4 ms·

This is how I understand the exploit, can someone please confirm if I have the right idea? 1. I register a domain name -- example.com -- with a registrar like

This is how I understand the exploit, can someone please confirm if I have the right idea? 1. I register a domain name -- example.com -- with a registrar like NameCheap. They tell Network Solutions (the .com registry) to add records on my behalf like below, which means the rest of the internet asks NameCheap's nameservers when they want to look up my domain. example.com. 172800 IN NS ns1.namecheaphosting.com example.com. 172800 IN NS ns2.namecheaphosting.com 2. For no reason, I ask NameCheap to change those NS records to another company's nameservers, such as Hurricane Electric, which I am NOT a customer of example.com. 172800 IN NS ns1.he.net example.com. 172800 IN NS ns2.he.net 3. Hurricane Electric (HE) are "exploitable"; one of their customers claims to be tranferring a domain to HE, example.com (my domain!), HE doesn't verify the actual ownership and they let it happen. 4. Now this HE customer has control over my domain... because I told my registrar to change the NS records to HE's nameservers. Why would I ever do that? My understanding is this should never happen, I have no reason why I'd want to make such a change. ICANN have a policy on domain transfer between registrars: https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en https://www.icann.org/resources/pages/transfer-policy-2016-0... -- and transferring a domain should only be done with the gaining registrar (HE in my example) putting an explicit request to the losing registar (NameCheap in my example), and the losing registrar getting to decide yes or no to the transfer. So... how are there a million or more domains at risk this way? Is it old practises that haven't been corrected? How would this work?

cortesoft 2y ago
This is kinda how it works, but not how it would work in practice. The issue would be more like: 1. Register your domain with namecheap, and you want to have digital ocean run your DNS, so you point the domain to use their name servers. 2. A few months later, you decide to stop using digital ocean DNS, so you delete all your records… but you forget to change your NS record at namecheap, so now someone else can now add that DNS name to their digital ocean account. This would only happen if your aren’t actively using the DNS name, which would allow you to have it point to a NS you aren’t controlling.
- layer8 2y ago
  But the easy fix is just to change the NS records back to something you control. Somehow I don’t understand the problem.
  - NoahKAndrews 2y ago
    It's easy to fix if you own the domain, but it still happens. The idea is to find ways to address the problem with the DNS providers so that it doesn't happen at all.
  - cortesoft 2y ago
    The point is some people will forget. It is not a huge security hole, but just something that will cause issues for some people.
- davchana 2y ago
  Gitlab also had same issue few weeks ago. Gitlab, once static pages are published, gives you a URL with gitlab.io ending. You can use your custom domain or subdomain by pointing CNAME or A record to Gitlab. What users would do is, add DNS records to their DNS Manager to point their custom domain to Gitlab Pages, later will delete the Gitlab pages when not wanted any more. Scammer will simply point that same domain to his fake repository, thus hijacking customer domain. Gitlab then made customer add a Txt Record for verification of domain. Scammer's txt record value is different from customer txt record, scammer can't modify DNS records.
  - apitman 2y ago
    Is there a similar mitigation that would work when you're using the 3rd party nameservers (a la Cloudflare), and not just a CNAME?
buzer 2y ago
From what I understand the issue is more that people point domain to a DNS service, use it for a while and then remove their account (/domain from the account). Now someone else can add it to their account. This is unlikely to be an issue on their primary domain but could be for e.g. subdomains or some marketing domains that aren't really in use anymore. Or cases where domain is just be squatted.
nickburns 2y ago
Namecheap is not a losing registrar, HE is not a gaining registrar, and the transaction you describe with Namecheap requesting that they update your registration's nameservers to HE's is not a domain transfer. You're conflating registration with nameserver assignment.
- amiga386 2y ago
  I'm not trying to conflate it, but I'm trying to imagine why you would ever switch your domain's NS entries away from your current registrar's nameservers, and the only reason I can think of is that you'd want a registrar transfer -- which should and I think does have more ownership checks around it. However, other posters have given a more plausible example: you have server hosting with someone who isn't also a registrar, so for simplified management, you get your registrar to point your domain's nameserver at the server hosting company's nameservers, delegating it all to them... now you just need one customer portal to update all your hosting and DNS entries... and then you leave the hosting company (maybe the bill's too much), and you also forget to clean up the NS records, pointing them back to the real registrar's nameservers, so they're still pointing at this server hosting company you're no longer a customer of. The hosting company isn't a registrar and is under no obligation to follow ICANN policies, so they can give the domain to some other customer of theirs without doing any verification. (I'm not sure they can do domain ownership validation, if they're not a registrar themselves)
  - nickburns 2y ago
    I personally keep my domain registrations and zone files separate as a matter of security policy. I place as much importance on vetting reputable DNS providers as I do registrars. Nameserver assignment remains with the ICANN-accredited registrar. (I would also never maintain a registration nor a zone file with a web/cloud hosting service.)
  - vel0city 2y ago
    I've often run my registrars separate from my nameservers. Maybe I'm self hosting my nameservers. Maybe the nameservers are tied to the rest of my hosting (for ease of dynamic hosting) but want the ability to rapidly migrate if the hosting provider goes down. If the registrar is my nameserver host, good luck changing the SOA and NS records when SHTF at your host.

