9 ms·
Don’t let your domain name become a sitting duck
- metadat 2y agoFrom TFA: > There is a frequently updated list published on GitHub called “Can I take over DNS,” which has been documenting exploitability by DNS provider over the past several years. https://github.com/indianajson/can-i-take-over-dns https://github.com/indianajson/can-i-take-over-dns Whoa, names like Digital Ocean, Google Cloud, Linode, Hurricane Electric - all classified as fully vulnerable.
- kortilla 2y agoBecause it’s not an attack. What am I missing here? This doesn’t feel any different than letting your domain expire.
- throwaway48540 2y agoThis definitely feels like an attack. One time I forgot to update my name servers after removing the domain from DigitalOcean and some spammer took it over. Another time I wanted to use DigitalOcean with my domain but I can't add it, because someone else has registered it.
- xmprt 2y agoAfter removing the domain from DigitalOcean did you use the domain anywhere else? It just seems strange to me that you can forget about a domain after explicitly removing that domain from a third party provider.
- throwaway48540 2y agoI have hundreds of domains. I was deleting them from DO by dozens. One slipped through the cracks.
- nickcw 2y agoI think the DNS provider is missing some due diligence. What happens is Alice creates some DNS records for example.com which is registered elsewhere. Everything is fine. At some point (maybe Alice forgets to pay the bill) the DNS records expire. A bit later Bob makes an account at the same DNS provider and makes DNS records for example.com. This is possible because Alice's records have been deleted. Bob has now effectively taken over example.com The due diligence missing is that the provider could have kept a record that the DNS records were owned by Alice. They should have been asking questions (or doing additional validation) when Bob tried to create new ones for example.com.
- CGamesPlay 2y agoMy question is, after this point, can Alice reclaim her domain? Is there any way to automate verification of domain name ownership outside without DNS?
- OccamsMirror 2y agoShe just needs to change her nameservers at the registrar level.
- OJFord 2y agoShe hasn't lost the domain, she's lost the ability to control its DNS at the provider she's currently using (the nameservers she set). So as sibling says it's a case of changing the ns to some other provider, or else I suppose a support case to somehow prove you do own the domain, so please assign control back to your account.
- jsheard 2y agoWell, if the email address you use at the registrar is under the domain the attacker now controls, they can hijack it and potentially escalate to taking over your registrar account as well. Hopefully you have 2FA set up and your registrar enforces it properly.
- 2y ago
- handsclean 2y agoThe difference is whether it can be fixed. An expired domain is hard because we don’t actually know the attacker isn’t legitimate until they misuse the domain. In the case of hosting hijacking, though, the domain still has a legitimate owner, and the hosting provider is giving somebody else access without that owner’s permission. I’d blame the domain owner if they pointed their domain off at some malicious host, but the point here is that it’s hosting providers we consider trusted and legitimate that are doing this, and they can stop doing it, they’re just choosing not to.
- Terretta 2y agoGoDaddy and SquareSpace (now that Google's DNS shifted) are notable by not being listed.
- jorams 2y agoThat's probably because they won't host your DNS without having the domain registered with them.
- Brajeshwar 2y agoUK.GOV has a good guide on "Keeping your domain name secure." https://www.gov.uk/guidance/keeping-your-domain-name-secure https://www.gov.uk/guidance/keeping-your-domain-name-secure
- rozenmd 2y agoTFA reminds me that most people miss the basics (eventually letting their domain expire), which is a much bigger threat than domain takeover: - Enable 2FA - Check that your domain is set to auto renew - Lock your domain from transfer - Check your payment details - Use a reputable domain registrar - Be sure you actually own your domain - Extend your domain registration - Be aware of any TLD-specific rules around renewals from: https://onlineornot.com/guidelines-to-help-avoid-losing-your-domain https://onlineornot.com/guidelines-to-help-avoid-losing-your...
- precommunicator 2y agoIf your domain name is critical to you, pay 10 years in advance where possible, and still extend every year, to keep this 10 year buffer.
- detourdog 2y agoI did a 100 year registration. This was under $1;000 about 10 years ago. The status only show 10 year increments. I did it with network solutions.
- bongobingo1 2y agoDo you worry about the registra going down during that time? I guess ICANNs records should include the lease length and as long as you can prove you exist at the correct physical address or whatever you can "reassign" it to a down stream registra?
- detourdog 2y ago
- loopdoend 2y agoIsn’t this the same as the spammy bear attack?
