3 ms·
EDIT: Won't work: You need to verify that you own the domain by pointing your NS records to cloudflares nameservers. What prevents me from doing this MITM atta
by dividuum 12y ago
EDIT: Won't work: You need to verify that you own the domain by pointing your NS records to cloudflares nameservers.
What prevents me from doing this MITM attack in (for example) a public wifi: I add a domain I don't own (example.com) to my cloudflare account. Then I point a hostname (www.example.com) to an IP address I own (1.2.3.4).
From what I understand, cloudflare now serves HTTPS for this domain through their proxies. I can easily find out the IP of one of those by querying the nameserver they assiged me by doing "dig www.example.com @gene.ns.cloudflare.com".
Now when I spoof DNS responses, I can return one of those IPs. The traffic will go to cloudflare. They have a signed certificate for that domain and the traffic gets forwarded to my IP (1.2.3.4).
Maybe I'm missing something, but I tried the http part of this and proxying seems to work before cloudflare comfirmed that the (in the example) example.com domains nameserver actually points to cloudflares nameservers.
- iancarroll 12y agoThat wouldn't work. CloudFlare isn't acting as the RA (the person verifying you own example.com). They serve a verification file at example.com, but the bot cannot see this file as example.com isn't pointing to CloudFlare.
- dividuum 12y agoNot sure I'm following you. Probably because I didn't use SSL on cloudflare before, so I don't know about any verification file. How does that work? I guess before serving SSL traffic for a domain they verify both that the nameserver for a domain is actually one of cloudflares nameservers AND they test for the presence of some kind of signed file that has to be reachable on the domain you added?
- deleted 12y ago[deleted]
- dividuum 12y agoUnderstood. But how does that work in cloudflares case? Since they magically upgrade 2 million websites by the end of the day I cannot imagine all those sites have those verification files available.
- pmh 12y agoSorry, I deleted my comment since I thought the issue was better explained/covered downthread: https://news.ycombinator.com/item?id=8382419 https://news.ycombinator.com/item?id=8382419 As for spoofing the DNS record, I was under the impression that you switched your domain's nameservers to point at Cloudflare and that's what's used to verify that you control the domain.
- nknighthb 12y agoUh, CloudFlare controls all the traffic between your site and the world. They can automatically put whatever they want wherever they want on your site.
- innocenat 12y agoThe verification file are needed by CA issueing cert. I don't think said CA are on your spoofed wifi.
- fiedzia 12y agoI am pretty sure Cloudflare will verify that you are owner of the domain.
- dividuum 12y agoI hope so. But I'm still trying to figure out how. The only way I see they do it is that they check that the nameservers responsible for the domain actually points to cloudflares nameservers. This check doesn't seem to happen for http traffic, so it would be interesting to see how that works with https.
- fiedzia 12y agoNot sure about cloudflare, as I never used them, but typically such services will ask you to create some subdomain (ie. cf1234.example.com).
- dylz 12y agoIn this case, after you move DNS over, Cloudflare can transparently send a /VALID-FILE-3249fujej.txt on the root or temporarily add an A/TXT/CNAME record for verification that lasts a few seconds.
- jgrahamc 12y agoThis won't work because you don't control example.com. If you sign up for CloudFlare and tell us you do your site will be in an 'unverified' state until you move DNS to us. You won't be able to move DNS to us and so the CA process won't be able to issue a certificate.
- dividuum 12y agoThanks for the response. So this validation is required before you issue certificates? I was concerned there because non-https traffic seems to be able to use cloudflare before verification.