10 ms·
A DNS hijacking wave is targeting companies at an almost unprecedented scale
- ams6110 8y agoThe "clever trick" seems to be: previously compromised the login credentials for the administration panel of the target’s DNS provider or previously compromised domain registrar or ccTLD Unless I'm missing something, given either of those things, doesn't take much cleverness...
- ploxiln 8y agoIt's some kind of alarmism over letsencrypt ... "letsencrypt will give tricky attackers a valid certificate for a domain!!!" (if they get control over the domain) (... certs have almost always been granted based on control of the domain, though historically it mostly MX records ... so attackers could do pretty much the same thing 15 years ago)
- cronix 8y agoI believe this is why letsencrypt certs are only valid for 3 months. Personally, I'd like it monthly.
- deleted 8y ago[deleted]
- Crosseye_Jack 8y agoI was under the impression that it was more to get admins to automate the issuance and have it auto renew than manually issue and forget and let the cert expire. If I have control of a dns or register control panel I can use any of the other free ssl certs out there for an attack. Comodo Will give you a valid cert for 90 days as a trial, others will give you 30 days. AWS cert manager (ok iirc I can only use those within AWS but the point still stands. And if I’m being naughty it’s not gonna be hard to acquire a few stolen CC to bill my AWS usage too) will give you a year. All for free. WooSign / StarCom used to issue free 1 year certs (I think wooSign might still do but they are issued by another CA).
- dcbadacd 8y agoThis also fixes certificates lasting too long after domains change hands, allows faster deployment of certs with fixes and other new tech. There are many benefits to short expiry.
- 3pt14159 8y agoYeah but you used to need a credit card. The barrier to entry is lower. HTTPS is a tire fire.
- tazard 8y agoYour completely right, where on Earth would criminals and scammers be able to get a credit card? /s I am having a hard time understanding how more websites using https could possibly be a worse thing.
- gregmac 8y agoLots of people still have the mindset that http is the default and https signals a high level of trustworthiness. What we're shifting towards (and maybe already are there) is https is default, and an http-only site is an amateur setup, on the same level as hosting your site via IP (no domain name at all) or with a url like http://myisp.net/~mycompany/default.htm http://myisp.net/~mycompany/default.htm. Like it or not, browsers are treating sites like this now, and you don't see many "Secured by TrustworthyCo SSL" golden padlock badge images anymore.
- 3pt14159 8y agoYeah, yeah. So many on HN has this mindset. Criminals just whip up credit cards like it's nothing. They don't. It's noisy to use some grandma's credit card to buy a cert for buttsnstuff.ca when she donates to her local church five times a month. Almost all criminals are fucking dumb or even if they're smart they fuck up before they're good and land themselves in jail. Like at least 98% of them. HTTPS is a tire fire. Root certs by hostiles. Near-trivial PDAs. Termination at network edge. OS installed certs. Even when it "works" 95% of the packets are on shitty, broken ciphers with no forward secrecy. And that last 5% is built on PKI which we know quantum is breaking pretty fucking soon. Almost nobody rotates access tokens. Almost nobody layers encryption. Almost nobody safeguards certs by locking down permissions. Almost nobody pins them. Almost nobody uses HSTS. Everything is shabby and shitty and breakable. Let's Encrypt is the wrong solution. It helps irrelevant hobby websites and increases risk for medium sized companies that tried to do the right thing.
- michaelbuckbee 8y agoSomething I'm always interested in is how vulnerabilities/attacks are leveraged once a system is compromised. Obviously if an attacker controls DNS they could do all sorts of bad things: setup a phishing site that looks official, put up a fake press release announcing a merger or sale to manipulate the stock price, hold the domain hostage, etc. Most of those actions (while bad) would be detected pretty readily. What's clever here is that the attackers _maintain_ a working proxy back to the real system for an extended period of time. Time during which they can then inspect the traffic and peel out sensitive data, presumably to re-use those credentials to break into other systems and escalate further.
- ttul 8y agoThis is not a clever trick. This is just a count compromise. Don’t use a shitty domain registrar or a shitty DNS hosting service and for gods sake use multi factor authentication on what is the most crucial element of your online presence.
- bonyt 8y agoWhat ever happened to HPKP? It seems like that would somewhat mitigate these attacks since they rely on using their control over the domain to get a new DV cert. A pinned certificate would at least protect those who have accessed the sites before.
