5 ms·

I assume the mechanism here is to hijack the DNS servers? Does DNSSEC protect against this?

fulafel 5y ago
DNSSEC could be used to protect against it, if TLS cert issuing policies were tightened by folks who mandate the minimum verification requirements for CAs, but this is not currently done. (eg Let's Encrypt supports DNS verification as one mechanism currently, but it also supports plaintext HTTP which is vulnerable to BGP hijack)
throwaway984393 5y ago
E-mail, DNS, and HTTP validation are all vulnerable (so, all the methods besides ACME). As for DNS validation, DNSSEC is opt-in; if one of the 350 different Certificate Authorities doesn't do mandatory stub validation, then the hijack still works on them. There's actually multiple attacks using BGP. You can either hijack the DNS or E-mail server's IP and spoof records, or you can hijack the IP of the target host and spoof an HTTP response. Or you could try all 3 to maximize your chances.
bawolff 5y ago
There are non dns mechanisms as well - you can directly hijack the websites ip address instead of their dns server. In theory i think https://en.m.wikipedia.org/wiki/Resource_Public_Key_Infrastructure https://en.m.wikipedia.org/wiki/Resource_Public_Key_Infrastr... is the thing that's meant to stop this attack if everyone adopted it.
jart 5y ago
Chrome doesn't support DNSSEC sadly. https://bugs.chromium.org/p/chromium/issues/detail?id=50874 https://bugs.chromium.org/p/chromium/issues/detail?id=50874
- astrange 5y ago
  Doesn't seem to matter: https://twitter.com/colmmacc/status/1494047770428149761 https://twitter.com/colmmacc/status/1494047770428149761
  - jart 5y ago
    That's like saying the lock on the front door did not prevent intrusion because the burglar went in through the window.
    - astrange 5y ago
      As tptacek will tell you, there's never any situation where DNSSEC would help. For instance, it doesn't mean your own DNS lookups to 1.1.1.1 are secure, but it does mean Libya is a CA for bit.ly. Although trying to turn it on did take Slack and HBO down in the past, so someone out there cares.
      - jart 5y ago
        Never helps. Causes outages. Route all your DNS through 1.1.1.1 or 8.8.8.8 instead. Sheesh. In Ancient Rome, weren't dictators expected to vacate office once their task had been accomplished and decentralized solutions were ready to once again take hold? Why is it that I always feel the heat whenever I voice words of support for DNSSEC?
        tptacek 5y ago
        Because DNSSEC is a bad protocol that nobody serious uses, with an inexplicably committed cheering section.
      - teddyh 5y ago
        DNSSEC worked mostly fine for Slack, except that their DNS provider, Route 53, initially had a bug where wildcard records on DNSSEC would not get correctly signed. It was when Slack panicked and tried to turn off DNSSEC when they completely bungled it and borked their whole setup.
        tptacek 5y ago
        This is the funniest apology for DNSSEC I've ever read. It's fine, as long as you never try to turn it off! Or use Route53! Don't do that, or your whole site will fall off the Internet for a day. Got it!

DNSSEC could be used to protect against it, if TLS cert issuing policies were tightened by folks who mandate the minimum verification requirements for CAs, but this is not currently done. (eg Let's Encrypt supports DNS verification as one mechanism currently, but it also supports plaintext HTTP which is vulnerable to BGP hijack)

throwaway984393 5y ago

E-mail, DNS, and HTTP validation are all vulnerable (so, all the methods besides ACME). As for DNS validation, DNSSEC is opt-in; if one of the 350 different Certificate Authorities doesn't do mandatory stub validation, then the hijack still works on them. There's actually multiple attacks using BGP. You can either hijack the DNS or E-mail server's IP and spoof records, or you can hijack the IP of the target host and spoof an HTTP response. Or you could try all 3 to maximize your chances.

bawolff 5y ago

There are non dns mechanisms as well - you can directly hijack the websites ip address instead of their dns server. In theory i think https://en.m.wikipedia.org/wiki/Resource_Public_Key_Infrastructure https://en.m.wikipedia.org/wiki/Resource_Public_Key_Infrastr... is the thing that's meant to stop this attack if everyone adopted it.

jart 5y ago

Chrome doesn't support DNSSEC sadly. https://bugs.chromium.org/p/chromium/issues/detail?id=50874 https://bugs.chromium.org/p/chromium/issues/detail?id=50874

astrange 5y ago
Doesn't seem to matter: https://twitter.com/colmmacc/status/1494047770428149761 https://twitter.com/colmmacc/status/1494047770428149761
- jart 5y ago
  That's like saying the lock on the front door did not prevent intrusion because the burglar went in through the window.
  - astrange 5y ago
    As tptacek will tell you, there's never any situation where DNSSEC would help. For instance, it doesn't mean your own DNS lookups to 1.1.1.1 are secure, but it does mean Libya is a CA for bit.ly. Although trying to turn it on did take Slack and HBO down in the past, so someone out there cares.
    - jart 5y ago
      Never helps. Causes outages. Route all your DNS through 1.1.1.1 or 8.8.8.8 instead. Sheesh. In Ancient Rome, weren't dictators expected to vacate office once their task had been accomplished and decentralized solutions were ready to once again take hold? Why is it that I always feel the heat whenever I voice words of support for DNSSEC?
      - tptacek 5y ago
        Because DNSSEC is a bad protocol that nobody serious uses, with an inexplicably committed cheering section.
    - teddyh 5y ago
      DNSSEC worked mostly fine for Slack, except that their DNS provider, Route 53, initially had a bug where wildcard records on DNSSEC would not get correctly signed. It was when Slack panicked and tried to turn off DNSSEC when they completely bungled it and borked their whole setup.
      - tptacek 5y ago
        This is the funniest apology for DNSSEC I've ever read. It's fine, as long as you never try to turn it off! Or use Route53! Don't do that, or your whole site will fall off the Internet for a day. Got it!