4 ms·
> While many domains began responding with an S3 404, others began switching from S3 to the parked page. What is interesting is that DNS was not involved — all
by banana_giraffe 5y ago
> While many domains began responding with an S3 404, others began switching from S3 to the parked page. What is interesting is that DNS was not involved — all domains pointed to 93.191.168.52 both before and after the issue.
I don't get this. These domains weren't configured with CNAME DNS entries like one normally does. Does this mean MarkMonitor's parked domain name server was trying to load from S3, then falling back to something else if that failed?
- iancarroll 5y agoI suspect what happened (as the author of the post) is that given the IP address is from Akamai, they misconfigured Akamai to naively proxy the traffic towards S3. S3 will just pick a bucket based on the Host header in the request, and it seems like Akamai just proxied that from the client.
- banana_giraffe 5y agoAhh, sure, that'll do it. That's quite a big oops. I'd love to see the panicked messages on their internal slack as they figure out what they did.
- ectopod 5y agoI guess they have an automatic system to do the same thing as your exploit. After they misconfigured Akamai, their system and your system were racing to claim the exposed S3 buckets.