25 ms·
We spent $20 to achieve RCE and accidentally became the admins of .mobi
- vool 2y agoTLDR > While this has been interesting to document and research, we are a little exasperated. Something-something-hopefully-an-LLM-will-solve-all-of-these-problems-something-something.
- 486sx33 2y agoI have to say - it wasn’t exactly “accidentally” that this occurred
- tomaskafka 2y agoO.M.G. - the attack surface gained by buying a single expired domain of an old whois server is absolutely staggering.
- deisteve 2y ago[flagged]
- JustAndy 2y agoDo you have any references/examples of this?
- RIMR 2y agoNope, this is just someone spreading AI hype.
- deisteve 2y agotons rapid7 for example use LLMs to analyze code and identify vulnerabilities such as SQL injection, XSS, and buffer overflows. Their platform can also identify vulnerabilities in third-party libraries and frameworks from what i can see
- WeLostMcguffin 2y ago[flagged]
- 0x500x79 2y agoCan you point me to a blog or feature of them that does this? I used to work at R7 up until last year and there was none of this functionality in their products at the time and nothing on the roadmap related to this. It was all static content.
- ycombinatrix 2y agoI would rather own a WHOIS server than a "decent sized quantized LLM"...
- iscoelho 2y agoGreat write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to verify) 4. Email, used for verification in this post, is also poorly protected against BGP hijacks. I'm amazed we've lasted this long. It must be because if anyone abuses these issues, someone might wake up and care enough to fix them (:
- 8organicbits 2y ago> 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able. NSEC does this. > An NSEC record can be used to say: “there are no subdomains between subdomains X and subdomain Y.
- iscoelho 2y agoYou're correct - noting that Lets Encrypt supports DNSSEC/NSEC fully. Unfortunately though, the entire PKI ecosystem is tainted if other CAs do not share the same security posture.
- 8organicbits 2y agoTainted seems a little strong, but I think you're right, there's nothing in the CAB Baseline Requirements [1] that requires DNSSEC use by CAs. I wouldn't push for DNSSEC to be required, though, as it's been so sparsely adopted. Any security benefit would be marginal. Second level domain usage has been decreasing (both in percentage and absolute number) since min-2023 [2]. We need to look past DNSSEC. [1] https://cabforum.org/working-groups/server/baseline-requirements/documents/CA-Browser-Forum-TLS-BR-2.0.7.pdf https://cabforum.org/working-groups/server/baseline-requirem... [2] https://www.verisign.com/en_US/company-information/verisign-labs/internet-security-tools/dnssec-scoreboard/index.xhtml https://www.verisign.com/en_US/company-information/verisign-...
- pimlottc 2y agoAs a reminder, RCE = remote code execution (it’s not defined in the article). https://www.cloudflare.com/learning/security/what-is-remote-code-execution/ https://www.cloudflare.com/learning/security/what-is-remote-...
- worthless-trash 2y agoThese days people use "RCE" for local code execution.
- acdha 2y agoI would clarify that as running code somewhere you don’t already control. The classic approach would be a malformed request letting them run code on someone else’s server, but this other pull-based approach also qualifies since it’s running code on a stranger’s computer.
- spathi_fwiffo 2y agoIt is defined in the article the first time it is used in the text. Maybe they read your comment and fixed it?
- pimlottc 2y agoPerhaps so! I didn’t see it defined anywhere earlier.
- shipp02 2y agoI love the overall sense of we didn't want to this but things just keep escalating and they keep getting more than they bargained for at each step. If only the naysayers had listened and fixed their parsing, the post authors might've been spared.
- xnorswap 2y agoThis blog is a fantastic journey, it was well worth reading the whole thing.
- sebstefan 2y ago>The first bug that our retrospective found was CVE-2015-5243. This is a monster of a bug, in which the prolific phpWhois library simply executes data obtained from the WHOIS server via the PHP ‘eval’ function, allowing instant RCE from any malicious WHOIS server. I don't want to live on this planet anymore
- detourdog 2y agoAlways look on the bright side of Life. The non-sensicalness of it is just a phase. Remember the Tower of Babel didn't stop humanity. Here is a link that was posted a few days ago regarding how great things are compared to 200 years ago. Ice cream has only become a common experience in the last 200 years.. https://ourworldindata.org/a-history-of-global-living-conditions https://ourworldindata.org/a-history-of-global-living-condit...
