3 ms·
Interesting that wasn't the approach they took, and instead injected for the DNS server - any idea why?
by richardwhiuk 9y ago
Interesting that wasn't the approach they took, and instead injected for the DNS server - any idea why?
- tptacek 9y agoThey did the simplest thing that could possibly work. Their target didn't even set HSTS. It wasn't exactly the vault at the Bellagio.
- jgrahamc 9y agoI think there's also a tradeoff. If they had redirected a large chunk of AWS traffic to their machines it would have been hard to handle, by redirecting Route53 and poisoning DNS they get a big bang for their buck because the public resolvers (like 8.8.8.8, 9.9.9.9 and 1.1.1.1) will take the poisoned records and do the real work of serving the DNS records. So, I think it was a rational choice.