- mh- 8y agoDeprecated/killed. https://www.chromestatus.com/feature/5903385005916160 https://www.chromestatus.com/feature/5903385005916160
- moosingin3space 8y agoIf you're confused as to why, this article was illuminating: https://scotthelme.co.uk/using-security-features-to-do-bad-things/ https://scotthelme.co.uk/using-security-features-to-do-bad-t...
- tptacek 8y agoHPKP was underdesigned; it was a protocol evolution of something Google was already doing semi-manually. There was a competing initiative inside Google --- certificate transparency --- and that won out. There's validity in the approach and I hope it comes back sometime, maybe with additional mechanism around managing pins.
- dcbadacd 8y agoIs HPKP Report Only also being deprecated?
- duskwuff 8y agoHPKP could have potentiated these attacks by allowing an attacker to pin their certificate while they were in control of the domain, making it difficult for the domain owner to ever fully regain control.
- ufmace 8y agoBeing widely phased-out due to being too risky and error-prone. Attacks like this get a lot of media attention, but are pretty rare overall. It's much more common for someone to handle certificates and servers badly somehow, ending up in locking all of your visitors out of your own site, or you never bother with it, but the attacker who takes over your domain does, once again basically hijacking your domain name indefinitely. I never set it up for any of my sites for the same reason, just too many ways for it to go wrong.
- mobilemidget 8y ago"One DNS hijacking technique involves changing what’s known as the DNS A record." Could be any record, depends on the intentions of the hijacker. Typically we see web traffic being hijacked to another ipv4 host which indeed, is an A record. Another abuse option could be to alter SPF/DKIM to do a more sophisticated phishing campaign.
- aidos 8y agoAnd because there are so many SPF records including SPF records including... you can be pretty undetectable.
- tptacek 8y agoNote that these attacks involve compromised accounts with authority servers, so despite being the most visible and impactful DNS attacks of the last few years, DNSSEC would have done little to defend against them; in fact, even in the DNSSEC fantasy-world where DANE replaces X.509 CAs, these attackers would still have accomplished their goals.
- wahern 8y agoDNSSEC has the unique advantage of permitting offline signing. If you go this route, even somebody controlling your authoritative servers wouldn't be able to modify your records.
- tptacek 8y agoIt doesn't matter if you use offline signing for your zone if someone owns up the account you log into to control your domain with your registrar, or owns up the registrar. So no, even with offline signing, DNSSEC did nothing here. But it's worth keeping in mind that most organizations can't use offline signing, because the duct-tape-and-baling-wire solutions DNSSEC applies to people dumping zones with NSEC records all require online signers.
- wahern 8y agoDepending on the registrar, updating glue records can be a separate process that requires additional authentication. Not long ago my registrar required me to contact them directly to update glue records. Offline signing is a very useful feature precisely because it makes it easier to differentiate security domains. For example, I could use offline signing for foo.com (along with a registrar lock) but delegate the subdomain dyn.foo.com to a separate SOA that uses real-time signing (or none at all) for use by internal services. The problem with the modern web PKI is that, as a practical matter, everybody is forced to put their private keys not only online, but unprotected (because HSM and PKCS#11 support isn't that great, yet).[1] Key rotation and certificate expiration doesn't really solve the problem; in fact, rotation exacerbates the problem by 1) forcing you to keep the CA keys online, and 2) incentivizing increasingly loose authorization policies. Offline signing makes it easier to manage risk in a more robust manner. It's a tool, not a panacea; a tool conspicuously missing from TLS infrastructure. Some newer projects like Wireguard have effectively turned asymmetric key authentication systems into something that walks and quacks exactly like shared passwords. They do it because key management is a hard problem. But I'm not ready to throw in the towel, and the option (both officially and as a practical choice) of offline key signing in DNSSEC is under appreciated. From a security perspective, allowing people to enumerate my subdomains is a small price to pay for permitting me to keep my private keys offline. I don't expect everybody to make that calculation, but it bothers me that people fail to see the value at all. [1] People faithfully recite the mantra "encrypt at rest" as if that means something. Data at rest is useless. If your data is worth anything then you're going to actually be, you know, using it, and if it's not protected in use then it's all just security theater. This is most clear with the private keys (e.g. stored "encrypted at rest" in KMS) used by cloud services for acquiring access tokens. It's 2019 and industry is still basically using shared passwords--tons of them, a complex web of passwords dutifully pushed around the network by layers of complex software. As if any of it matters to someone who has figured out how to penetrate your network; as if 5 minute or even 5 second password rotation matters to the guy who already figured out how to automate penetration onto your systems.
