4 ms·
You’re likely severely underestimating the amount of internal paperwork and review that is required to launch a new google.com subdomain.
by sophiebits 2y ago
You’re likely severely underestimating the amount of internal paperwork and review that is required to launch a new google.com subdomain.
- isodev 2y agoMaybe they don't need a new subdomain, something unused could do the trick.
- riccardomc 2y agoProbably a 'something.google.com'... But you could have teams with DNS zone delegation who can.create.anything.like.this.google.com
- drpossum 2y agoI did one on my local network and didn't fill out anything
- block_dagger 2y agoBut only you have access to your local network.
- therein 2y agoThat's not necessarily true.
- drpossum 2y agoGood thing all networks everyone connects to are always known by that user to be secure
- bqmjjx0kac 2y agoDo these APIs not require https?
- drpossum 2y agoThe case here was just injecting a domain. There's another thread for this post pointing out you would also need to inject a malicious root cert for https traffic, which is correct, but not impossible (and given some bad/lazy practices I've seen places do when they sign their own certs for internal infrastructure, not a far stretch)
- jonas21 2y agoIf they can do that, they can spoof or proxy any website and collect your passwords, auth cookies, and anything else sent over the network. At that point, who cares if they can also see how much CPU you're using?
- drpossum 2y agoI've unlearned over my years that trying to come up with what malicious actors can do under what scenarios and conditions isn't worth the effort, because they are many, know more than me, have different goals than me, and I am one. There's endless permutations of environments and additional weakness or scenarios or a particular sensitivity of information that you don't or can't consider that make some attack really painful. For this case, maybe CPU usage or aggregate changes in CPU usage tips off an attacker on what someone is ramping up internally that can be used for espionage or even timing attacks. What I have learned in place of that is plug holes to minimize attack vectors.
- pharrington 2y agois your local network google.com ?
- shreddit 2y agoI can tell my pc what ca to trust, so yes i can make it to…
- mimon 2y agoSo if you can just trick someone into trusting a bogus root CA, take control of their DNS resolution, and get them to open an attacker controlled domain in Chrome then you can... Use this API to get information about their current CPU utilisation. Wow some attack you got there.