4 ms·
No. Routing attacks divert traffic on the IP address level to another destination. It does not matter if you protect the DNS so it resolves to the correct IP ad
by okket 7y ago
No. Routing attacks divert traffic on the IP address level to another destination. It does not matter if you protect the DNS so it resolves to the correct IP address.
- andrewjf 7y agoIt mitigates it in the sense that the attacker presumably wont have the TLS identity required for the client to trust it. The client won't be able to resolve anything, but it can't be used to send the client to other places, turning it into a denial of service
- megous 7y agoThey can try getting a new DV cert for the domain. It may or may not work depending on how thoroughly the CA checks the domain resolution from multiple places.
- theWheez 7y agoIf I understand this correctly, does this mean that this is not a weakness in Quad101, but the internet infrastructure itself?
- vlan0 7y ago>but the internet infrastructure itself? Kind of. The Internet is similar to a chain link fence. Every link in the chain needs to perform its role as expected, otherwise shit breaks. In the case of the Internet, there are many ISPs that are leak links in the chain.
- okket 7y agoYes. On the routing level. The attacker literally announces 'This IP address network is mine now' via BGP and gets the traffic. Most such incidents are not real attacks though, but misconfigurations. And there are the MANRS recommendations, which can prevent a lot of problems, including the one described in the article.
- amarshall 7y agoWell, it protects against the DNS server itself being redirected. But it doesn’t do anything for IPs that were in the DNS answer being redirected.