7 ms·
I wonder what their motivation is?
by timvisee 6y ago
I wonder what their motivation is?
- jamescun 6y agoSome people just want to watch the world burn.
- unixhero 6y agoThis
- mysterydip 6y ago"no one is buying our expensive SSL certs. If we show businesses how unreliable a free service is, CTOs will make their admins buy from us." or "domain xyz's certificate is expiring. If we pay for a ddos, their site won't be able to renew and (customers wont go to the site due to expired cert/API people use wont work/we can take advantage of a compromised cert longer)" Just some possible but implausible scenarios.
- foepys 6y ago> domain xyz's certificate is expiring That's why it's so important not to wait until the end of the 90 day expiration period but to renew it every other week or so.
- hmaxwell 6y agois that Let's Encrypt's default behavior?
- Symbiote 6y agoThe default is to renew when less than 30 days remain, and to check that every day or every week.
- tutfbhuf 6y agoSeems like a sane default to me.
- philihp 6y agoVery much so. In my experience with nightly jobs in a corporate setting, the more often something happens, the more likely you are to catch an upstream dependency that breaks it. The sooner you catch that breakage, the easier it is to get the resources (either from that team, or from your own team) to fix it. It’s a matter of “Oh we changed that API 2 months ago, everything is fine for us, all of our people have moved on to other tasks” versus “Oh our change broke you? We can revert it until we have a workaround”. 2 months, in most orgs, is enough time to figure something out before your entire business goes offline.
- hftplot 6y agoIt seems unworkable for the majority of smaller sites who are increasingly forced to use letsencrypt. Unless you want that automatic update tool on your server, which I find a bit sketchy.
- abhinav22 6y agoWhy are they forced to use letsencrypt? Cloud flare gives me free SSL and I imagine AWS or GCE would also
- yjftsjthsd-h 6y ago> Unless you want that automatic update tool on your server, which I find a bit sketchy. Where else would you put it? You could put an ACME client somewhere else but it still needs to connect to place the updated certs.
- tialaramex 6y agoNot recommending this, but it is technically possible to proceed as follows: * Server mints an arbitrary key pair, it produces a CSR with the public key in it, signed using the private key, and the administrator manually copies this to an external ACME client. * ACME client uses the CSR and control over DNS to get Let's Encrypt (or any ACME CA) to issue periodically, say, once every 45 days or as soon as possible if that's exceeded. * Server periodically fetches any new certificates for its name from any public source of them. You can build your own server, you can use crt.sh, you can use Google, it doesn't matter because the certificates necessarily contain baked in proof that they're genuine. Notice that in this design the server and ACME client don't talk to each other at all. They both have to be (at least sometimes) connected somehow to the public Internet, but they never need to connect to each other after that one time setup, they don't even need a human to manually transfer stuff, they just both do their thing and it works out. This does mean the key remains the same for the lifetime of the server. But if you have a sane policy for servers getting replaced (e.g. they're depreciated over 36 months and replaced before 48 months) there's no reason that should pose a problem in itself.
- tialaramex 6y agoLet's Encrypt is a Certificate Authority, so, it doesn't have any "default behaviour" in respect of renewals, from the CA's point of view "renewing" is just a new issuance that happens to be for an identical subject. Let's Encrypt's rate limiting policies do actually care about that ("Duplicate Certificate Limit" five per week for each subject) but it can't put in place any particular policy about when you must or will renew. CAs which charge for issuance often have a policy which implies an earliest sensible renewal date, because they will "carry over" remaining time on the previous certificate. There is a practical limit to that, (for example today your "one year" certificate from such a CA can only have up to 398 days until it expires, so renewing two months early won't make sense) because of the Baseline Requirements and/or trust store policies. But if you're doing client development for ACME, the protocol Let's Encrypt implements for issuance, then yes, they'd tell you that they advise you to begin trying to renew with 30 days left. The EFF's Certbot tool, which a long time ago was just named "letsencrypt" implements this policy as do many other stand alone ACME clients.