- Noumenon72 2y agoSomeone may have posted a link to it a few days ago, but the link is from 2016 with a partial update last February.
- brynb 2y agothat seems like a bigger lift than just deciding to help fix the bug “be the change” or some such
- larsnystrom 2y agoThe fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would've been equivalent to their eval statement, but with less code and no RCE.
- hypeatei 2y agoThe fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.
- devvvvvvv 2y agoEntertaining and informative read. Main takeaways for me from an end user POV: - Be inherently less trustworthy of more unique TLDs where this kind of takeover seems more likely due to less care being taken during any switchover. - Don't use any "TLS/SSL Certificate Authorities/resellers that support WHOIS-based ownership verification."
- DexesTTP 2y agoNone of these are true for the MitM threat model that caused this whole investigation: - If someone manages to MitM the communication between e.g. Digicert and the .com WHOIS server, then they can get a signed certificate from Digicert for the domain they want - Whether you yourself used LE, Digicert or another provider doesn't have an impact, the attacker can still create such a certificate. This is pretty worrying since as an end user you control none of these things.
- devvvvvvv 2y agoThank you for clarifying. That is indeed much more worrying. If we were able to guarantee NO certificate authorities used WHOIS, this vector would be cut off right? And is there not a way to, as a website visitor, tell who the certificate is from and reject/distrust ones from certain providers, e.g. Digicert? Edit: not sure if there's an extension for this, but seems to have been done before at browser level by Chrome: https://developers.google.com/search/blog/2018/04/distrust-of-symantec-pki-immediate https://developers.google.com/search/blog/2018/04/distrust-o...
- tetha 2y agoCAA records may help, depending on how the attacker uses the certificate. A CAA record allows you to instruct the browser that all certs for "*.tetha.example" should be signed by Lets Encrypt. Then - in theory - your browser could throw an alert if it encounters a DigiCert cert for "fun.tetha.example". However, this depends strongly on how the attacker uses the cert. If they hijack your DNS to ensure "fun.tetha.example" goes to a record they control, they can also drop or modify the CAA record. And sure, you could try to prevent that with long TTLs for the CAA record, but then the admin part of my head wonders: But what if you have to change cert providers really quickly? That could end up a mess.
- nusl 2y agoPretty horrible negligence on the part of .mobi to leave a domain like this to expire.
- ycombinatrix 2y agoDon't forget the mail servers, certificate providers, whois clients
- WeLostMcguffin 2y agoCan't agree entirely. It's negligent, sure, but the negligent part wasn't letting it expire. The negligent part was not holding the domain with an error result for 10 years and respond to every request with an email telling them to stop using that domain. And I say 10 years because 10 years of having a broken system is already way too long to not go addressing, no matter how sluggish the service underneath. You can not be expected to cover your own ass for OTHER people's fuckups into perpetuity. Every system issuing an whois to a supposed dead domain should be considered the actual responsible party for this.
- nusl 2y agoSure, though if you're a central provider like a registrar/ISP there are very bad things that happen no matter what you do with a domain. Since the registrar could very easily determine whether or not the domain was in active use in the wild (and still return an error if they wanted), and didn't, I do consider it negligence. People hard-code them, they end up in configs, all over, specially in forgotten or hard-to-change places. $20 a year forever is pretty cheap for a company.
- Tepix 2y agoWow! Highly entertaining and scary at the same time. Sometimes ijust wish i was clueless about all those open barn doors.
- hansjorg 2y agoWhy are tools using hardcoded lists of WHOIS servers? Seems there is a standard (?) way of registering this in DNS, but just from a quick test, a lot of TLDs are missing a record. Working example: dig _nicname._tcp.fr SRV +noall +answer _nicname._tcp.fr. 3588 IN SRV 0 0 43 whois.nic.fr. Edit: There's an expired Internet Draft for this: https://datatracker.ietf.org/doc/html/draft-sanz-whois-srv-01 https://datatracker.ietf.org/doc/html/draft-sanz-whois-srv-0...