- Joeboy 2y agoSomewhat related question: I have a (obscure) domain that I'm planning to let expire soon. Is there anything I could / should do to stop it being used for questionable purposes?
- kxrm 2y agoOnce you let your domain expire you no longer have any say over what happens with the domain so no, not really. I would just recommend cleansing the domain from any systems you may have used it on and ensuring that you have no other technical ties the domain. Treat it just like any other domain you do not own.
- hk__2 2y agoIf you don’t own the domain then you have no say over what’s it’s used for. The only thing you can do is not to let it expire.
- belorn 2y agoCreate a permanent redirect to any other site should transfer any search "scores" onto the new site. You can also request google to de-list the domain from search, which should reset any value that the domain has acquired from the time you owned it. If the account is validated on large platforms, it should be a good idea to remove those from the account as a way to signal the platform that it is no longer validated on that site.
- sybercecurity 2y agoSome TLDs/registrars let you park registrations. They won't appear in the DNS, but they can't be registered by anyone else. Or there is a delegation to some internal hosting service that the registrar operates that is an empty zone (i.e. no A, MX, etc.) so there is nothing reachable. I've done this with zones I've had for a while - it sucks since you want to be a good net citizen and not let the zones be used for spam/attacks. You end up paying for a domain for years after you stopped needing it.
- pabs3 2y agoFirst, let ArchiveTeam know, so that we can save anything public you have on the domain to archive.org so it will persist beyond the expiry. https://archiveteam.org/ https://archiveteam.org/
- Neil44 2y agoSo you point your nameservers at a third party, let your account with that third party expire, then someone later on can create an account at third party and resume control of the DNS zone? I mean yeah, but you mustn't care much about the domain and any credibility it has will evaporate quickly.
- josefresco 2y agoI had something similar happen to a client using Cloudflare. The attacker somehow was able to establish a new account(s) at CF that used the same free nameservers as my client. When my client's domain expired the attackers added the domain in their CF account, and were then able to control DNS. I reported it to CF security but I'm not sure if the loophole was closed. What I don't know is how the attacker was able to get an account with the same nameservers which are seemingly assigned at random (maybe not?). Maybe they just own/operate thousands of CF accounts? Update: CF claims to have closed this loophole: https://github.com/indianajson/can-i-take-over-dns/issues/10 https://github.com/indianajson/can-i-take-over-dns/issues/10
- lcnPylGDnU4H9OF 2y agoNot sure if you're emphasizing "claims" because you find it dubious so perhaps it's worth noting that the statement is coming from someone who claims (heh) to be an engineer at CF rather than someone working in PR/marketing. In case that affects the reader's view of the statement.
- josefresco 2y agoI don't necessarily find it dubious. I emphasized because I have not verified personally that the exploit is closed nor would that even be feasible (for me or anyone outside CF). I also previously reported this issue to multiple people at CF, offered more information and it was seemingly ignored/buried until this project called them out. Also, when reading through the thread I shared it doesn't seem like CF or the researchers recognized the extent of the initial problem when they initially classified as "edge case". My client who was targeted was small and insignificant which caused me to doubt this an "edge case". Just my speculation.
- ChrisArchitect 2y agoActual report: https://blogs.infoblox.com/threat-intelligence/who-knew-domain-hijacking-is-so-easy/ https://blogs.infoblox.com/threat-intelligence/who-knew-doma... (https://news.ycombinator.com/item?id=41120214 https://news.ycombinator.com/item?id=41120214)
- 256_ 2y agoFrom TFA: > DNSMadeEasy founder and senior vice president Steve Job That name surprised me. I thought it couldn't possibly be real. I looked it up and apparently that's actually his name; presumably no relation to the plural one who ran Apple. Most articles seem to write his first name with an N to make it more believable.
- kchr 2y agoMy tired mind had to read your comment a couple of times before realising you actually meant Steven, not Nsteve.
- octopoc 2y agoWhat happens if you set your name servers to e.g. Digital Ocean then go to Digital Ocean and try to add your domain name there but you find that an attacker has already created that domain name under their account? They were watching the name server records on your domain.
- sybercecurity 2y agoI'd change the registration info at the registrar - park the zone if you must. That would at least stop the attack from continuing (caches would still have the attacker's responses). The best defense is to set up the delegation at the host first, then set up the delegation information at the registrar. A stub zone is could be run indefinitely (as long as there were no name collisions) before a formal delegation from a TLD is set up. Gives you time to set things up the way you want before it is reachable from global DNS tree.