- tgragnato 6y ago> CTOs will make their admins buy from us Or, those admins can switch to zerossl.com until the DDoS ends (you basically just need to change the domain in certbot). Yielding the DDoS.. wasted money.
- imhoguy 6y agoAren't OCSP servers affected too? That would cause issues for page visitors too.
- josefx 6y agoGiven the complete absence of information could it just be an accident? I think Wikipedia recently had performance issues where it turned out that a popular app was just pulling an image in the background and the app developers fixed it once they were notified.
- scoot 6y agoA distraction from the real intrusion?
- christophilus 6y agoMy thoughts exactly. Hacking letsencrypt would be a massive deal.
- tomxor 6y agoNot sure. Unless this is sustained for a long time it shouldn't affect autorenewals which are done well in advance of expiry. So it _shouldn't_ affect cert expiry unless people are still manually renewing and leaving it to last minute. [edit] Unless the attackers identified a bug in certbot (commonly used autorenewal scripts), e.g what happens when LE is unavailable when autorenew is triggered - you'd hope it would retry periodically until LE is restored, but perhaps not. If not you could time the DDoS just right to ensure a specific cert does not get renewed even after the DDoS stops, then maybe a couple weeks later it would expire... But that's relying on such a bug existing and the site owners not noticing it (LE will also email the registered email address eventually regardless of autorenewal scripts), so maybe this is too much of a stretch.
- tgsovlerkhgsel 6y agoPossibly testing or demonstrating a botnet. "For bragging rights" is a thing, as is advertising ("my botnet took down critical infrastructure, wanna buy my DDoS service?").
- iso1210 6y agoPointing out the issues of a single point of failure for the internet?
- Chilinot 6y agoIs it really a single point of failure though? Certificates are renewed well in advance, and there are several free alternatives with ACME support to LetsEncrypt today. Switching to a new provider in case LetsEncrypt goes down is as simple as updating your scripts.
- deleted 6y ago[deleted]
- gsich 6y agoBuypass, ZeroSSL also provide free certificates with ACME.
- beermonster 6y agoThe keys to the kingdom are ever more being placed in the hands of relatively few internet custodians. Figuratively here of course, since the private keys are generated locally and never transmitted to LE.
- francislavoie 6y agoCaddy mitigates this by falling back to ZeroSSL if it couldn't issue a cert from LE: https://caddyserver.com/docs/automatic-https#errors https://caddyserver.com/docs/automatic-https#errors
- chrisandchris 6y agoFun? Just last week our shared hosting provider was attacked and the attacker tried to brute-force it‘s way into a management API. I cannot image another reason as „fun“ and „just because we can“ because there‘s nothing to get [besides money after encrypting all data]. So I think the attacker just attacks LE because it‘s in the internet and he can.
- stjohnswarts 6y agoIt as a practice run before they try it on a bigger entity
- breakingcups 6y agoThey could be aiming for credentials to use in credential stuffing attack, a place to put malware, a place to distribute malware, servers to add to their botnet, a proxy to use for shady stuff, the list goes on. I see plenty of reasons to attack a hosting provider and its infrastructure? Or am I missing something?
- mirekrusin 6y agoit's better to assume that people will simply do everything that is possible, you can't open umbrella in your butt so that can be assumed not to be done, but everything possible should be assumed done/to be done sonner or later; motivation of "because I can" is simply enough.
- bombcar 6y agoCould be a "test fire" of a paid service - showing it works and will do what the customer wants.
- beermonster 6y agoOften a DDoS is used as a smokescreen/cover for an actual compromise. I guess the hope is that it gets unnoticed in all the noise and whilst all hands are busy at the pumps. Hope not! I see in their status page that OCSP endpoints are also impacted. There could be any number of motivations including interfering with someone's ability to check if a certificate has been revoked.