Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Taking control of all .io domains with a targeted registration

thehackerblog.com

Post reply on HN
Print view View original

161–170 of 258 posts

Re: Taking control of all .io domains with a targeted registration

#161

Post by LinuxBender »

mreithub wrote: post #50

Wow, I don't think I would've even considered such an attack... DNSSEC, HSTS and Certificate Pinning would've made it more difficult to abuse this, but I guess it would've been pretty easy to get valid SSL certificates for all your favourite .io domains. Let's try to play malicious party here: Phase A: First set up a simple DNS forwarder playing by the rules and answering requests as we should (as to not get any unwa…

If you control the root DNS servers for .io, you can simply not answer the DNSSEC queries. Many resolvers will fail open.

HSTS requires the site is HTTPS with a valid cert. If you own all .io, you can use LetsEncrypt to get that for free. They now even support Wildcard Certs! :-) That said, you would have to choose your targets carefully and/or load balance your requests to LetsEncrypt. There is a rate limit. There are browser plugins that can tell you if a cert just changed, assuming you have been to that site prior.

Then there is Public Key Pinning. This would be great, but I suspect the number of big companies implementing this are low. I don't have numbers, but you can test your favorite sites in Qualys[1] or using testssl.sh[2] that only depends on openssl and bash.

You could proxy all requests to the real root servers for .io and only become authoritative for the ones you wish to target.

Given the small number of zones, I think a modest server could keep up, or you could balance the load on a bunch of VM's. It may take a while for anyone to notice. I am curious actually, how many fellow geeks have nagios/sensu alerts that would tell them if the root server IP's changed.

All of this said, there are BGP attacks you can do that accomplish the same thing for any TLD and the IP's wouldn't even have to change. Only more advanced monitoring tools that keep an eye on route path might notice, but probably would not alert anyone.

[1] https://www.ssllabs.com/ssltest/index.html [2] https://github.com/drwetter/testssl.sh

Re: Taking control of all .io domains with a targeted registration

#162

Post by [deleted] »

mpounsett wrote: post #136

While it's definitely an error on the part of the backend registry operator for .io, this is not the major security issue the author describes. He couldn't have hijacked any DNS traffic this way. I've written in detail about why this is the case at https://mpounsett.blogspot.ca/2017/07/the-io-error-problem-w...

[deleted]

Re: Taking control of all .io domains with a targeted registration

#163

Post by moo360 »

nimchimpsky wrote: post #160
venning wrote: post #54

Earlier quoted context omitted.

> an important distinction That it is a distinction is important to me. Having difficult discussions is made more difficult if we obscure facts or conflate terms. > more acceptable I applied no normative judgement.

> That it is a distinction is important to me. Why ?

Are you being deliberately obtuse? It's a pretty important distinction that these were not some native tribesmen with millennia of ancestral history tied up in the lands.

Re: Taking control of all .io domains with a targeted registration

#164

Post by jsjohnst »

Symbiote wrote: post #104
mcv wrote: post #103

Earlier quoted context omitted.

Still, why does the UK need a special TLD for a naval base?

Because the domain name system uses ISO-8859, which provides codes for "countries, territories and islands". The standard provides codes for such places since different law often applies in territories and on islands. (See also: UM, TW, EH, AQ, SH, SJ, and many others.)

I think you mixed up your ISOs. ISO-8859 is for 8bit character encodings.

Re: Taking control of all .io domains with a targeted registration

#165

Post by CydeWeys »

bad_user wrote: post #113
CydeWeys wrote: post #53

Earlier quoted context omitted.

I'm in the TLD space (we run a fair number of gTLDs). If a gTLD operator screwed up like this then there could be consequences. A ccTLD, however, runs with very few restrictions. I don't see much of consequence happening to it as a result of this. I will, however, say that gTLDs are generally more secure and well-run than smaller ccTLDs, and are worth preferring for that reason. It's a weird historical quirk that .io…

Besides the old .org, what better options are there for software projects?

