6 ms·

Hacking root EPP servers to take control of zones

159 points by iancarroll 3y ago

gittiam 3y ago
I've read through this article several times, and I am failing to see how this could possibly be used to form an attack. Sure - taking the provider down is bad - but that happens due to unscheduled downtime every other day?
- a5withtrrs 3y ago
  From the article: >> Speaking with Vince (the administrator of the .ai zone) over WhatsApp, we confirmed that compromising this server would give us full control over any .ai domain: >> Once administrative access is gained to the CoCCA application, it is possible to control the nameservers for every domain for that ccTLD. The point is to control domains in a ccTLD. Arbitrary domain hijacking is bad...
- opello 3y ago
  The screenshot of the WhatsApp conversation says they'd need admin on the web application. I agree it wasn't clear if they'd gotten that. Looks like it was via the backup files: https://news.ycombinator.com/item?id=36305699 https://news.ycombinator.com/item?id=36305699
- archgoon 3y ago
  [dead]
a5withtrrs 3y ago
This is huge! You could control entire ccTLDs?
- infosecau 3y ago
  Yes, as we were able to download the database for CoCCA's web application (from the box.com backups) for any of the ccTLDs managed by CoCCA, we could decrypt the admin hash and then login to the CoCCA administration panel and modify/transfer any domain inside a ccTLD's zone.
  - qingcharles 3y ago
    The scale of possibilities with this hack are enormous. You could easily redirect entire domains, generate valid SSL certs for those domains, then capture all the data including all login credentials for all users on those domains. With exploitation of the right domains you would probably be able to extend this hack using stolen authentication information to take over basically the entire Internet. Funny hack of my own once: a major web hosting company had a forum which failed to check uploaded profile pics were images, so I used it to upload a script so I could browse their entire filesystem. I eventually came across their root password stored in plaintext in a configuration file. The password? "internet" - all lowercase, just like that.
    - markus_zhang 3y ago
      I kinda think these vulnerabilities were long exploited but no one made the move to actually make any harm is because 1) not profitable for private parties 2) state actors are waiting for a proper time to execute
  - yolo3000 3y ago
    Out of curiosity, at what point is this considered hacking? Aren't you afraid of getting into trouble with the law by accessing servers like this, downloading data, etc?
  - CydeWeys 3y ago
    > We spent a significant amount of time on Google's registry software and discovered an endpoint that we believe are not supposed to be accessed without authentication Can you send me info on this to mcilwain@google.com ? Thanks.
silisili 3y ago
When I did EPP work at a registry, we did both mutual TLS(mentioned in passing) and strict firewalling. Apologies if I missed it, but were they testing from a trusted source, or are some registries that wide open?
- mike_d 3y ago
  I helped the authors with a little bit of background info on EPP. Some registries are leaving their management systems open to the internet.
  - 8organicbits 3y ago
    As a security consultant this boggles my mind. I push companies with much less sensitive systems to use better security practices. It's crazy that these foundational systems lack such controls, but I guess that's due to race to the bottom economic factors?
    - markus_zhang 3y ago
      This is probably the "No one cares about security unless something breaks (and then security team gets blamed)" mindset especially in public areas.
    - cookiengineer 3y ago
      Wait until you find out where CA certificates come from. The answer is: E-Mail and a public salesforce instance.
      - 8organicbits 3y ago
        You're talking about issuing certificates via email? That's a widely documented process, I've used it. SharePoint... I'm not familiar with. I'd love a reference. Certificate issuance doesn't need to be perfect. We have Certificate Transparency, for example to catch missisuance and CAA records to restrict the process.
captn3m0 3y ago
This feels like it should be submitted to https://www.hackerone.com/internet-bug-bounty https://www.hackerone.com/internet-bug-bounty.
TechBro8615 3y ago
This was a fun writeup and I liked the continued references to the theme of the brittle internet. In particular, I found this amusing: > We discovered that one of the maintainers of the .AI registry is a person named Vince. I wonder if Vince lives in Nebraska: https://xkcd.com/2347/ https://xkcd.com/2347/
- greyface- 3y ago
  Vince lives in Anguilla: https://en.wikipedia.org/wiki/Vince_Cate https://en.wikipedia.org/wiki/Vince_Cate
robalfonso 3y ago
This is interesting, however the vast majority of registries require connecting from a known ip, using a specific cert chain and in some instances their own ca. Turns out when you don’t follow industry practices in one way you don’t do much else right either

