5 ms·

When I did EPP work at a registry, we did both mutual TLS(mentioned in passing) and strict firewalling. Apologies if I missed it, but were they testing from a

When I did EPP work at a registry, we did both mutual TLS(mentioned in passing) and strict firewalling. Apologies if I missed it, but were they testing from a trusted source, or are some registries that wide open?

mike_d 3y ago
I helped the authors with a little bit of background info on EPP. Some registries are leaving their management systems open to the internet.
- 8organicbits 3y ago
  As a security consultant this boggles my mind. I push companies with much less sensitive systems to use better security practices. It's crazy that these foundational systems lack such controls, but I guess that's due to race to the bottom economic factors?
  - markus_zhang 3y ago
    This is probably the "No one cares about security unless something breaks (and then security team gets blamed)" mindset especially in public areas.
  - cookiengineer 3y ago
    Wait until you find out where CA certificates come from. The answer is: E-Mail and a public salesforce instance.
    - 8organicbits 3y ago
      You're talking about issuing certificates via email? That's a widely documented process, I've used it. SharePoint... I'm not familiar with. I'd love a reference. Certificate issuance doesn't need to be perfect. We have Certificate Transparency, for example to catch missisuance and CAA records to restrict the process.
      - cookiengineer 3y ago
        I talk about the CCADB: [1] https://www.ccadb.org/ https://www.ccadb.org/ [2] https://www.ccadb.org/resources https://www.ccadb.org/resources
        deleted 3y ago
        [deleted]
        8organicbits 3y ago
        Ah, you're not talking about issuance. I think you're implying that the browsers blindly copy their trust roots from the linked Salesforce site, and you don't think Salesforce provides suitable tampering protection. I'm not shocked? The website discusses audit responsibilities quite a bit, which seems like it mitigates tampering concerns. Sure I'd prefer something other than Salesforce too, but I'm not seeing a glaring issue here.
    - taskforcegemini 3y ago
      can you elaborate on that? Certificates are usually public anyway, but the matching private keys aren't. CAs usually have them on hsm-devices only. if you mean private keys are shared via email: keys from the CA-Certs, or just from the Certificates the CA signed? for instance, getting a CA publicly into a browser is expensive and requires audits, so your experience makes me curious
  - mike_d 3y ago
    Most of these are small ccTLDs with minimal management. For most countries they just kind of got assigned a TLD and some random person in the telecommunications department of the government, the postal office, or a university has been keeping it going for years. I recently tried reporting a security issue to a ccTLD. As a registrar thankfully I was able to reach out to ICANN for assistance, but even then the person who operated the TLD had just retired and there was no replacement.
_notreallyme_ 3y ago
Note that the command they use, poll, requires to login first, which means they also had some valid credentials somehow. In addition, they seemed to have access to the source code, whereas the opensource version hasn't been updated in more than 8 years. Maybe this is the result of a whitebox security audit?
- elp 3y ago
  Login is itself an XML command so in theory that could also be hacked. Like @silisili said most of the registry operators require client certs and ips to go with the usernames but it is very possible that they are only checking that after getting a login. CoCCA run by the tiny zones with no budgets. They are likely to be VERY vulnerable to this.
belorn 3y ago
Firewalling is a good practice and hopefully provide some traceability if servers at a registrar would start to attack the epp servers. It should however not the be only defense as that would make the system vulnerable to the least secure registrar that is approved by the registry. Becoming a registrar is also in many cases not that hard.

mike_d 3y ago

I helped the authors with a little bit of background info on EPP. Some registries are leaving their management systems open to the internet.

8organicbits 3y ago
As a security consultant this boggles my mind. I push companies with much less sensitive systems to use better security practices. It's crazy that these foundational systems lack such controls, but I guess that's due to race to the bottom economic factors?
- markus_zhang 3y ago
  This is probably the "No one cares about security unless something breaks (and then security team gets blamed)" mindset especially in public areas.
- cookiengineer 3y ago
  Wait until you find out where CA certificates come from. The answer is: E-Mail and a public salesforce instance.
  - 8organicbits 3y ago
    You're talking about issuing certificates via email? That's a widely documented process, I've used it. SharePoint... I'm not familiar with. I'd love a reference. Certificate issuance doesn't need to be perfect. We have Certificate Transparency, for example to catch missisuance and CAA records to restrict the process.
    - cookiengineer 3y ago
      I talk about the CCADB: [1] https://www.ccadb.org/ https://www.ccadb.org/ [2] https://www.ccadb.org/resources https://www.ccadb.org/resources
      - deleted 3y ago
        [deleted]
      - 8organicbits 3y ago
        Ah, you're not talking about issuance. I think you're implying that the browsers blindly copy their trust roots from the linked Salesforce site, and you don't think Salesforce provides suitable tampering protection. I'm not shocked? The website discusses audit responsibilities quite a bit, which seems like it mitigates tampering concerns. Sure I'd prefer something other than Salesforce too, but I'm not seeing a glaring issue here.
  - taskforcegemini 3y ago
    can you elaborate on that? Certificates are usually public anyway, but the matching private keys aren't. CAs usually have them on hsm-devices only. if you mean private keys are shared via email: keys from the CA-Certs, or just from the Certificates the CA signed? for instance, getting a CA publicly into a browser is expensive and requires audits, so your experience makes me curious
- mike_d 3y ago
  Most of these are small ccTLDs with minimal management. For most countries they just kind of got assigned a TLD and some random person in the telecommunications department of the government, the postal office, or a university has been keeping it going for years. I recently tried reporting a security issue to a ccTLD. As a registrar thankfully I was able to reach out to ICANN for assistance, but even then the person who operated the TLD had just retired and there was no replacement.

_notreallyme_ 3y ago

Note that the command they use, poll, requires to login first, which means they also had some valid credentials somehow. In addition, they seemed to have access to the source code, whereas the opensource version hasn't been updated in more than 8 years. Maybe this is the result of a whitebox security audit?

elp 3y ago
Login is itself an XML command so in theory that could also be hacked. Like @silisili said most of the registry operators require client certs and ips to go with the usernames but it is very possible that they are only checking that after getting a login. CoCCA run by the tiny zones with no budgets. They are likely to be VERY vulnerable to this.

belorn 3y ago

Firewalling is a good practice and hopefully provide some traceability if servers at a registrar would start to attack the epp servers. It should however not the be only defense as that would make the system vulnerable to the least secure registrar that is approved by the registry. Becoming a registrar is also in many cases not that hard.