5 ms·

That seems somewhat scary if they've compromised domain registrars and are intercepting login data from client sites that way.

by robk 13y ago

jrockway 13y ago
It's more scary if they've compromised a SSL CA. A simple DNS attack won't stop your browser from displaying a broken certificate warning. (Though they can always not redirect from http to https and most users won't notice, sadly.)
- blibble 13y ago
  it's very easy to get your own https cert once you control the dns for a domain, you just set up own nameserver that proxies requests to the original NS (except very specific ones, say those from Verisign), request your "domain control validation" https cert, and bam! valid https cert!
- deleted 13y ago
  [deleted]
  - bstpierre 13y ago
    It said "not redirect from http to https" -- meaning that when someone requests http://example.com http://example.com they would normally be redirected by the site owner to https://example.com https://example.com, but the attacker could just leave the original request alone. The point is that most people wouldn't notice. HTTPS Everywhere or similar browser plugin would probably pop up an alert if this did happen.
    - graue 13y ago
      HTTP Strict Transport Security[1] is designed specifically to prevent that attack. Unfortunately, Linode's manager doesn't seem to use it: $ curl -I https://manager.linode.com/ HTTP/1.1 200 OK Server: nginx/0.7.65 Date: Tue, 07 May 2013 16:23:07 GMT Content-Type: text/html;charset=UTF-8 Connection: keep-alive Vary: Accept-Encoding If they were, there would be a line like this: $ curl -sI https://github.com | fgrep Strict Strict-Transport-Security: max-age=2592000 Which tells the browser, for the next 2592000 seconds (30 days), only request github.com over HTTPS, never HTTP. Not sure why Linode isn't using HSTS — lack of awareness? The super-old version of Nginx is also a little scary. [1] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
      - TheSwordsman 13y ago
        Nginx 0.7.65 is packaged by Ubuntu for 10.04 LTS. Should still get security updates.
- jeffasinger 13y ago
  A 'simple' DNS attack would get them access to the mail servers too. There are plenty of CAs out there who will give out a (non-EV) cert to anyone who can receive emails to webmaster@example.com.

That seems somewhat scary if they've compromised domain registrars and are intercepting login data from client sites that way.

by robk 13y ago

That seems somewhat scary if they've compromised domain registrars and are intercepting login data from client sites that way.

jrockway 13y ago

It's more scary if they've compromised a SSL CA. A simple DNS attack won't stop your browser from displaying a broken certificate warning. (Though they can always not redirect from http to https and most users won't notice, sadly.)

blibble 13y ago
it's very easy to get your own https cert once you control the dns for a domain, you just set up own nameserver that proxies requests to the original NS (except very specific ones, say those from Verisign), request your "domain control validation" https cert, and bam! valid https cert!
deleted 13y ago
[deleted]
- bstpierre 13y ago
  It said "not redirect from http to https" -- meaning that when someone requests http://example.com http://example.com they would normally be redirected by the site owner to https://example.com https://example.com, but the attacker could just leave the original request alone. The point is that most people wouldn't notice. HTTPS Everywhere or similar browser plugin would probably pop up an alert if this did happen.
  - graue 13y ago
    HTTP Strict Transport Security[1] is designed specifically to prevent that attack. Unfortunately, Linode's manager doesn't seem to use it: $ curl -I https://manager.linode.com/ HTTP/1.1 200 OK Server: nginx/0.7.65 Date: Tue, 07 May 2013 16:23:07 GMT Content-Type: text/html;charset=UTF-8 Connection: keep-alive Vary: Accept-Encoding If they were, there would be a line like this: $ curl -sI https://github.com | fgrep Strict Strict-Transport-Security: max-age=2592000 Which tells the browser, for the next 2592000 seconds (30 days), only request github.com over HTTPS, never HTTP. Not sure why Linode isn't using HSTS — lack of awareness? The super-old version of Nginx is also a little scary. [1] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
    - TheSwordsman 13y ago
      Nginx 0.7.65 is packaged by Ubuntu for 10.04 LTS. Should still get security updates.
jeffasinger 13y ago
A 'simple' DNS attack would get them access to the mail servers too. There are plenty of CAs out there who will give out a (non-EV) cert to anyone who can receive emails to webmaster@example.com.