- PaulHoule 8y agoCould this be a big setback for "Let's Encrypt" since it uses DNS resolution for its own authentication instead of being a second factor?
- JoshTriplett 8y agoAll domain-validated certificates use factors you can control if you control the domain, whether email or web or DNS. This has nothing to do with Let's Encrypt.
- PaulHoule 8y agoYeah, but it is a problem with domain-validated certificates in general that kinda defeats the purpose of SSL. It seems most of the time that a web site is "hacked" (defaced) somebody changed the DNS instead of attacking the actual web server. SSL signing can potentially be a second line of defense, but only if having control of the DNS (thus web and email) is insufficient to get a cert.
- icedchai 8y agoWhat are the alternatives? About 20 years ago, I remember having to go through tons of hoops to get a certificate. Faxing corporate docs and other bureaucracy. That can all be forged.
- dylz 8y ago- TXT record: pointless if your DNS is hacked - CNAME record: pointless if your DNS is hacked - Put a file or add a meta-tag to HTML at a specific path: pointless if your DNS is hacked, they can just add/change A/AAAA record and host their own webserver - Email to webmaster@.. etc: pointless if your DNS is hacked, add MX record
- dcbadacd 8y ago> That can all be forged. And this is where a lot of the world is heavily behind say Estonia, Latvia (or other countries) that provide cryptographically secure signed documents tied to people, you practically can't forge those documents.
- cobbzilla 8y ago"almost unprecedented" implies that there was an earlier wave of DNS hijacking that was even larger (thus setting some kind of precedent). Was there such a precedent? And if so, I didn't see mention of it in the article.
- throwaway5752 8y agoSource link: https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html https://www.fireeye.com/blog/threat-research/2019/01/global-...
- ccnafr 8y agoYes. The source reads much better.
- westurner 8y ago> The National Cybersecurity and Communications Integration Center issued a statement [1] that encouraged administrators to read the FireEye report. [2] [1] https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS... [2] https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html https://www.fireeye.com/blog/threat-research/2019/01/global-...
- abbadadda 8y agoVia the article: "(FireEye) advised administrators to take a variety of measures, including: * ensure they’re using multifactor authentication to protect the domain’s administration panel * check that their A and NS records are valid * search transparency logs for unauthorized TLS certificates covering their domains and *conduct internal investigations to assess if networks have been compromised"
- LeonM 8y agoThat's why I placed this Ask HN a while ago: https://news.ycombinator.com/item?id=17704828 https://news.ycombinator.com/item?id=17704828 I pitched that idea at startup school, and got accepted. However, after a while I pivoted to something else, as I decided that the name registry and DNS market is just too crowded. I was afraid that we'd be spending 99% of the time and budget on convincing people they need secure domain/DNS management, instead of building the technology.
- btrettel 8y agoSecurity could be an advantage for a variety of online services. When selecting an online service, I'm starting to use U2F 2FA support as a way to narrow the list of services to consider, so making a decision is easier. Few domain name registrars offer U2F from what I can tell.
- josefresco 8y agoThis is clever in that they evaded detection. But I've seen and been the victim of much more sophisticated DNS hijacks that didn't require any credentials.
- Animats 8y agoThis is the problem with quickie SSL cert issuance from "Let's Encrypt". If it took 10 days of consistent domain resolution to get an SSL cert, this wouldn't be happening.
- topranks 8y agoThe attack is based on compromising control of the victim’s domain. What’s to stop someone in control of a domain putting records up for 10 days? It’d still happen, just be a delay between compromising the domain and getting the cert is all.
- Animats 8y agoPresumably the owner of the domain would notice if their site was diverted for ten days.
- hedora 8y agoIf an attacker can spoof your DNS records (or if they can simply man in the middle the connection between your server and the internet), then they can generate valid Let’s Encrypt certificates. If I had the time or inclination, I’d write a transparent https gateway that used let’s encrypt to man-in-the-middle http and https connections to servers behind it. You could imagine deploying something like that on the edge of AWS for mass surveillance purposes, or maybe a misguided white-hat could use it to “secure” http-only services (it’s an improvement in a defeatist sort of way...)
- wcdolphin 8y agoFor the MTM scenario, how would you convince letsencrypt’s CA to issue you a cert for any domain? Don’t you need to complete the challenge in order for the CA to issue you a cert?
- topranks 8y agoYou’d have to somehow redirect / spoof DNS responses to Let’s Encrypt to fool them and make it look like you passed the challenge. Not trivial, but far from impossible for as long as the world maintains that securing the DNS is pointless.