cortesoft 2y ago

This is kinda how it works, but not how it would work in practice. The issue would be more like: 1. Register your domain with namecheap, and you want to have digital ocean run your DNS, so you point the domain to use their name servers. 2. A few months later, you decide to stop using digital ocean DNS, so you delete all your records… but you forget to change your NS record at namecheap, so now someone else can now add that DNS name to their digital ocean account. This would only happen if your aren’t actively using the DNS name, which would allow you to have it point to a NS you aren’t controlling.

layer8 2y ago
But the easy fix is just to change the NS records back to something you control. Somehow I don’t understand the problem.
- NoahKAndrews 2y ago
  It's easy to fix if you own the domain, but it still happens. The idea is to find ways to address the problem with the DNS providers so that it doesn't happen at all.
- cortesoft 2y ago
  The point is some people will forget. It is not a huge security hole, but just something that will cause issues for some people.
davchana 2y ago
Gitlab also had same issue few weeks ago. Gitlab, once static pages are published, gives you a URL with gitlab.io ending. You can use your custom domain or subdomain by pointing CNAME or A record to Gitlab. What users would do is, add DNS records to their DNS Manager to point their custom domain to Gitlab Pages, later will delete the Gitlab pages when not wanted any more. Scammer will simply point that same domain to his fake repository, thus hijacking customer domain. Gitlab then made customer add a Txt Record for verification of domain. Scammer's txt record value is different from customer txt record, scammer can't modify DNS records.
- apitman 2y ago
  Is there a similar mitigation that would work when you're using the 3rd party nameservers (a la Cloudflare), and not just a CNAME?

buzer 2y ago

From what I understand the issue is more that people point domain to a DNS service, use it for a while and then remove their account (/domain from the account). Now someone else can add it to their account. This is unlikely to be an issue on their primary domain but could be for e.g. subdomains or some marketing domains that aren't really in use anymore. Or cases where domain is just be squatted.

nickburns 2y ago

Namecheap is not a losing registrar, HE is not a gaining registrar, and the transaction you describe with Namecheap requesting that they update your registration's nameservers to HE's is not a domain transfer. You're conflating registration with nameserver assignment.

amiga386 2y ago
I'm not trying to conflate it, but I'm trying to imagine why you would ever switch your domain's NS entries away from your current registrar's nameservers, and the only reason I can think of is that you'd want a registrar transfer -- which should and I think does have more ownership checks around it. However, other posters have given a more plausible example: you have server hosting with someone who isn't also a registrar, so for simplified management, you get your registrar to point your domain's nameserver at the server hosting company's nameservers, delegating it all to them... now you just need one customer portal to update all your hosting and DNS entries... and then you leave the hosting company (maybe the bill's too much), and you also forget to clean up the NS records, pointing them back to the real registrar's nameservers, so they're still pointing at this server hosting company you're no longer a customer of. The hosting company isn't a registrar and is under no obligation to follow ICANN policies, so they can give the domain to some other customer of theirs without doing any verification. (I'm not sure they can do domain ownership validation, if they're not a registrar themselves)
- nickburns 2y ago
  I personally keep my domain registrations and zone files separate as a matter of security policy. I place as much importance on vetting reputable DNS providers as I do registrars. Nameserver assignment remains with the ICANN-accredited registrar. (I would also never maintain a registration nor a zone file with a web/cloud hosting service.)
- vel0city 2y ago
  I've often run my registrars separate from my nameservers. Maybe I'm self hosting my nameservers. Maybe the nameservers are tied to the rest of my hosting (for ease of dynamic hosting) but want the ability to rapidly migrate if the hosting provider goes down. If the registrar is my nameserver host, good luck changing the SOA and NS records when SHTF at your host.