- rty32 2y agoThe reality of life is that there are way more hardcoded strings than you imagine or there should be.
- crote 2y agoA plain mobi.whois.arpa. CNAME whois.nic.mobi could've already solved the issue. But getting everyone to agree and adopt something like that is hard. Although as fanf2 points out below, it seems you could also just start with the IANA whois server. Querying https://www.iana.org/whois https://www.iana.org/whois for `mobi` will return `whois: whois.nic.mobi` as part of the answer.
- xyst 2y agobecause people build these tools as part of one time need, publish it for others (or in case they need to reference it themselves). Other "engineers" copy and paste without hesitating. Then it gets into production and becomes a CVE like discussed. Developer incompetence is one thing, but AI-hallucination will make this even worse.
- tryauuum 2y agoI have a feeling whois is way older than the concept of SRV records even
- meepmorp 2y agoThe first WHOIS db was created in early 70s, according to Wikipedia. So, older than DNS itself.
- asimpleusecase 2y agoWonderful article! Well done chaps.
- giancarlostoro 2y agoI still remember when websites would redirect you on your phone to their .mobi website, completely screwing up the original intent. They didn't show you the mobile version of whatever Google let you towards, they just lazily redirected you to the .mobi homepage. I bet they asked a non-dev to do those redirects, that one IT neckbeard who shoved a redirect into an Apache2 config file and moved on with life. :) But seriously, it was the most frustrating thing about the mobile web. Is this TLD even worth a damn in 2024?
- duskwuff 2y ago> Is this TLD even worth a damn in 2024? IMO: No. Table stakes nowadays are for all web sites to support mobile devices; the notion of having a separate web site for mobile users, let alone an entire TLD for those web sites, is obsolete.
- rixthefox 2y ago> We recently performed research that started off "well-intentioned" (or as well-intentioned as we ever are) - to make vulnerabilities in WHOIS clients and how they parse responses from WHOIS servers exploitable in the real world (i.e. without needing to MITM etc). R̶i̶g̶h̶t̶ o̶f̶f̶ t̶h̶e̶ b̶a̶t̶, S̶T̶O̶P̶. I̶ d̶o̶n̶'t̶ c̶a̶r̶e̶ w̶h̶o̶ y̶o̶u̶ a̶r̶e̶ o̶r̶ h̶o̶w̶ "w̶e̶l̶l̶-̶i̶n̶t̶e̶n̶t̶i̶o̶n̶e̶d̶" s̶o̶m̶e̶o̶n̶e̶ i̶s̶. I̶n̶t̶e̶n̶t̶i̶o̶n̶a̶l̶l̶y̶ s̶p̶r̶i̶n̶k̶l̶i̶n̶g̶ i̶n̶ v̶u̶l̶n̶e̶r̶a̶b̶l̶e̶ c̶o̶d̶e̶, K̶N̶O̶W̶I̶N̶G̶L̶Y̶ a̶n̶d̶ W̶I̶L̶L̶I̶N̶G̶L̶Y̶ t̶o̶ "a̶t̶ s̶o̶m̶e̶ p̶o̶i̶n̶t̶ a̶c̶h̶i̶e̶v̶e̶ R̶C̶E̶" i̶s̶ b̶e̶h̶a̶v̶i̶o̶r̶ t̶h̶a̶t̶ I̶ c̶a̶n̶ n̶e̶i̶t̶h̶e̶r̶ c̶o̶n̶d̶o̶n̶e̶ n̶o̶r̶ s̶u̶p̶p̶o̶r̶t̶. I̶ t̶h̶o̶u̶g̶h̶t̶ t̶h̶i̶s̶ k̶i̶n̶d̶ o̶f̶ r̶o̶g̶u̶e̶ c̶o̶n̶t̶r̶i̶b̶u̶t̶i̶o̶n̶s̶ t̶o̶ p̶r̶o̶j̶e̶c̶t̶s̶ h̶a̶d̶ a̶ g̶r̶e̶a̶t̶ e̶x̶a̶m̶p̶l̶e̶ w̶i̶t̶h̶ t̶h̶e̶ U̶n̶i̶v̶e̶r̶s̶i̶t̶y̶ o̶f̶ M̶i̶n̶n̶e̶s̶o̶t̶a̶ o̶f̶ w̶h̶a̶t̶ n̶o̶t̶ t̶o̶ d̶o̶ w̶h̶e̶n̶ t̶h̶e̶y̶ g̶o̶t̶ a̶l̶l̶ t̶h̶e̶i̶r̶ c̶o̶n̶t̶r̶i̶b̶u̶t̶i̶o̶n̶s̶ r̶e̶v̶o̶k̶e̶d̶ a̶n̶d̶ f̶o̶r̶c̶e̶ r̶e̶v̶i̶e̶w̶e̶d̶ o̶n̶ t̶h̶e̶ L̶i̶n̶u̶x̶ k̶e̶r̶n̶e̶l̶. EDIT: This is not what the group has done upon further scrutiny of the article. It's just their very first sentence makes it sound like they were intentionally introducing vulnerabilities in existing codebases to achieve a result. I definitely can see that it should have been worded a bit better to make the reader aware that they had not contributed bad code but were finding existing vulnerabilities in software which is much better than where I went initially.
