6 ms·

I really do wonder why this issue is not given more light. You can potentially BGP hijack a domain (via DNS) and e-mail (via SMTP) as a private individual so e

I really do wonder why this issue is not given more light. You can potentially BGP hijack a domain (via DNS) and e-mail (via SMTP) as a private individual so easily. Image a nation-state. These protocols only have bandaids like DNSSEC and RPKI stopping you from doing it, which both have painfully small adoption and don't realistically stop a determined attacker. This could happen at anytime by an individual with the motivation, and it only needs to be successful for a few minutes to gain access to a huge amount of private data. This has to be a huge national security risk, right? Why do we not take it seriously?

biglost 6y ago
Where i live you can use an email as a proof of anything at court
- hansel_der 6y ago
  so can a fax, but bureaucratic shortsightedness is not a good proof of anything.
EGreg 6y ago
How do you do these attacks exactly??
bawolff 6y ago
> You can potentially BGP hijack a domain (via DNS) and e-mail (via SMTP) as a private individual so easily. No you can't. Well various attacks exist against ip routing, dns, email forging etc,in practice they are really hard to pull off as an individual who isn't in a privileged network position (with possible exception of email forging. That one is a bit easier depending on stuff) > You can potentially BGP hijack a domain (via DNS) I think you might be confusing stuff here. Unless you bgp hijack the nameserver, but if you have that ability, why not go after the site directly?
- deleted 6y ago
  [deleted]
- ryanlol 6y ago
  > No you can't. Yes you can > they are really hard to pull off as an individual who isn't in a privileged network position “privileged network position”, as in someone with a couple of thousand dollars to spend.
- iscoelho 6y ago
  If you've worked in the industry, you know you can get a BGP uplink these days with bare minimum IRR source validation with only a signature on a contract (not even payment is required to turn up generally). Using this, you can advertise any IP prefix you want. Since a lot of providers advertise /23+ as well, if you hijack the /24, you will always be the BGP best path and will be able to accomplish a full internet-wide hijack. Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible. If you are a nation-state, you already have all of the above, and nobody to hold you accountable for using it.
  - ryanlol 6y ago
    > Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible. Few weeks? With most providers you can get this done within 24h from the initial email to sales@
    - iscoelho 6y ago
      Getting the colocation, hardware, BGP uplink, and the creativity involved in not using your identity at all & minimizing (or eliminating) expenses. Possible, but it'll take a few weeks.
      - ryanlol 6y ago
        You don’t need any of those things, you can just rent a dedicated server (perhaps even a VPS) and send over a LoA and have the host route the IPs to your box. I’ve never had to deal with colo or think about hardware to have my IPs announce.
elktea 6y ago
> You can potentially BGP hijack a domain (via DNS) domains and BGP don't really interact, can you explain what you mean?
- baybal2 6y ago
  I guess he meant the ip address
- tialaramex 6y ago
  I imagine what they're getting at is, you do a BGP hijack so that you get all the DNS queries about domain.example. So when a resolver asks about something.domain.example it gets told to ask servers authoritative for domain.example and it is given the IP addresses for some of those servers, but a BGP hijack could (if successful) allow you to answer for those IP addresses instead. At this point you can give any answers you like for such queries. If the domain has DNSSEC, you either have to choose answers you've seen that may be misleading (e.g. old but still not expired answers) or some resolvers might notice your answers are bogus. Many domains today don't have DNSSEC, so, you could give any answer and it will be indistinguishable from an answer by the legitimate authoritative DNS servers. Nobody would know any different. Now that you can cause traffic to go wherever you want, you can easily satisfy most of the Ten Blessed Methods and get yourself certificates in the Web PKI ("SSL Certificates") or whatever else you needed to achieve. In the distant future sometimes it may be possible that a recursive is able to assure itself that the answer is genuine via DPRIVE [DNS over HTTPS, or TLS, or QUIC or whatever else is invented] instead but in practice most of the routes by which we could get genuine answers ultimately rely on DNSSEC (DPRIVE is still doing something useful for you - privacy benefits, particularly oblivious transfer could mean you get trustworthy answers with a promise that your honest broker doesn't know what you asked, and the authoritative servers know what was asked but not who asked it)
baybal2 6y ago
> These protocols only have bandaids like DNSSEC and RPKI stopping you from doing it The lion share of mailers don't check even them.
ryanlol 6y ago
Just wait till the people freaking out about BGP find out what you can accomplish with a fake court order!

biglost 6y ago

Where i live you can use an email as a proof of anything at court

hansel_der 6y ago
so can a fax, but bureaucratic shortsightedness is not a good proof of anything.

