3 ms·

Update: see other comment chains invalidating the security I'm claiming HSTS provides. APIs will probably go directly to https:// https://, and hopefully cert

Update: see other comment chains invalidating the security I'm claiming HSTS provides. APIs will probably go directly to https:// https://, and hopefully cert failures will cause the API to blow up with minimal harm. If you want to visit my web site, and you need to type it in, you'll probably just put realms.org into the URL bar of your browser. Most secure websites, such as paypal.com, have something called HSTS https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security to force the browser to always hit the site with https, even if requested to it it http: dana@araman:~$ curl -D - https://paypal.com https://paypal.com 2> /dev/null |grep -i strict-transport Strict-Transport-Security: max-age=63072000 dana@araman:~$ So even if going to paypal.com lands you on a blackhat server, the cert will still blow up, protecting you. Slightly related: much to my annoyance, it seems that neither AWS ELB nor ALB support sending HSTS, which is a real bummer.

philjohn 9y ago
Except, it would have been trivial for them to get Lets Encrypt to issue them a valid cert.
- Diederich 9y ago
  Yup, I saw that after I commented. I edited and put a warning at the top of my post.
- Manozco 9y ago
  it depends, let's encrypt might be performing request from different sources (and then it would need a bigger BGP hijack to fake them)
  - notriddle 9y ago
    If LetsEncrypt is actually hosted within AWS, then a network request from them to Route53 might not even hit the public internet.
  - tialaramex 9y ago
    Yes, Let's Encrypt acknowledges that they perform their validations from multiple observation points on the Internet. They (intentionally) don't provide a list. This occasionally annoys people who have an idea like "I will firewall everything but whitelist Let's Encrypt" and then find out that while you're welcome to try to puzzle out some way to make this work, Let's Encrypt won't help you and when it breaks you get to keep both halves.
- disiplus 9y ago
  i assume that did not work because the challenge would fail because it looks that only google dns would return invalid results.
tetha 9y ago
Yep, this is nasty to defend against. Most of our internal infrastructure handling GDPR-data would be fine with this incident, since we encoded mutual validation and trust into a lot of systems. Clients need to authenticate to be authorized, obviously, but clients also authenticate the server against company-internal secrets. This is done using a bunch of secret, self-signed CA-Chains or managed ssh/known_hosts files. But that kind of system is quite impossible to implement without control over the server and the client-side. And if the client has to get the information from somewhere, you have a tradeoff - flexibility vs security. You can either change the source of trust in a client quickly, as an attacker, or you can provide a secure connection which can be changed with 6 years of planning as a service provider.
web007 9y ago
> Slightly related: much to my annoyance, it seems that neither AWS ELB nor ALB support sending HSTS, which is a real bummer. I didn't know that either one lets you set any kind of header - I've always set a passthrough on the upstream, so it's guaranteed no matter what the LB or routing framework is used. curl -sI -H 'Host: myhost.mydomain.com' https://long-alb-descriptor.us-west-2.elb.amazonaws.com/ | grep Strict Strict-Transport-Security: max-age=15552000; includeSubDomains; preload

philjohn 9y ago

Except, it would have been trivial for them to get Lets Encrypt to issue them a valid cert.

Diederich 9y ago
Yup, I saw that after I commented. I edited and put a warning at the top of my post.
Manozco 9y ago
it depends, let's encrypt might be performing request from different sources (and then it would need a bigger BGP hijack to fake them)
- notriddle 9y ago
  If LetsEncrypt is actually hosted within AWS, then a network request from them to Route53 might not even hit the public internet.
- tialaramex 9y ago
  Yes, Let's Encrypt acknowledges that they perform their validations from multiple observation points on the Internet. They (intentionally) don't provide a list. This occasionally annoys people who have an idea like "I will firewall everything but whitelist Let's Encrypt" and then find out that while you're welcome to try to puzzle out some way to make this work, Let's Encrypt won't help you and when it breaks you get to keep both halves.
disiplus 9y ago
i assume that did not work because the challenge would fail because it looks that only google dns would return invalid results.

tetha 9y ago

Yep, this is nasty to defend against. Most of our internal infrastructure handling GDPR-data would be fine with this incident, since we encoded mutual validation and trust into a lot of systems. Clients need to authenticate to be authorized, obviously, but clients also authenticate the server against company-internal secrets. This is done using a bunch of secret, self-signed CA-Chains or managed ssh/known_hosts files. But that kind of system is quite impossible to implement without control over the server and the client-side. And if the client has to get the information from somewhere, you have a tradeoff - flexibility vs security. You can either change the source of trust in a client quickly, as an attacker, or you can provide a secure connection which can be changed with 6 years of planning as a service provider.

web007 9y ago

> Slightly related: much to my annoyance, it seems that neither AWS ELB nor ALB support sending HSTS, which is a real bummer. I didn't know that either one lets you set any kind of header - I've always set a passthrough on the upstream, so it's guaranteed no matter what the LB or routing framework is used. curl -sI -H 'Host: myhost.mydomain.com' https://long-alb-descriptor.us-west-2.elb.amazonaws.com/ | grep Strict Strict-Transport-Security: max-age=15552000; includeSubDomains; preload