4 ms·
The attack (I think) would work like this: - You own the domain trust.org pointing to IP address 2.3.4.5. - Someone performs a BGP hijack on 2.3.4.5 and now h
by mindwok 5y ago
The attack (I think) would work like this:
- You own the domain trust.org pointing to IP address 2.3.4.5.
- Someone performs a BGP hijack on 2.3.4.5 and now hosts their own server on 2.3.4.5.
- They then ask Letsencrypt for a certificate to prove they are trust.org. Letsencrypt provides them a token to host on their website to prove they control it.
- Letsencrypt does a DNS lookup, sees trust.org resolves to 2.3.4.5, and performs a http request to that website to check for a token which the hijacker has duly placed on their server at 2.3.4.5.
- Letsencrypt issues a certificate for trust.org, which is now valid and controlled by the hijacker.
None of this requires access to CAs installed on anyones machine, because Letsencrypt is widely trusted and they are the ones issuing the cert.