- rmnoon 2y agoMake sure you read the article since it doesn't look like they're doing that at all. The sentence you cited is pretty tricky to parse so your reaction is understandable.
- josephg 2y agoI hear you. And I mostly agree. I’ve refused a couple genuine sounding offers lately to take over maintaining a couple packages I haven’t had time to update. But also, we really need our software supply chains to be resilient. That means building a better cultural immune system toward malicious contributors than “please don’t”. Because the bad guys won’t respect our stern, disapproving looks.
- projektfu 2y agoI think you misinterpreted the sentence. They don't need to change the WHOIS client, it's already broken, exploitable, and surviving because the servers are nice to it. They needed to become the authoritative server (according to the client). They can do that with off-the-shelf code (or netcat) and don't need to mess with any supply chains. This is the problem with allowing a critical domain to expire and fall into evil hands when software you don't control would need to be updated to not use it.
- mannyv 2y ago"He who seeks finds." - old proverb.
- develatio 2y agoI have the feeling that any day now I’m gonna wake up in the morning and I’ll find out that there just isn’t internet anymore because somebody did something from a hotel room in the middle of nowhere with a raspberry pi connected to a wifi hotspot of a nearby coffee shop.
- Suppafly 2y agoReminds me of the dorms in college where the internet would get messed up because someone would plug in a random router from home that would hand out junk dhcp ip addresses. It's like that but for the whole world.
- sentientslug 2y agoSounds like BGP…
- deisteve 2y agoeven worse, the raspberry pi, tripped, fell, and burst into flames for no good reason.
- WeLostMcguffin 2y ago[flagged]
- wslh 2y agoAny connection to the recent "White House asks agencies to step up internet routing security efforts" [1] is purely coincidental. [1] https://news.ycombinator.com/item?id=41482087 https://news.ycombinator.com/item?id=41482087
- neuralkoi 2y agoA significant amount of stuff is indeed held up by hopes and prayers [0], but by design, the internet was built to be robust [1]. In this case the scope was limited to .mobi. [0] https://xkcd.com/2347/ https://xkcd.com/2347/ [1] https://en.wikipedia.org/wiki/ARPANET#Debate_about_design_goals https://en.wikipedia.org/wiki/ARPANET#Debate_about_design_go...
- 123sereusername 2y ago[dead]
- donatj 2y agoI have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic keys... don't use dynamically defined variables...
- zoover2020 2y agoThis is why PHP is mostly banned at bigCo
- NovemberWhiskey 2y agoTo paraphrase: you can write PHP in any language. PHP is a negative bias for bigCo mostly because of the folkloric history of bad security practices by some PHP software developers.
- jeremyjh 2y agoBy “folkloric history”, don’t you actually mean just “history”?