159 points by iancarroll 3y ago

I've read through this article several times, and I am failing to see how this could possibly be used to form an attack. Sure - taking the provider down is bad - but that happens due to unscheduled downtime every other day?

a5withtrrs 3y ago
From the article: >> Speaking with Vince (the administrator of the .ai zone) over WhatsApp, we confirmed that compromising this server would give us full control over any .ai domain: >> Once administrative access is gained to the CoCCA application, it is possible to control the nameservers for every domain for that ccTLD. The point is to control domains in a ccTLD. Arbitrary domain hijacking is bad...
opello 3y ago
The screenshot of the WhatsApp conversation says they'd need admin on the web application. I agree it wasn't clear if they'd gotten that. Looks like it was via the backup files: https://news.ycombinator.com/item?id=36305699 https://news.ycombinator.com/item?id=36305699
archgoon 3y ago
[dead]

a5withtrrs 3y ago

This is huge! You could control entire ccTLDs?

infosecau 3y ago
Yes, as we were able to download the database for CoCCA's web application (from the box.com backups) for any of the ccTLDs managed by CoCCA, we could decrypt the admin hash and then login to the CoCCA administration panel and modify/transfer any domain inside a ccTLD's zone.
- qingcharles 3y ago
  The scale of possibilities with this hack are enormous. You could easily redirect entire domains, generate valid SSL certs for those domains, then capture all the data including all login credentials for all users on those domains. With exploitation of the right domains you would probably be able to extend this hack using stolen authentication information to take over basically the entire Internet. Funny hack of my own once: a major web hosting company had a forum which failed to check uploaded profile pics were images, so I used it to upload a script so I could browse their entire filesystem. I eventually came across their root password stored in plaintext in a configuration file. The password? "internet" - all lowercase, just like that.
  - markus_zhang 3y ago
    I kinda think these vulnerabilities were long exploited but no one made the move to actually make any harm is because 1) not profitable for private parties 2) state actors are waiting for a proper time to execute
- yolo3000 3y ago
  Out of curiosity, at what point is this considered hacking? Aren't you afraid of getting into trouble with the law by accessing servers like this, downloading data, etc?
- CydeWeys 3y ago
  > We spent a significant amount of time on Google's registry software and discovered an endpoint that we believe are not supposed to be accessed without authentication Can you send me info on this to mcilwain@google.com ? Thanks.

silisili 3y ago

When I did EPP work at a registry, we did both mutual TLS(mentioned in passing) and strict firewalling. Apologies if I missed it, but were they testing from a trusted source, or are some registries that wide open?

mike_d 3y ago
I helped the authors with a little bit of background info on EPP. Some registries are leaving their management systems open to the internet.
- 8organicbits 3y ago
  As a security consultant this boggles my mind. I push companies with much less sensitive systems to use better security practices. It's crazy that these foundational systems lack such controls, but I guess that's due to race to the bottom economic factors?
  - markus_zhang 3y ago
    This is probably the "No one cares about security unless something breaks (and then security team gets blamed)" mindset especially in public areas.
  - cookiengineer 3y ago
    Wait until you find out where CA certificates come from. The answer is: E-Mail and a public salesforce instance.
    - 8organicbits 3y ago
      You're talking about issuing certificates via email? That's a widely documented process, I've used it. SharePoint... I'm not familiar with. I'd love a reference. Certificate issuance doesn't need to be perfect. We have Certificate Transparency, for example to catch missisuance and CAA records to restrict the process.

captn3m0 3y ago

This feels like it should be submitted to https://www.hackerone.com/internet-bug-bounty https://www.hackerone.com/internet-bug-bounty.

TechBro8615 3y ago

This was a fun writeup and I liked the continued references to the theme of the brittle internet. In particular, I found this amusing: > We discovered that one of the maintainers of the .AI registry is a person named Vince. I wonder if Vince lives in Nebraska: https://xkcd.com/2347/ https://xkcd.com/2347/

greyface- 3y ago
Vince lives in Anguilla: https://en.wikipedia.org/wiki/Vince_Cate https://en.wikipedia.org/wiki/Vince_Cate

robalfonso 3y ago

This is interesting, however the vast majority of registries require connecting from a known ip, using a specific cert chain and in some instances their own ca. Turns out when you don’t follow industry practices in one way you don’t do much else right either