EGreg 6y ago

How do you do these attacks exactly??

bawolff 6y ago

> You can potentially BGP hijack a domain (via DNS) and e-mail (via SMTP) as a private individual so easily. No you can't. Well various attacks exist against ip routing, dns, email forging etc,in practice they are really hard to pull off as an individual who isn't in a privileged network position (with possible exception of email forging. That one is a bit easier depending on stuff) > You can potentially BGP hijack a domain (via DNS) I think you might be confusing stuff here. Unless you bgp hijack the nameserver, but if you have that ability, why not go after the site directly?

deleted 6y ago
[deleted]
ryanlol 6y ago
> No you can't. Yes you can > they are really hard to pull off as an individual who isn't in a privileged network position “privileged network position”, as in someone with a couple of thousand dollars to spend.
iscoelho 6y ago
If you've worked in the industry, you know you can get a BGP uplink these days with bare minimum IRR source validation with only a signature on a contract (not even payment is required to turn up generally). Using this, you can advertise any IP prefix you want. Since a lot of providers advertise /23+ as well, if you hijack the /24, you will always be the BGP best path and will be able to accomplish a full internet-wide hijack. Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible. If you are a nation-state, you already have all of the above, and nobody to hold you accountable for using it.
- ryanlol 6y ago
  > Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible. Few weeks? With most providers you can get this done within 24h from the initial email to sales@
  - iscoelho 6y ago
    Getting the colocation, hardware, BGP uplink, and the creativity involved in not using your identity at all & minimizing (or eliminating) expenses. Possible, but it'll take a few weeks.
    - ryanlol 6y ago
      You don’t need any of those things, you can just rent a dedicated server (perhaps even a VPS) and send over a LoA and have the host route the IPs to your box. I’ve never had to deal with colo or think about hardware to have my IPs announce.

elktea 6y ago

> You can potentially BGP hijack a domain (via DNS) domains and BGP don't really interact, can you explain what you mean?

baybal2 6y ago
I guess he meant the ip address
tialaramex 6y ago
I imagine what they're getting at is, you do a BGP hijack so that you get all the DNS queries about domain.example. So when a resolver asks about something.domain.example it gets told to ask servers authoritative for domain.example and it is given the IP addresses for some of those servers, but a BGP hijack could (if successful) allow you to answer for those IP addresses instead. At this point you can give any answers you like for such queries. If the domain has DNSSEC, you either have to choose answers you've seen that may be misleading (e.g. old but still not expired answers) or some resolvers might notice your answers are bogus. Many domains today don't have DNSSEC, so, you could give any answer and it will be indistinguishable from an answer by the legitimate authoritative DNS servers. Nobody would know any different. Now that you can cause traffic to go wherever you want, you can easily satisfy most of the Ten Blessed Methods and get yourself certificates in the Web PKI ("SSL Certificates") or whatever else you needed to achieve. In the distant future sometimes it may be possible that a recursive is able to assure itself that the answer is genuine via DPRIVE [DNS over HTTPS, or TLS, or QUIC or whatever else is invented] instead but in practice most of the routes by which we could get genuine answers ultimately rely on DNSSEC (DPRIVE is still doing something useful for you - privacy benefits, particularly oblivious transfer could mean you get trustworthy answers with a promise that your honest broker doesn't know what you asked, and the authoritative servers know what was asked but not who asked it)

baybal2 6y ago

> These protocols only have bandaids like DNSSEC and RPKI stopping you from doing it The lion share of mailers don't check even them.

ryanlol 6y ago

Just wait till the people freaking out about BGP find out what you can accomplish with a fake court order!