- playingalong 2y agoI guess they mean the stigma that arose based on the reality in the past. So kind of both.
- hinkley 2y agoThey fucked themselves and the rest of us moved on. You can become a good person late in life and still be lonely because all your bridges are burned to the ground.
- hinkley 2y ago
- fanf2 2y agoThis is a fantastic exploit and I am appalled that CAs are still trying to use whois for this kind of thing. I expected the rise of the whois privacy services and privacy legislation would have made whois mostly useless for CAs years ago. << maintainers of WHOIS tooling are reluctant to scrape such a textual list at runtime, and so it has become the norm to simply hardcode server addresses, populating them at development time by referring to IANA’s list manually. Since the WHOIS server addresses change so infrequently, this is usually an acceptable solution >> This is the approach taken by whois on Debian. Years ago I did some hacking on FreeBSD’s whois client, and its approach is to have as little built-in hardcoded knowledge as possible, and instead follow whois referrals. These are only de-facto semi-standard, i.e. they aren’t part of the protocol spec, but most whois servers provide referrals that are fairly easy to parse, and the number of exceptions and workarounds is easier to manage than a huge hardcoded list. FreeBSD’s whois starts from IANA’s whois server, which is one of the more helpful ones, and it basically solves the problem of finding TLD whois servers. Most of the pain comes from dealing with whois for IP addresses, because some of the RIRs are bad at referrals. There are some issues with weird behaviour from some TLD whois servers, but that’s relatively minor in comparison.
- tialaramex 2y agoToday the Certificate Authorities in the Web PKI use the "Ten Blessed Methods" (there are in fact no longer ten of them, but that's what I'm going to keep calling them). [[ Edited to add: I remembered last time I mentioned these some people got confused. The requirement is a CA must use at least one of the blessed methods, there used to be "Any other method" basically they could do whatever they wanted and that "method" was of course abused beyond belief which is why it's gone. They can do whatever they like in addition, and there are also some (largely not relevant) checks which are always mandatory, but these "blessed methods" are the core of what prevents you from getting a certificate for say the New York Times websites ]] https://cabforum.org/working-groups/server/baseline-requirements/documents/ https://cabforum.org/working-groups/server/baseline-requirem... The Ten Blessed Methods are listed in section 3.2.2.4 of the Baseline Requirements, there are currently twenty sub-sections corresponding to what the Forum considers distinct methods, the newer ones unsurprisingly are later in the list, although many are retired (no longer permitted for use) 3.2.2.4.2 "Email, Fax, SMS, or Postal Mail to Domain Contact" specifically says to check whois as does 3.2.2.4.15 "Phone Contact with Domain Contact". For the commercial CAs this is all bad for their bottom line, because a willing customer can't buy their product due to some bureaucratic problem. They want to give you $50, but they can't because some IT bloke needs to update a field in some software. When they ask the IT guy "Hey, can you update this field so I can buy a $50 certificate" the IT guy is going to say "Oh, just use Let's Encrypt" and you don't get $50. So you want to make it as easy as possible to give you $50. Bad for the Internet's Security? Who cares. ISRG (the Let's Encrypt CA) of course doesn't care about $$$ because the certificates do not cost money, only the provisioning infrastructure costs money, so they only implement 3.2.2.4.7, 3.2.2.4.19 and 3.2.2.4.20 IIRC because those make sense to automate and have reasonable security assuming no bugs.
- peterpost2 2y agoThat is so neat. Good job guys!
- aftbit 2y ago>You would, at this point, be forgiven for thinking that this class of attack - controlling WHOIS server responses to exploit parsing implementations within WHOIS clients - isn’t a tangible threat in the real world. Let's flip that on its head - are we expected to trust every single WHOIS server in the world to always be authentic and safe? Especially from the point of view of a CA trying to validate TLS, I would not want to find out that `whois somethingarbitrary.ru` leaves me open to an RCE by a Russian server!
- wbl 2y agoIs this in the bugzilla/MDSP yet?
