Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hijack of Amazon’s domain service used to reroute web traffic for two hours

doublepulsar.com

Post reply on HN
Print view View original

11–20 of 291 posts

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#11

Post by polpo »

conistonwater wrote: post #9

> This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers. What does this sentence mean? Sorry if I'm being slow. I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control, so messing with name resolution wouldn't affect it.

It means just that. Since they had control of DNS, they could have easily gotten a DV certificate, but in this case, they didn't and people clicked through certificate warnings.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#12

Post by kodablah »

conistonwater wrote: post #9

> This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers. What does this sentence mean? Sorry if I'm being slow. I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control, so messing with name resolution wouldn't affect it.

Maybe they didn't mean "fake certificate" as we think of it. Maybe they meant a valid certificate that they got from something like LE since they could show they hosted the domain (via the DNS check or the HTTP check).

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#13

Post by ceejayoz »

conistonwater wrote: post #9

> This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers. What does this sentence mean? Sorry if I'm being slow. I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control, so messing with name resolution wouldn't affect it.

They rerouted DNS traffic, which would've let them point the domain at their own servers, which would've let them successfully get a new SSL certificate.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#14

Post by 0xbadcafebee »

This same attack can be used to generate valid TLS certs for any website, for example using Let's Encrypt. The best part? Your target doesn't need to use Let's Encrypt at all. Anyone can use them to forge certs for any domain. Of course, this is possible with most other cert providers, but Let's Encrypt automates it.

So.... TLS certs mean jack squat if you can pull off a BGP+DNS attack. You might want to start pinning certs for your bank's website. (but not using HPKP, Google is removing it from Chrome)

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#15

Post by JelteF »

conistonwater wrote: post #9

> This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers. What does this sentence mean? Sorry if I'm being slow. I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control, so messing with name resolution wouldn't affect it.

Usually yes, but that's only the case if you try to spoof DNS/routing for end users. If you can fake the DNS/routing for the certificate registrars you can trick them in giving you a certificate.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#16

Post by jbergstroem »

zegl wrote: post #8

We experienced the same thing. DNS lookups via Googles public DNS servers where failing for one of our hosted zones. Interestingly this only seemed to be a problem with Google DNS, other large providers as well as smaller ones where not affected.

As I mentioned in the previous thread; DNS lookups via Azure also seemed to be affected.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#17

Post by fernandotakai »

zegl wrote: post #8

We experienced the same thing. DNS lookups via Googles public DNS servers where failing for one of our hosted zones. Interestingly this only seemed to be a problem with Google DNS, other large providers as well as smaller ones where not affected.

we saw the same thing. dns stopped resolving while using google's dns for about 2h.

there's a route53 status update on their page that says basically that -- only affected google dns.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#18

Post by bklyn11201 »

conistonwater wrote: post #9

> This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers. What does this sentence mean? Sorry if I'm being slow. I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control, so messing with name resolution wouldn't affect it.

Certificates can be issued with simple domain validation. If you can receive an email directed to webmaster@crypto.com, you can get a valid cert. So if you can put up a fake DNS server to impersonate Amazon's DNS servers and then start receiving traffic meant for Amazon (BGP route hijacking), you can accomplish domain validation to receive an illegitimate certificate.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#19

Post by geocar »

bklyn11201 wrote: post #18
conistonwater wrote: post #9

> This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers. What does this sentence mean? Sorry if I'm being slow. I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control, so messing with name resolution wouldn't affect it.

Certificates can be issued with simple domain validation. If you can receive an email directed to webmaster@crypto.com, you can get a valid cert. So if you can put up a fake DNS server to impersonate Amazon's DNS servers and then start receiving traffic meant for Amazon (BGP route hijacking), you can accomplish domain validation to receive an illegitimate certificate.

Or by controlling the IP (as with letsencrypt)

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#20

Post by polpo »

polpo wrote: post #11
conistonwater wrote: post #9

> This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers. What does this sentence mean? Sorry if I'm being slow. I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control, so messing with name resolution wouldn't affect it.

It means just that. Since they had control of DNS, they could have easily gotten a DV certificate, but in this case, they didn't and people clicked through certificate warnings.

Here's a source on Twitter showing some documentation of the self-signed certificate that myetherwallet.com users ignored warnings about: https://twitter.com/GossiTheDog/status/988785871188045825
Post reply on HN