As an aside, you can set up a security group in AWS that blocks inbound traffic on port 80 if you'd like to neuter the incoming requests.
Taking Over DigitalOcean Domains via a Lax Domain Import System
71–80 of 186 posts
Re: Taking Over DigitalOcean Domains via a Lax Domain Import System
#72TO: ANY DIGITAL-OCEAN USER, This is an absolutely terrible response from DO. If I had anything hosted here, I'd move away ASAP. Seriously, do it.
Already thinking about it.
Re: Taking Over DigitalOcean Domains via a Lax Domain Import System
#73Banning his account was totally unjustified since he approached them first with the issue. A less ethical person could have tried to make money or sold this off on the back market. People like him should be rewarded not have their accounts banned. For all we know he just saved DO a lot of headache in sorting this issue had it gone wrong. I really wish the response from DO on this was different.
Adding 20k domains to your account is probably enough to flag as abuse even if you own the domains. Next time the author should probably try just the one or two. Bonus points if they're their own domains.
Re: Taking Over DigitalOcean Domains via a Lax Domain Import System
#74Bye bye digitalocean - account deletion request submitted 1178917. When you have reckless people like Cashan Stine (trust & safety specialist - WTF is that title? sounds like a road safety officer?) that close accounts due to a security report then it won't win any business from me or my clients.
Re: Taking Over DigitalOcean Domains via a Lax Domain Import System
#75TO: ANY DIGITAL-OCEAN USER, This is an absolutely terrible response from DO. If I had anything hosted here, I'd move away ASAP. Seriously, do it.
[deleted]
Re: Taking Over DigitalOcean Domains via a Lax Domain Import System
#76Earlier quoted context omitted.
I have an account with DigitalOcean (and several competitors) and I'm not going anywhere or moving any sites around because of this. Sure, they could have handled things better and the security researcher could have too. I don't see any malice or incompetence here, nor do I see a reason to make the effort to switch to another provider. Where are you going to run off to? How is their security better over there? How ma…
Allowing adding a domain without verifying ownership, and banning someone who reported a security issue isn't incompetence? I think you're looking more kindly on their security practices than most folks in the security world would.
Banning someone who added 20k domains to their account. There's a difference between reporting a security issue and blatantly abusing their services.
Re: Taking Over DigitalOcean Domains via a Lax Domain Import System
#77Something similar happened to me a few months ago with Cloudflare. I set up a new domain to use Cloudflare's nameservers but did not immediately get around to setting it up on the admin panel. By the time I wanted to add the domain, someone else had already grabbed it and set up some sort of spam page.
Took a few emails to Cloudflare support to resolve this one. They also didn't seem to care much about the security implications when I questioned them about it.
So this is far from a DO-specific issue...
Re: Taking Over DigitalOcean Domains via a Lax Domain Import System
#78"I was walking down the street and I noticed your house wasn't locked very well. So I stole all your stuff and put it in my own house.
Now I'm in prison because of this so it's really hard for me to put it back."
The article writer is an idiot. He deliberately stole accounts because he could. Just because he then decided to blame the provider because he was able to do this does't make it any more defensible.
If I mug you in the street, should I then post that because I was able to do so it's all your fault? No. I'd go to prison....
Re: Taking Over DigitalOcean Domains via a Lax Domain Import System
#79Earlier quoted context omitted.
Linode has had _far_ larger issues than DO ever has. That's why I switched to DO in the first place.
Same here. Please stay away from Linode. They used to be good. Now they are unprofessional and unethical.
I'm a new Linode user (as of this week) and have been happy so far. What are these problems you talk about? I'd like to know before I commit further.
Re: Taking Over DigitalOcean Domains via a Lax Domain Import System
#80this post raises questions: Was there a realization into how legitimate users may be affected by this action? Was there a plan to remove those domains from their account after making and disclosing their proof of concept? Why not stop at 10 or 20, and then alert DO to the findings? 20 thousand was unnecessary.
How does making a domain that does not resolve suddenly resolve negatively impact a user, again? The domain could not have possibly been operational before the circumstances that brought about this scenario, and there is no legitimate traffic they could possibly be receiving. DigitalOcean could certainly improve authentication here but there are dozens of authoritative services that do not, and this is not a new prob…
> How does making a domain that does not resolve suddenly resolve negatively impact a user, again?
Adding 20k domains to your nameservers at once might cause issues in resolution while it catches up with itself which will affect other users using the DNS service. It shouldn't on DO's scale, but it might. This is why the whole thing isn't a "white hat" situation, the author tested without thinking of potential consequences.