- post-it 2y agoObviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire. If you're a business and you're looking to pick up a new domain because it's only $10/year, consider that you're going to be paying $10/year forever, because once you associate that domain with your business, you can never get rid of that association.
- declan_roberts 2y agoAlways use subdomains. Businesses only ever need a single $10 domain for their entire existence.
- salad-tycoon 2y agoA lot of interesting and informative rebuttals to this comment but no one anticipated the obvious counter argument. Businesses only ever need two $10 domains, usercompany.com and company.com, just in case they ever want to host user generated content.
- ganoushoreilly 2y agoI actually think they need 2, usually need a second domain / setup for failover. Especially if the primary domain is a novelty TLD like.. .IO which showed that things can happen at random to the TLD. If the website down it's fine, but if you have systems calling back to subdomains on that domain, you're out of luck. A good failover will help mitigate / minimize these issues. I'd also keep it on a separate registrar. Domains are really cheap, I try to just pay for 5-10 year blocks (as many as I can), when I can just to reduce the issues.
- shafoshaf 2y agoAnd a second for when your main domain gets banned for spam for innocuous reasons.
- 2y ago
- sundarurfriend 2y agoThe article puts the blame on > Never Update, Auto-Updates And Change Are Bad as the source of the problem a couple of times. This is pretty common take from security professionals, and I wish they'd also call out the other side of the equation: organizations bundling their "feature" (i.e. enshittification) updates and security updates together. "Always keep your programs updated" is just not feasible advice anymore given that upgrades as just as likely to be downgrades these days. If that were to be realistic advice, we need more pressure on companies to separate out security-related updates and allow people to get updates only on that channel.
- necovek 2y agoIn essence, you are agreeing that this is the root cause, you just seem to believe it's unrealistic to fix it. I actually think it's viable to fix, I am simply not sure if anyone would pay for it — basically, old LTS model from Linux distributions where a set of packages gets 5 or 10 years of guaranteed security updates (backported, maintaining backwards compatibility otherwise). If one was to start a business of "give me a list of your FLOSS dependencies and I'll backport security fixes for you for X", what's X for you?
- thrtythreeforty 2y agoAren't you just reinventing Red Hat?
- necovek 2y agoThat's the other way around (and also SuSE, Ubuntu LTS and even Debian stable): here are the things you can get security backports for vs here are the security backports for things you need.
- WeLostMcguffin 2y ago[flagged]
- throwaway984393 2y ago[dead]
- dt3ft 2y agoI wish I had the time they have…
- bitfilped 2y agoI mean it sounds like this was done in a few hours while hanging out at a con. I'm sure you can allocate a few hours to some fun.
- whafro 2y agoI’ve seen so many teams that fail to realize that once you use a domain in any significant way, you’re basically bound to renewing it until the heat death of the universe – or at least the heat death of your team. Whether it’s this sort of thing, a stale-but-important URL hanging out somewhere, someone on your team signing up for a service with an old domain-email, or whatever, it’s just so hard to know when it’s truly okay let an old domain go.
- Fileformat 2y agoThe real solution to WHOIS is RDAP. Unfortunately, it isn't required for ccTlds, and there are plenty of non-ccTlds that aren't working. https://en.wikipedia.org/wiki/Registration_Data_Access_Protocol https://en.wikipedia.org/wiki/Registration_Data_Access_Proto... https://resolve.rs/domains/rdap-missing.html https://resolve.rs/domains/rdap-missing.html
- tucosan 2y agoHow does it mitigate the issues outlined in the article?
- Fileformat 2y agoThe root cause for the PHP vulnerability is trying to parse unstructured text. The actual information in WHOIS has structure: emails, addresses, dates, etc. This info should be provided in a structured format, which is what RDAP defines. IMHO, there is no reason for a registrar to not support RDAP, and to have the RDAP server's address registered with ICANN.
- adolph 2y agoConjecture: control over tlds should be determined by capture the flag. Whenever an organization running a registry achieves a level of incompetence whereby its tld is captured, the tld becomes owned by the attacker. Sure there are problems with this conjecture, like what if the attacker is just as incompetent (it just gets captured again), or "bad actor" etc. A concept similar to capture the flag might provide for evolving better approaches toward security than the traditional legal and financial methods of organizational capture the flag.
