5 ms·
Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minute
by kotaKat 3y ago
Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minutes TTL ;)
- workfromspace 3y agoDo we need to restart our Windows machines? :)
- awill 3y agothat's the solution to all Windows problems, so yes :)
- Krutonium 3y agoGG, Gone for me now.
- rubyfan 3y agoThis is my favorite HN comment of 2023.
- jgoodknight 3y agoThis is my second favorite HN comment of 2023
- rand1239 3y agoHN is a wormhole through which you can connect pretty much anyone in tech industry.
- jaza 3y ago30 minutes minutes or 30 Windows minutes? :P
- rasengan 3y agoThis isn’t something that I think should be diluted. If it’s that simple for a stray record to be included in the dns round robin it could have been bad if it was an external ip with a machine setup by a phisherman especially since control of a domain is all you need to get an ssl cert now. Couple this with the fact that it’s Microsoft, one of the most relied on companies in our computer world, this is pretty darn horrible.
- statictype 3y agoFor all this to work you need to control the domain. Is that easier than simply breaking into their systems and owning their servers?
- water9 3y agoSometimes it’s easier to bribe then to break
- Cpoll 3y agoThat's exactly what they're saying. > it could have been bad if it was an external ip with a machine setup by a phisherman I.e. one of the IPs for microsoft.com belongs to $phisher, which means they control (a subset of the traffic going to) the domain. They can't add CNAME records for certificate validation, but LetsEncrypt for example offers HTTP-based validation. Not sure how Microsoft sets up their certificate pinning, it might not be quite that easy.
- rasengan 3y agoIt might also be a highly targeted attack on someone with precious information wherein someone was able to hack a simple router and in order to get access to their actual microsoft.com account, they simply setup a phisherman's clone on the router and captured the login/password/2fa and got into the account.
- notakio 3y agoFor the Microsoft.com domain, proper, there seem to be no existing CAA rules, allowing each and every CA on earth to issue certificates based on whatever criteria the CA requires. What could possibly go wrong with that approach?
- stkai 3y agoI see them both. My TTL will run out at 16:39 PST, though.
- petee 3y agoTTL appears to be set to an hour. But either way, its been 45 min and the primary ns1-39.azure-dns.com is still offering up 0.1
- zenexer 3y ago192.168.1.1 is gone now, but all authoritative nameservers are still offering 192.168.1.0. Oops.
- adolph 3y agoA few are dropping 192.168.1.0 now: as of 1703035296: ns1-39.azure-dns.com no longer has 192.168.1.0 for microsoft.com 1.1.1.1 still has 192.168.1.0 for microsoft.com 8.8.8.8 still has 192.168.1.0 for microsoft.com 76.76.2.0 no longer has 192.168.1.0 for microsoft.com 9.9.9.9 still has 192.168.1.0 for microsoft.com 208.67.222.222 still has 192.168.1.0 for microsoft.com 185.228.168.9 still has 192.168.1.0 for microsoft.com 76.76.19.19 still has 192.168.1.0 for microsoft.com 94.140.14.14 still has 192.168.1.0 for microsoft.com
- zenexer 3y agoOnly one of those is authoritative. All of the authoritative servers have dropped it. Microsoft has fixed the issue.
- awill 3y agoYea, sure, but that's like saying "company X stopped selling poison, it's Shop Y's fault that they're still selling it". Nope. This is still Microsoft's fault while non-auth servers update.
- zenexer 3y agoFirst we wanted to see Microsoft update the authoritative nameservers, then move on to monitoring propagation. Conflating the two makes it difficult to monitor whether Microsoft actually fixed it correctly this time, as they appear to have screwed up their first attempt. I wasn't attempting to address blame since I figured that was obvious enough.
- dboreham 3y agoFew months early April 1 stunt?
- Geezus_42 3y agoI know myself through a series of connections as well. ;) ;)