Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Taking control of all .io domains with a targeted registration

thehackerblog.com

Post reply on HN
Print view View original

211–220 of 258 posts

Re: Taking control of all .io domains with a targeted registration

#211

Post by DarkKomunalec »

3131s wrote: post #171
moo360 wrote: post #163

Earlier quoted context omitted.

Are you being deliberately obtuse? It's a pretty important distinction that these were not some native tribesmen with millennia of ancestral history tied up in the lands.

100s of years though, so from the perspective of an individual on the island it's exactly the same -- their entire life was on that island. So, the distinction is pointless and reeks of apologetics IMO. " Sir Bruce Greatbatch, KCVO, CMG, MBE, governor of the Seychelles, ordered all the dogs on Diego Garcia to be killed. More than 1000 pets were gassed with exhaust fumes. "They put the dogs in a furnace where the peop…

By that logic, ethnic Europeans are the 'original inhabitants' of North America.

I'm also unclear on why you quoted what the British did in your post - how does it relate to whether or not calling those people 'original inhabitants' is misleading? Do you believe that, if the British did something sufficiently wrong to them, that calling them 'original inhabitants' will be less misleading?

Re: Taking control of all .io domains with a targeted registration

#212

Post by paulddraper »

toyg wrote: post #206
paulddraper wrote: post #66

Earlier quoted context omitted.

The question is NOT about the morality of deportation, but about about the legitimacy of the UK's ownership. The only two nations that have laid claim to the territory are France and the United Kingdom. (France lost it in the Napoleonic Wars.)

https://youtu.be/UTduy7Qkvk8

Ha ha :)

Of course, the difference between the Indian Ocean Territory and India, is that people lived in India before. When the French showed up, the atolls were uninhabited.

Re: Taking control of all .io domains with a targeted registration

#213

Post by andai »

alexdumitru wrote: post #180
andai wrote: post #125

Earlier quoted context omitted.

Trying to figure out why you were downvoted. Was it the positivity? The exclamation marks? The lack of pretending to contribute to the conversation?

It looks like it's been written by a spam bot.

How so?

Re: Taking control of all .io domains with a targeted registration

#214

Post by andai »

chriswarbo wrote: post #133
andai wrote: post #125

Earlier quoted context omitted.

Trying to figure out why you were downvoted. Was it the positivity? The exclamation marks? The lack of pretending to contribute to the conversation?

I downvoted because it doesn't raise any questions or add any information to the discussion. BTW, neither does commenting about votes ;) As per https://news.ycombinator.com/newsguidelines.html "Please resist commenting about being downvoted. It never does any good, and it makes boring reading."

I was merely puzzled that my favorite comment was downvoted to the bottom of the thread!

I am sure the author (who appeared in the discussion here) would have appreciated the positive feedback. Are you suggesting it would have been better to contact the author directly?

Re: Taking control of all .io domains with a targeted registration

#215

Post by vertex-four »

musicnarcoman wrote: post #201
vertex-four wrote: post #157

Earlier quoted context omitted.

> These credentials were likewise not obtained by a breach of our systems and we strongly suspect they were obtained from an insecure connection to our technical partner’s web portal (the web platform in question allows access via http). This makes no sense - how did the attacker get between gandi.net and their technical partner in order to MITM them? MITMs aren't magic - simply sending an unencrypted password somewh…

> This makes no sense - how did the attacker get between gandi.net and their technical partner in order to MITM them? On the top of my head, bgp hijacking perhaps? > MITMs aren't magic No. But do not trust the network. Ever.

If it's BGP hijacking, there'll be evidence somewhere.

And no, don't trust the network, but "the network isn't trustworthy" is not a diagnosis, only a potential risk factor. "X entity used BGP hijacking to situate their router between me and Y" is a diagnosis.