- stoperaticless 2y agoDo we include possibility of phisically capturing the server?
- adolph 2y agoIt is an interesting question. Physical security is significant. On the other hand, the physical server is not necessarily the set of digital controls that establish the server's authenticity. The significant part is performing something similar to a "Turing test" whereby the capturer continues services just as if they were the previous operator of the service (but without the security holes). OTOH, if the capture failed to also capture banking flows from customers to the service, then the capturer would have a paddle-less canoe.
- mnau 2y agoI think the whole computer approach is doomed to failure. It relies on perfect security that is supposed to be achieved by SBOM checking and frequent updates. That is never going to work. Even log4j, 40% of all downloads are vulnerable versions. Much less when a vendor in a chain goes out of business or stops maintaining a component. Everything is always going to be buggy and full of holes, just like our body is always full of battlefields with microbes.
- pas 2y agonah, slowly but surely we can write good and reliable code, use that for things to make better tools, and then use those to ... :) It will be probably a few decades, but the road seems pretty clear. Put in the work, apply the knowledge gained from all the "lessons learned" and don't stop.
- forgotpwd16 2y agoVery cool work. >The dotmobiregistry.net domain, and whois.dotmobiregisry.net hostname, has been pointed to sinkhole systems provided by ShadowServer that now proxy the legitimate WHOIS response for .mobi domains. If those domains were meant to be deprecated should be better to return a 404. Keeping them active and working like normal reduces the insensitive to switch to the legitimate domain.
- epc 2y agoWhois doesn't support HTTP status codes, but the shadowserver sinkhole responds with: Domain not found. >>> Please update your code or tell your system administrator to use whois.nic.mobi, the authoritative WHOIS server for this domain. <<<
- anabab 2y agoThe article implies they were broken for a few years and lots of clients did not notice this.
- lovasoa 2y ago> $ sqlite3 whois-log-copy.db "select source from queries"|sort|uniq|wc -l Oh cool they saved the logs in a database ! Wait... |sort|uniq|wc -l ?? But why ?
- SSLy 2y agobeats up re-re-remembering how to do it in sql
- radicality 2y agoAnd probably because for quick things like that you’re already working in a “pipeline”, where you first want to see some of the results so you output with SQLite, and then add more to the pipeline. Similarly, I often do ‘cat file | grep abc’ instead of just grep, might be probably out of habit.
- mr_mitm 2y agoI found that this is actually a good use case for LLMs. You can probably paste that one liner up there and ask it to create the corresponding SQL query.
- SSLy 2y agoyeah, they're good for cursed tools like that, ffmpeg, excel macros, etc etc
- mjevans 2y agoSELECT COUNT( DISTINCT source ) FROM queries ORDER BY source ASC -- COUNT ( DISTINCT ... ) ~= uniq | wc -l ;; sort without -u is this busybox? ORDER BY col ASC -- wait this doesn't need sort and uniq if it's just being counted... SELECT COUNT( DISTINCT source ) FROM queries
- Woovie 2y agobash nerds vs sql nerds I guess, these people are bash nerds
- 2y ago
- muppetman 2y agoOh no not .mobi!
- ipsum2 2y agoAs an aside, I haven't seen a .mobi domain out in the wild in the past 6 years.
- jimmaswell 2y ago> auto updates are bad, turn them off What? No.
- HmU7RuewTCeF 2y ago[flagged]
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- aadlani 2y agoThe cost of managing a domain portfolio is like compound interest — the more domains you add, the higher the renewal costs climb year after year. It’s tempting to hold onto every domain ‘just in case,’ but cutting domains without a proper risk assessment can open the door to serious security issues, as this article points out.
- hi-v-rocknroll 2y agoIt's grotesquely insecure and not authoritative to rely on rando, unsecured WHOIS in the clear scraping contact details to "authenticate" domain ownership rather than ask the owner to provide a challenge cookie by DNS or hosted in content.
- mightyhacker658 2y ago[dead]