago You could setup your own dns servers obviously 18 years ago and in fact when starting out in the mid 90's that is exactly what we and many others did. (Criket Liu nutshell books from O'Reilly) http://shop.oreilly.com/product/9781565920101.do http://shop.oreilly.com/product/9781565920101.do http://www.oreilly.com/pub/au/284 http://www.oreilly.com/pub/au/284
- pfg 9y agoTo clarify, the problem here wasn't with their DNS servers, but rather the registrar being compromised. You could run your own DNS servers and still get compromised like this unless you also happen to run your own registrar.
- w8rbt 9y agoMost all of the registrars and DNS mgt services support TOTP now for 2FA. If yours does not, move to one that does.
- arthurfm 9y agoIt's a shame so few registrars support hardware tokens [1] since those would be better still. [1] https://twofactorauth.org/#domains https://twofactorauth.org/#domains
- discordianfish 9y agoTo me the biggest question is whether or not TLS was in place. That should prevent the attacker from intercepting the actual data without the victim noticing.
- jorams 9y agoThe post says the following: > Maximum 10-minute time window during which the attacker temporarily rerouted and intercepted Fox-IT email for the specific purpose of proving that they owned our domain in the process of fraudulently registering an SSL certificate for our ClientPortal.
- tialaramex 9y agoSpecifically Comodo reports that they sent their normal validation email to hostmaster@fox-it.com (which unknown to Comodo or Fox-IT at the time was being directed to the attackers). I've never used Comodo's implementation of 3.2.2.4.4 but typically there's an email with a code in it, telling you to go to a web page and paste the code in if you want to authorise the issuance of the requested certificate, or something along those lines. The security of this validation method (3.2.2.4.4) depends upon 1. You control DNS for your domain including the MX records used to deliver email (this is where Fox-It came undone here) 2. You control the MX servers, or if you have a third party providing backup MX, you trust them not to abuse that 3. The Certificate Authority does a good job of getting accurate DNS records and connecting to the right IP address 4. All email addresses in your WHOIS records plus a handful of famous ones like hostmaster@ postmaster@ are delivered to people you trust in your organisation.
- tomwas54 9y agoNo, it doesn't. As mentioned in the article, the attacker successfully requested a TLS certificate for the hostname, which was possible because he could pass a CA's domain validation. I'm not entirely sure, but I think HPKP could have prevented this for returning customers, because Fox-IT would have been able to pin the key of their own certificate. Then the new certificate used by the attacker would have been rejected by the customer's browser.
- bearcherian 9y agoSo 18 years of outdated security practices...