4 ms·
And ultimately they still own the domains and can always point them to a new IP address at any time. The window for exploitation seems kind of small and tempor
by fouc 5y ago
And ultimately they still own the domains and can always point them to a new IP address at any time. The window for exploitation seems kind of small and temporary.
- IncRnd 5y ago> The window for exploitation seems kind of small and temporary. That depends on whether you are attacking the clients or the server. If an attacker obtained a domain cert or wildcard cert, while in control of the domain, then the attacks can continue.
- TedDoesntTalk 5y agoHow? They now have a cert for that domain but the domain owner can point the domain to any IP address he wants. The article mentions this, but I don’t see the vuln. Can you explain?
- manigandham 5y agoDNS is very easy to spoof and redirect. There are proposals to secure it (DNSSEC, DNS-over-TLS, DNS-over-HTTPS) but none are widely used and instead the server's certificates are used to both authenticate the correct destination and encrypt traffic to it. Redirecting traffic is much easier than generating certificates so a valid cert held by a bad actor can be a serious vulnerability.
- FDSGSG 5y ago>Redirecting traffic is much easier than generating certificates so a valid cert held by a bad actor can be a serious vulnerability. This is bullshit. If you can redirect traffic you can almost always create a certificate unless you can only redirect a very limited set of traffic. Redirecting traffic is literally all you need in order to be able to use certbot to generate a new cert.
- GranPC 5y agoMITM
- ipaddr 5y agoI think we are going to need a little bit more. How does the attacker get traffic to route to them?
- lmm 5y agoDNS is not (yet) generally secured. An attacker who e.g. controls a wifi AP can just substituted their own DNS responses and redirect users to their own addresses, and their servers have valid certificates for the domains that they're supposed to be, so from the user side everything looks fine.
- IncRnd 5y agoYes. When the attacker can interpose their own server on the network, seen by valid clients, then the attacker can redirect the DNS of those clients to the fake server. This is a MiTM attack that allows the fake server to be accepted by valid clients (on that network), stealing their credentials and then potentially their information from the server. There are actually many attacks that can happen here, one of which is simply to record the credentials, while passing the traffic through to the server and back from the server to the clients. Even though the true DNS server has had its DNS record's IP address changed to point towards the correct and true server, the clients are unaware of this change, as their DNS caches have been poisoned to point towards the malicious server. PS There is a defense against this, certificate pinning, but that is not used much in practice.
- FDSGSG 5y agoIt's a bit silly, there's no meaningful defense defeated here. Since the BGP routing system is almost entirely trust based a determined attacker will be able to perform a MITM attack on your domain and get a domain validated TLS certificate issued. There's no real defense against this, TLS only stops dragnet attackers.
- selcuka 5y agoOnly if they notice it among 60K+ domain names. There might be an automated system that silently proceeds to the next domain if the bucket has already been claimed.
- silisili 5y agoAgreed. The title is misleading...there were no domains 'taken', which would imply a change of ownership, especially in the context of a registrar.
- staticassertion 5y ago'for the taking', ie: they were vulnerable to a domain takeover. The title is entirely accurate. They didn't say they were 'taken'.
- silisili 5y agoGood point, I can see that perspective. I guess I should have used 'ambiguous' instead of misleading. My first thought, with current wording, is that they were allowing transfers out or letting domains expire. Perhaps I spent too much time in the registry business.
- flemhans 5y agoI also understood it as if they lost the domains.
- ctvo 5y agoA lot of windows are small and temporary. In this case the attacker could have served anything out of the S3 bucket and conducted full blown phishing (google.ar, coinbase.ca), and generated valid certificates. It's a big deal the order of operations here and the risk MarkMonitor introduced to all their clients.