Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Taking Over DigitalOcean Domains via a Lax Domain Import System

thehackerblog.com

Post reply on HN
Print view View original

31–40 of 186 posts

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#31

Post by MichaelGG »

ultramancool wrote: post #23
i_have_to_speak wrote: post #21

TL;DR - If you own example.com and use DO as your nameserver, then anyone with a DO account can add DNS records for example.com.

Not quite, only one person can, so if you add first, it's yours. Typically they have you add the domain and then you switch the DNS and in that configuration you wouldn't be vulnerable at all.

It sounds like this only impacts people that weren't using their domain, eh? If I leave my NS pointing to some random provider and delete my account, I'm sorta handing off control...

At first I thought it was an issue where DO was using their own DNS servers but letting you add domains. So if Microsoft.com wasn't registered, you'd register it then all DO customer traffic would get your DNS records.

Some telcos have this. Sign up, say you're porting a number. Provide number of local bank and invalid port info. Account gets set up, telco routes their own calls to you. Port is rejected and customer service is asking for info. All while you are getting the bank's calls and forwarding them. Perfect MITM.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#32

Post by MichaelGG »

timv wrote: post #15
sattoshi wrote: post #12

Earlier quoted context omitted.

I should leave the most reliable host I had to date because someone was messing around with things he shouldn't be? DO knows people can do this, but they don't want people to do it. Remembering 2 recurring DNS servers is easier for bulk management than a bunch of different ones. You don't test services like that, it can negatively affect other users. Response wasn't perfect but it was reasonable.

> Response wasn't perfect but it was reasonable I'm sorry, "We aware that we make it easy for about 20k domains to be directed to a malicious host, but we're not going to do anything about it" is reasonable ? But of course, it's because Matt "was messing around with things he shouldn't be". It's all solved - we just need everyone to stop doing things that DO "don't want people to do".

Meh the owners of the domains gave up control by pointing to someone else's nameservers.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#33

Post by mandatory »

djhworld wrote: post #28

Very interesting read, thanks. I'm surprised at the response from Digital Ocean, did you adequately explain what you had done? The first person that replied looks like he just skim read your email or didn't understand the fact you had sinkholed a lot of traffic.

I believe I was clear about it. However sometimes my writing can be unclear so perhaps it wasn't properly understood (I assume you're talking about their security team's response and not Trust & Safety?). Kind of sad about the massive amount of hate for DigitalOcean in this thread as their security team really seemed quite nice. Their support was just acting on an anomaly they had seen so shrugs.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#34

Post by thegeekpirate »

diegorbaquero wrote: post #3

Great article! I'm saddened by DO's response and further wronging a white hat by banning you. Let's remember Linode offers 2x the RAM.

Linode has had _far_ larger issues than DO ever has. That's why I switched to DO in the first place.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#35

Post by tszming »

I think most of the providers (e.g. DO, Linode, CloudFlare etc) do not check the authority of DNS due to the chicken-and-egg problem. The AWS way to handle this issue is definitely awesome but the infrastructure required is not worth for those companies who are providing "free DNS service" as an add-on to their existing customers. Anyway, IMO, it is your fault if you point to a nameserver but not utilizing it.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#36

Post by fiatpandas »

diegorbaquero wrote: post #3

Great article! I'm saddened by DO's response and further wronging a white hat by banning you. Let's remember Linode offers 2x the RAM.

>white hat

Gray hat. (Still doesn't justify the idiotic response from DO security team)

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#37

Post by nicolas_t »

cyphar wrote: post #30
zatkin wrote: post #19

Earlier quoted context omitted.

Do you know of an alternative that can host an instance of FreeBSD?

I believe Vultr offers FreeBSD (and custom ISO) hosting at about the same price and offers storage servers too. Their documentation and remote console tools leave a lot to be desired though (I wanted to install openSUSE and ended up resorting to manually entering the iPXE commands at a console to get the damn thing installed).

Their support also leaves a lot to be desired. Had a persistent network problem due to a misconfiguration of their system and it took two weeks of back and forth before they really looked into it.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#38

Post by [deleted] »

cyphar wrote: post #30
zatkin wrote: post #19

Earlier quoted context omitted.

Do you know of an alternative that can host an instance of FreeBSD?

I believe Vultr offers FreeBSD (and custom ISO) hosting at about the same price and offers storage servers too. Their documentation and remote console tools leave a lot to be desired though (I wanted to install openSUSE and ended up resorting to manually entering the iPXE commands at a console to get the damn thing installed).

[deleted]

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#40

Post by jsmthrowaway »

tszming wrote: post #35

I think most of the providers (e.g. DO, Linode, CloudFlare etc) do not check the authority of DNS due to the chicken-and-egg problem. The AWS way to handle this issue is definitely awesome but the infrastructure required is not worth for those companies who are providing "free DNS service" as an add-on to their existing customers. Anyway, IMO, it is your fault if you point to a nameserver but not utilizing it.

The random nameservers are only accidentally a defense against this attack. They're avoiding SPOFs, including TLDs -- you never receive nameservers in the same TLD for example. It's a reliability and scaling consideration with this accidental benefit.

Most admins don't think about a complete TLD failure. Amazon did.

Post reply on HN