3 ms·
It's singed by a key that's obtained from a URL owned by the same person. Sure, you can't attack devices already using the repo, but new installs are fair game.
by serbuvlad 1y ago
It's singed by a key that's obtained from a URL owned by the same person. Sure, you can't attack devices already using the repo, but new installs are fair game.
And are URLs (w/ DNSSEC and TLS) really that easy to hijack?
- tart-lemonade 1y ago> And are URLs (w/ DNSSEC and TLS) really that easy to hijack? During the Google Domains-Squarespace transition, there was a vulnerability that enabled relatively simple domain takeovers. And once you control the DNS records, it's trivial to get Let's Encrypt to issue you a cert and adjust the DNSSEC records to match. https://securityalliance.notion.site/A-Squarespace-Retrospective-or-How-to-Coordinate-an-Industry-Wide-Incident-Response-fead693b66c14543a48283d85aec19ad https://securityalliance.notion.site/A-Squarespace-Retrospec...