3 ms·
Right. There were no DNS changes at all and none were needed to execute the attack. It was IP (at the routing layer) that was subverted; i.e. the IP addresses
by NovemberWhiskey 5y ago
Right. There were no DNS changes at all and none were needed to execute the attack.
It was IP (at the routing layer) that was subverted; i.e. the IP addresses resolved from DNS remained the same but the traffic to them was redirected.
- egberts1 5y agoI now get that the DNS no-change part. Was focused on the latter distinctions between: - incomplete mTLS and lack of DNSSEC implementation (found in all web browsers) - proper two-way mTLS with PKI validation of CA chain whose DNS CAA record is verified as properly protected by DNSSEC. The latter distinction gets your data through a BGP hijack safely from any MitM; former one, not so much.