3 ms·

None of these domain hijacking attempts would’ve been prevented by DNSSEC, right? (Also kinda curious as to why pointing this out seems to be somewhat controve

None of these domain hijacking attempts would’ve been prevented by DNSSEC, right? (Also kinda curious as to why pointing this out seems to be somewhat controversial? :)

DKnoll 8y ago
Pretty sure you're right. The US-CERT advisory for this campaign implies the attackers were logging into the targets accounts at registrars or DNS providers directly. https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS...
r1ch 8y ago
Not really. In theory the zone signing could be done as a separate process from zone updates, but I don't think any DNS provider implements this - they hold the keys, not you. The other attacks used compromised domain registrar accounts, where the attacker could just disable DNSSEC or switch the nameservers to whatever.
bluejekyll 8y ago
As I understand the attacks being against the login admin accounts for managing the domain itself, no DNSSEC would not have prevented changing the records in the zone. In addition, if the DNS provider hosting that domain automatically resigned the zone for the hacked account, then the hosting company would even have resigned the zone, thus making valid DNSSEC entries anyway. What would be better is to require 2FA for all zone hosting companies.
- regecks 8y ago
  > What would be better is to require 2FA for all zone hosting companies. Even with this, many registrars and DNS hosts are too fast and loose with disabling 2FA when you call them up and tell them you lost your second factor. Alternatively, requesting changes over the phone without going through web authentication. My confidence in 2FA dipped quite a bit after going through the experience myself.
entire-name 8y ago
Perhaps so, given that for most DNS provider, the ability to modify DNS records automatically gives you the ability to sign those record. This shows the importance of having a dedicated system for signing information, completely separate (and potentially offline) from the deployment system.
avip 8y ago
There's an astonishing amount of fishy downvoting across this entire thread. That's weird.
- dang 8y ago
  This comment breaks at least two of the HN guidelines. Would you please review and follow them? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html If you think you're seeing abuse, please email us with links (hn@ycombinator.com). That's in the rules too.

None of these domain hijacking attempts would’ve been prevented by DNSSEC, right? (Also kinda curious as to why pointing this out seems to be somewhat controversial? :)

DKnoll 8y ago

Pretty sure you're right. The US-CERT advisory for this campaign implies the attackers were logging into the targets accounts at registrars or DNS providers directly. https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS...

r1ch 8y ago

Not really. In theory the zone signing could be done as a separate process from zone updates, but I don't think any DNS provider implements this - they hold the keys, not you. The other attacks used compromised domain registrar accounts, where the attacker could just disable DNSSEC or switch the nameservers to whatever.

bluejekyll 8y ago

As I understand the attacks being against the login admin accounts for managing the domain itself, no DNSSEC would not have prevented changing the records in the zone. In addition, if the DNS provider hosting that domain automatically resigned the zone for the hacked account, then the hosting company would even have resigned the zone, thus making valid DNSSEC entries anyway. What would be better is to require 2FA for all zone hosting companies.

regecks 8y ago
> What would be better is to require 2FA for all zone hosting companies. Even with this, many registrars and DNS hosts are too fast and loose with disabling 2FA when you call them up and tell them you lost your second factor. Alternatively, requesting changes over the phone without going through web authentication. My confidence in 2FA dipped quite a bit after going through the experience myself.

entire-name 8y ago

Perhaps so, given that for most DNS provider, the ability to modify DNS records automatically gives you the ability to sign those record. This shows the importance of having a dedicated system for signing information, completely separate (and potentially offline) from the deployment system.

avip 8y ago

There's an astonishing amount of fishy downvoting across this entire thread. That's weird.

dang 8y ago
This comment breaks at least two of the HN guidelines. Would you please review and follow them? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html If you think you're seeing abuse, please email us with links (hn@ycombinator.com). That's in the rules too.