4 ms·

I'm trying to figure out how this could have happened, but I control so few IP addresses that many of my DNS entries are manually assigned. And you'd have to be

I'm trying to figure out how this could have happened, but I control so few IP addresses that many of my DNS entries are manually assigned. And you'd have to be incompetent if you have access to set DNS records and you set them to RFC 1918 addresses. Anyone have any theories on how this could happen?

efortis 3y ago
* Copy/Paste * Copilot told me * Sabotage (internal or external)
- quickthrower2 3y ago
  Or hard to reason about IaC
- fomine3 3y ago
  my wild idea: counterattack for DDoS
  - efortis 3y ago
    [flagged]
deleted 3y ago
[deleted]
milkshakes 3y ago
about ten years ago, apple added a stray record to the apple.com zone .... a DNAME[1] record ....... that pointed to apple.com 1: https://en.wikipedia.org/wiki/DNAME_record https://en.wikipedia.org/wiki/DNAME_record this had some pretty disastrous results[2] 2: https://mashable.com/archive/apple-tunes-app-store-icloud-problems https://mashable.com/archive/apple-tunes-app-store-icloud-pr... bad things happen everywhere
- ericpauley 3y ago
  It continually astounds me that DNAME got standardized. Scary stuff.
whynotmaybe 3y ago
I'll go with Joseph Conrad on this one. "It's only those who do nothing that make no mistakes, I suppose." Now the persons that did it have some proof that they did something. They will surely put some check in place because there should be another adage somewhere that says that you only learn to use the handrails after you fell in the stairs.
- fsckboy 3y ago
  erro ergo sum
colechristensen 3y ago
Certainly just some automation bug, perhaps a few things strung together, like a dev environment setup that leaked into production. A human in the loop making a mistake probably as well. This is the kind of thing you look at and put up a few guardrails to prevent it happening again.
keypusher 3y ago
My guess is that someone at MS was testing Windows Updates or other changes from a local source. They also had some other DNS updates in their config they were testing. They took all of their config and pushed it out, when they should only have taken the other changes.
- fsckboy 3y ago
  I hope that's not their workflow, but few people I've ever worked with have know how to create operating procedures that had half a chance of succeeding, usually it's based on "oh, don't worry, i would never do that"
bruce511 3y ago
>> And you'd have to be incompetent if you have access to set DNS records and you set them to RFC 1918 addresses. Clearly the following is not in play for a root domain (Microsoft.com) but assigning a DNS entry to a class C address does have a purpose. If you have an intranet server, giving it a DNS name allows for HTTPS serving, with an automatic, CA signed, certificate. (Using say LE with DNS challenge.) I provide this simply as an example of how this might come about.

efortis 3y ago

* Copy/Paste * Copilot told me * Sabotage (internal or external)

quickthrower2 3y ago
Or hard to reason about IaC
fomine3 3y ago
my wild idea: counterattack for DDoS
- efortis 3y ago
  [flagged]

deleted 3y ago

[deleted]

milkshakes 3y ago

about ten years ago, apple added a stray record to the apple.com zone .... a DNAME[1] record ....... that pointed to apple.com 1: https://en.wikipedia.org/wiki/DNAME_record https://en.wikipedia.org/wiki/DNAME_record this had some pretty disastrous results[2] 2: https://mashable.com/archive/apple-tunes-app-store-icloud-problems https://mashable.com/archive/apple-tunes-app-store-icloud-pr... bad things happen everywhere

ericpauley 3y ago
It continually astounds me that DNAME got standardized. Scary stuff.

whynotmaybe 3y ago

I'll go with Joseph Conrad on this one. "It's only those who do nothing that make no mistakes, I suppose." Now the persons that did it have some proof that they did something. They will surely put some check in place because there should be another adage somewhere that says that you only learn to use the handrails after you fell in the stairs.

fsckboy 3y ago
erro ergo sum

colechristensen 3y ago

Certainly just some automation bug, perhaps a few things strung together, like a dev environment setup that leaked into production. A human in the loop making a mistake probably as well. This is the kind of thing you look at and put up a few guardrails to prevent it happening again.

keypusher 3y ago

My guess is that someone at MS was testing Windows Updates or other changes from a local source. They also had some other DNS updates in their config they were testing. They took all of their config and pushed it out, when they should only have taken the other changes.

fsckboy 3y ago
I hope that's not their workflow, but few people I've ever worked with have know how to create operating procedures that had half a chance of succeeding, usually it's based on "oh, don't worry, i would never do that"

bruce511 3y ago

>> And you'd have to be incompetent if you have access to set DNS records and you set them to RFC 1918 addresses. Clearly the following is not in play for a root domain (Microsoft.com) but assigning a DNS entry to a class C address does have a purpose. If you have an intranet server, giving it a DNS name allows for HTTPS serving, with an automatic, CA signed, certificate. (Using say LE with DNS challenge.) I provide this simply as an example of how this might come about.