4 ms·
If I were the hacker: 1. I would get a proper SSL cert signed 2. Only hijack one of the ranges, and do not respond to other domains (causing SERVFAIL), so oth
by isaack 8y ago
If I were the hacker:
1. I would get a proper SSL cert signed
2. Only hijack one of the ranges, and do not respond to other domains (causing SERVFAIL), so other domains will resolve unaffected, instead of causing a scene (see: https://www.reddit.com/r/sysadmin/comments/8ejrkk/google_dns_issues/ https://www.reddit.com/r/sysadmin/comments/8ejrkk/google_dns...)
- cjbprime 8y ago> 1. I would get a proper SSL cert signed Uh, how? Are you assuming that a single BGP leak would be enough to cause e.g. a letsencrypt misissuance for the domain? It sounds like (from other comments) they have a global round-robin resolver setup for their DNS challenges. > 2. Only hijack one of the ranges, and do not respond to other domains (causing SERVFAIL), so other domains will resolve unaffected I think exactly that's what they did. I saw people posting SERVFAILs during the outage.
- baby 8y ago> they have a global round-robin resolver setup for their DNS challenges no they don't
- geoah 8y ago> I think exactly that's what they did. I saw people posting SERVFAILs during the outage. Author is suggesting they should be properly resolving the rest of the domains so they wouldn't cause SERVFAILs.
- zyberzero 8y agoThey do, and they don't. They have a round robin setup, for which resolver that validates the DNS challenge - however, they do not validate the DNS challenges from several resolvers[1]. So, if that particular resolver got caught in the BGP leak while doing a challenge verification you could get a valid cert. Lots of ifs and buts - but it is certainly possible. [1] https://news.ycombinator.com/item?id=16918382 https://news.ycombinator.com/item?id=16918382