Re: Taking control of all .io domains with a targeted registration

#216

Post by lightedman »

mpounsett wrote: post #136

While it's definitely an error on the part of the backend registry operator for .io, this is not the major security issue the author describes. He couldn't have hijacked any DNS traffic this way. I've written in detail about why this is the case at https://mpounsett.blogspot.ca/2017/07/the-io-error-problem-w...

"He couldn't have hijacked any DNS traffic this way."

That is entirely untrue. If I have control of the majority of DNS server routes/domains, I can hijack plenty of traffic. This is basic N+ certification-level stuff, not even advanced networking.

Re: Taking control of all .io domains with a targeted registration

#217

Post by pingiun »

LinuxBender wrote: post #161
mreithub wrote: post #50

Wow, I don't think I would've even considered such an attack... DNSSEC, HSTS and Certificate Pinning would've made it more difficult to abuse this, but I guess it would've been pretty easy to get valid SSL certificates for all your favourite .io domains. Let's try to play malicious party here: Phase A: First set up a simple DNS forwarder playing by the rules and answering requests as we should (as to not get any unwa…

If you control the root DNS servers for .io, you can simply not answer the DNSSEC queries. Many resolvers will fail open. HSTS requires the site is HTTPS with a valid cert. If you own all .io, you can use LetsEncrypt to get that for free. They now even support Wildcard Certs! :-) That said, you would have to choose your targets carefully and/or load balance your requests to LetsEncrypt. There is a rate limit. There a…

Could you get a wildcard certificate for *.io this way?

Re: Taking control of all .io domains with a targeted registration

#218

Post by LinuxBender »

jancsika wrote: post #169
LinuxBender wrote: post #161

Earlier quoted context omitted.

If you control the root DNS servers for .io, you can simply not answer the DNSSEC queries. Many resolvers will fail open. HSTS requires the site is HTTPS with a valid cert. If you own all .io, you can use LetsEncrypt to get that for free. They now even support Wildcard Certs! :-) That said, you would have to choose your targets carefully and/or load balance your requests to LetsEncrypt. There is a rate limit. There a…

So how does certificate transparency fit into all this? https://www.certificate-transparency.org/what-is-ct Let's assume an attacker who selectively hijacks .io traffic in such a magical* way that the owners of the relevant domain names do not notice the attack is happening. Assuming that, what exactly would the CT monitors notice? I assume there would be new LetsEncrypt certificates entered into the append-only log,…

That could certainly be useful in the follow-up investigation and forensics. Hopefully our attacker did not spin up those VM's using a burner card or stolen CC and proxies.

There isn't anything magical about selectively targeting domains. One simply creates multiple recursors and sets the upstream forwarder to the proper IP's of the original root servers. Then one adds zones for the domains or individual records they wish to modify. Unbound DNS is great for taking over individual records. I use it for this very purpose to block advertisements and trackers. In this case however, we are just acting as a root server, so there isn't much to take over. We just point the victims to ourselves for the domains we wish to hijack. We could then have a second level of recursors to perform the above selective attacks.

Re: Taking control of all .io domains with a targeted registration

#219

Post by LinuxBender »

pingiun wrote: post #217
LinuxBender wrote: post #161

Earlier quoted context omitted.

If you control the root DNS servers for .io, you can simply not answer the DNSSEC queries. Many resolvers will fail open. HSTS requires the site is HTTPS with a valid cert. If you own all .io, you can use LetsEncrypt to get that for free. They now even support Wildcard Certs! :-) That said, you would have to choose your targets carefully and/or load balance your requests to LetsEncrypt. There is a rate limit. There a…

Could you get a wildcard certificate for *.io this way?

I don't know if LetsEncrypt would issue that, even if you control it. That would be a good exercise to validate if there is an "easy mode" for state sponsored fun.

I've read that browsers are said to block such wildcards, but I don't know to what they are referring. I create wildcard TLD self signed certs all the time. I've never had one signed by a proper CA, so I can't tell you if the browsers have any logic to ignore them.

Post reply on HN