3 ms·
You're probably correct in your assessment, but it does still happen. https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7
by AndyMcConachie 3y ago
You're probably correct in your assessment, but it does still happen.
https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600#d138 https://medium.com/s2wblog/post-mortem-of-klayswap-incident-...
https://petsymposium.org/2017/papers/hotpets/bgp-bogus-tls.pdf https://petsymposium.org/2017/papers/hotpets/bgp-bogus-tls.p...
- tptacek 3y agoI think it's quite telling that the examples here all involve BGP subversion, which DNSSEC doesn't coherently mitigate: universal DNSSEC deployment would change the exploit you'd deploy to exploit BGP, but it wouldn't break the vulnerability.
- nightpool 3y agoOut of curiosity—how does DNSSEC fail to address this specific vulnerability? Wouldn't it make it impossible to get an HTTPS/DNS record response for this zone, taking it from a "fail dangerous" MITM attack that could violate confidentiality to a simple "fail safe" DOS attack that only harms availability?