Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Taking Over DigitalOcean Domains via a Lax Domain Import System

thehackerblog.com

Post reply on HN
Print view View original

81–90 of 186 posts

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#81

Post by TheCowboy »

jbb555 wrote: post #78

"I was walking down the street and I noticed your house wasn't locked very well. So I stole all your stuff and put it in my own house. Now I'm in prison because of this so it's really hard for me to put it back." The article writer is an idiot. He deliberately stole accounts because he could. Just because he then decided to blame the provider because he was able to do this does't make it any more defensible. If I mug…

Comparisons of events like this to violent crime often seem inaccurate.

A better comparison is removing 10 people's lunch money from their school lockers, maybe due to a careless sequential scheme of creating combinations, and giving the money back. And doing this before talking to the principal or any teacher.

Either way, he still should have contacted them before.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#82

Post by SixSigma »

jbb555 wrote: post #78

"I was walking down the street and I noticed your house wasn't locked very well. So I stole all your stuff and put it in my own house. Now I'm in prison because of this so it's really hard for me to put it back." The article writer is an idiot. He deliberately stole accounts because he could. Just because he then decided to blame the provider because he was able to do this does't make it any more defensible. If I mug…

> Theft is defined as the physical removal of an object that is capable of being stolen without the consent of the owner and with the intention of depriving the owner of it permanently.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#83

Post by wongarsu »

IanCal wrote: post #46
arkadiyt wrote: post #14

Earlier quoted context omitted.

Domains can only be added if they are not in another account, so he added only domains which were previously deleted but still pointed to DO nameservers (hence almost certainly not being used). And if DO was really concerned about the damage then they would have removed the added A records, but they didn't, they banned the author and continued to let all traffic go to his server.

> (hence almost certainly not being used) Well they were still being accessed by real people. > And if DO was really concerned about the damage then they would have removed the added A records, but they didn't, they banned the author and continued to let all traffic go to his server. Both seem reasonable. And it does sound like the security team are actually doing something about it. > I reached out to DigitalOcean’s…

> Banning an account because you saw it make 20k requests to your API adding domains seems pretty reasonable, and it was a few hours before they reached out. If you saw that activity, would you ban the account or leave it open hoping that they'd be doing something nice and reach out?

If I was a domain reseller, adding my 20k domains to digital ocean just to get banned without warning, explaination or option for reconsideration I would be rightfully upset. If they didn't want people adding large numbers of domains they could just have limited the feature instead of banning people who reach some arbitrary threshold.

If on the other hand the department that executed the ban knew that the registrations weren't made by the domain owners, they should be discussing such a huge incident with the security team. That discussion would naturally lead to them knowing about the specifics of this case, unless this case wasn't widely shared in the security team.

So the options are:

1. Digital Ocean bans legitimate customers without warning or option for reconsideration; for no obvious reason

2. Big security incidents don't get reported to the security team

3. The responsible people thought that this was not a big security incident

4. This incident wasn't discussed in the security team

5. They knowingly banned a white hat hacker (who may or may not have gone too far)

Of all those options, the last one is by far the one that looks best for Digital Ocean.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#84

Post by ultramancool »

timv wrote: post #55
ultramancool wrote: post #26

Earlier quoted context omitted.

Except this isn't even a vulnerability, this is expected behavior given the design I think, to encounter an issue with it, you'd need to leave your domain with DO's nameservers, but delete it from your account. This would only happen if it's something you're not using anymore, or if you're a severely terrible admin.

> this isn't even a vulnerability, this is expected behavior given the design Those aren't mutually exclusive. It's certainly possible to be broken by design. > This would only happen if it's something you're not using anymore From the writeup it seems like it would also happen if you registered a new domain and assigned the DO name-servers but didn't immediately point it to something.

Typically when registering a new domain you add it on your panel first and then change the NS as instructed. If you didn't follow that order, well, that's on you. It's the same design just about everyone providing DNS uses (CloudFlare, XName, FreeDNS, probably others).

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#85

Post by T2_t2 »

TheCowboy wrote: post #81
jbb555 wrote: post #78

"I was walking down the street and I noticed your house wasn't locked very well. So I stole all your stuff and put it in my own house. Now I'm in prison because of this so it's really hard for me to put it back." The article writer is an idiot. He deliberately stole accounts because he could. Just because he then decided to blame the provider because he was able to do this does't make it any more defensible. If I mug…

Comparisons of events like this to violent crime often seem inaccurate. A better comparison is removing 10 people's lunch money from their school lockers, maybe due to a careless sequential scheme of creating combinations, and giving the money back. And doing this before talking to the principal or any teacher. Either way, he still should have contacted them before.

A better analogy is "I found a dollar on the ground". I'm not sure that is really a crime!

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#86

Post by mortar »

athrun wrote: post #56
mixedbit wrote: post #49

Amazon S3 has similar problems. To host static website you need use your domain name as the S3 bucket name. Amazon does not verify ownership of your domain, and bucket names use global namespace. Someone can easily block you from using S3 static website hosting by adding a bucket with your domain name before you do. Also if you delete a bucket and do not change your DNS, someone can recreate the bucket and will be se…

As a best practice, use a 'normal' name for your S3 bucket and then put Cloudfront in front of your S3 website. This way you are not limited by bucket names and you also avoid any SSL validation errors. Note: you can set Cloudfront's TTL to 0 if you don't need any caching.

This is certainly good practice as long as anyone contemplating this considers the cost implications versus serving from S3 directly.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#90

Post by ilogik »

jsmthrowaway wrote: post #45
flexd wrote: post #6

This doesn't help my impression of Digital Ocean at all (even if I am a paying customer currently). A few years ago you could impersonate Digital Ocean staff on their support pages with no effort. They grabbed the username from your email, so whatever you put in front of the @ becamse your username on the forums, visible to everyone. And the avatar came from one of those email->avatar services where you can sign up a…

I can think of at least Cloudflare (somewhat), Linode, and Hurricane Electric off the top of my head. Anybody who operates a well-known ns1 type of resolver. It's more a problem with zone hygiene than hosts, honestly.

Cloudflare does something similar to AWS. Each user gets different nameservers
Post reply on HN