- vel0city 2y agoI always set up at least the basics of the zone first, then point the nameservers. Why would you point to nameservers that know nothing of the zone?!
- everfrustrated 2y agoPart of this problem is authoritative dns server operators not sharding their zones. The only provider I know who does this correctly is AWS Route 53. Your zone gets assigned 4 unique authoritative servers from a set of namespaced shards. eg ns-2048.awsdns-64.com Someone else can create a zone for the same domain but will map to different shard so no real world effect. Always surprising to me that hardly any providers do it.
- Uvix 2y agoAzure DNS does the same.
- amiga386 2y agoThis is how I understand the exploit, can someone please confirm if I have the right idea? 1. I register a domain name -- example.com -- with a registrar like NameCheap. They tell Network Solutions (the .com registry) to add records on my behalf like below, which means the rest of the internet asks NameCheap's nameservers when they want to look up my domain. example.com. 172800 IN NS ns1.namecheaphosting.com example.com. 172800 IN NS ns2.namecheaphosting.com 2. For no reason, I ask NameCheap to change those NS records to another company's nameservers, such as Hurricane Electric, which I am NOT a customer of example.com. 172800 IN NS ns1.he.net example.com. 172800 IN NS ns2.he.net 3. Hurricane Electric (HE) are "exploitable"; one of their customers claims to be tranferring a domain to HE, example.com (my domain!), HE doesn't verify the actual ownership and they let it happen. 4. Now this HE customer has control over my domain... because I told my registrar to change the NS records to HE's nameservers. Why would I ever do that? My understanding is this should never happen, I have no reason why I'd want to make such a change. ICANN have a policy on domain transfer between registrars: https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en https://www.icann.org/resources/pages/transfer-policy-2016-0... -- and transferring a domain should only be done with the gaining registrar (HE in my example) putting an explicit request to the losing registar (NameCheap in my example), and the losing registrar getting to decide yes or no to the transfer. So... how are there a million or more domains at risk this way? Is it old practises that haven't been corrected? How would this work?
- cortesoft 2y agoThis is kinda how it works, but not how it would work in practice. The issue would be more like: 1. Register your domain with namecheap, and you want to have digital ocean run your DNS, so you point the domain to use their name servers. 2. A few months later, you decide to stop using digital ocean DNS, so you delete all your records… but you forget to change your NS record at namecheap, so now someone else can now add that DNS name to their digital ocean account. This would only happen if your aren’t actively using the DNS name, which would allow you to have it point to a NS you aren’t controlling.
- layer8 2y ago
- StuntPope 2y agoThe Gell-Mann Amnesia is strong in this story and thead. As I posted on Krebs' article: This is neither news nor new. There have been prior panics around this “water is wet” type issue going back at least a decade. (Search up “Floating Domains – Taking Over 20K DigitalOcean Domains via a Lax Domain Import System” – and others). I also wrote about this on CircleID from the DNS operator’s perspective (“Nameserver Operators Need the Ability to “Disavow” Domains”) – after this same issue was used to DDoS attack another DNS provider by delegating a domain to their DNS servers without having setup an account there, and then doing a DNS reflection attack on that domain. That was over ten years ago. The fact that people can delegate their own domains to somebody else’s nameservers without ever properly setting up a zone on those nameservers, or ever keeping track of where THEIR OWN DOMAINS point is 100% the responsibility of the domain owner – and to varying degrees a function of their REGISTRAR – who is the only entity that has any control over it. It’s a weird flex for corporate registrars who purport to be “high touch” and exclusive, to simply shrug their shoulders and turn a blind eye to their own clients’ obviously broken and vulnerable nameserver delegations. For our part this is specifically one of things we actively monitor and alert our clients about.
- quicksilver03 2y agoI've just launched a DNS hosting provider ( https://www.ptrdns.net https://www.ptrdns.net ) and this is one of the problems I'm worried about. With the PowerDNS backend I'm using, once a zone is added PowerDNS will respond to queries for its record regardless of the nameserver the queries are sent to. One can, for example, query the IP address of the nameserver to get a response. The Route 53 technique of assigning random server names looks a bit like the technique of creating virtual hosts in a nginx server, but it looks like this is a custom AWS implementation and not something that comes out of the box in any DNS server software I know.