We have .dev and .foo, which seem like they'd be good options, but neither are available for open registration. Sorry :(

Re: Taking control of all .io domains with a targeted registration

#166

Post by moo360 »

Symbiote wrote: post #104
mcv wrote: post #103

Earlier quoted context omitted.

Still, why does the UK need a special TLD for a naval base?

Because the domain name system uses ISO-8859, which provides codes for "countries, territories and islands". The standard provides codes for such places since different law often applies in territories and on islands. (See also: UM, TW, EH, AQ, SH, SJ, and many others.)

I think you mean ISO-3166-1, ISO-8859 is a standard for character encoding eg: latin1 (which is probably why you know it).

Re: Taking control of all .io domains with a targeted registration

#167

Post by mandatory »

mpounsett wrote: post #136

While it's definitely an error on the part of the backend registry operator for .io, this is not the major security issue the author describes. He couldn't have hijacked any DNS traffic this way. I've written in detail about why this is the case at https://mpounsett.blogspot.ca/2017/07/the-io-error-problem-w...

Author here, responding here like I did on Twitter. DNS resolver implementations matter here greatly. I received so many DNS queries (without me actually responding to any of them) that I quickly filled up my VPS with gigabytes of data from IP addresses of DNS resolvers across the Internet.

Saying "this is not the major security issue the author describes. He couldn't have hijacked any DNS traffic this way." seems a bit dishonest. You're saying that you have personally vetting all the DNS implementations of various DNS resolvers and have verified all of them take the resolution steps you've described exactly? If this is the case why did I receive so many queries (such as A, AAAA for the NS hostnames - which I assumed/assume was to cached these IP addresses for future resolution of the TLD's IPs). The way dig resolves things is different from how many production resolvers would do so, etc.

I can certainly see that some resolvers may take different steps for resolution which would make them unaffected by this issue (I'd have to think on it some more). A big issue here is of course that I didn't actually attempt to poison a bunch of the DNS resolvers which were hitting my server because I didn't want to affect any actual users. "Proving the point" in this case would've been dangerous and probably illegal as well.

That being said, mapping out how various DNS resolvers would perform their full resolution is an interesting side project and I've added it to my TODO list :)

Re: Taking control of all .io domains with a targeted registration

#168

Post by swetabhsuman8 »

REGISTRATION STARTED FOR HACKERS BASIC EXAM https://hackernucleus.com/registration-for-hbe/

HACKERS ARE USING THIS NEW ATTACK METHOD TO TARGET POWER COMPANIES https://hackernucleus.com/hackers-are-using-this-new-attack-...

BEST HACKING TOOLS OR SOFTWARE WITH EXPLANATION https://hackernucleus.com/best-hacking-tools-or-software-wit...

Re: Taking control of all .io domains with a targeted registration

#169

Post by jancsika »

LinuxBender wrote: post #161
mreithub wrote: post #50

Wow, I don't think I would've even considered such an attack... DNSSEC, HSTS and Certificate Pinning would've made it more difficult to abuse this, but I guess it would've been pretty easy to get valid SSL certificates for all your favourite .io domains. Let's try to play malicious party here: Phase A: First set up a simple DNS forwarder playing by the rules and answering requests as we should (as to not get any unwa…

If you control the root DNS servers for .io, you can simply not answer the DNSSEC queries. Many resolvers will fail open. HSTS requires the site is HTTPS with a valid cert. If you own all .io, you can use LetsEncrypt to get that for free. They now even support Wildcard Certs! :-) That said, you would have to choose your targets carefully and/or load balance your requests to LetsEncrypt. There is a rate limit. There a…

So how does certificate transparency fit into all this?

https://www.certificate-transparency.org/what-is-ct

Let's assume an attacker who selectively hijacks .io traffic in such a magical* way that the owners of the relevant domain names do not notice the attack is happening. Assuming that, what exactly would the CT monitors notice? I assume there would be new LetsEncrypt certificates entered into the append-only log, but then what?

Edit: added word magical for clarity

Post reply on HN