Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hijack of Amazon’s domain service used to reroute web traffic for two hours

doublepulsar.com

Post reply on HN
Print view View original

51–60 of 291 posts

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#51

Post by bklyn11201 »

EE84M3i wrote: post #45
bklyn11201 wrote: post #38

Getting a basic certificate issued is incredibly easy these days. If you own the DNS resolution, you can get a cert. Here a few ways I can think of to make this harder for an attacker: * Add a Strict-Transport-Security to all HTTPS requests. This means the attacker will need to get a valid cert (still easy if you can hijack BGP). * Pick a preferred SSL issuer and stick with them. Add a CAA DNS record only allowing th…

Forgive my ignorance but I have a few questions: * Why would HSTS help in this case? While HSTS is active, does it prevent clicking through the warning (which was done here)? * How would a CAA record help against cert issuance in this case? Is it only helping against compromise of the authoritative during the remaining TTL of the record in recursives AND if the CAA record points to something that doesn't have on-dema…

HSTS wouldn't help users clicking through warnings, but it's a good thing to have (myetherwallet doesn't use HSTS).

CAA record would only help in remaining TTL. Once expired, then it doesn't matter.

So yeah, these seem like decent steps to help protect but certainly not going to 100% prevent an attack like this one.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#52

Post by ohiovr »

0xbadcafebee wrote: post #14

This same attack can be used to generate valid TLS certs for any website, for example using Let's Encrypt. The best part? Your target doesn't need to use Let's Encrypt at all. Anyone can use them to forge certs for any domain . Of course, this is possible with most other cert providers, but Let's Encrypt automates it. So.... TLS certs mean jack squat if you can pull off a BGP+DNS attack. You might want to start pinni…

I noticed this while setting up some hobby servers that as long as my ip agreed with dns I could get a cert from lets encrypt.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#54

Post by 24gttghh »

jerf wrote: post #41
24gttghh wrote: post #27

Earlier quoted context omitted.

Excuse my ignorance but how does this allow someone to forge TLS certs for a given website/domain name that already has active certs? Wouldn't they have to revoke existing certs and then get new ones during the attack to pull this off?

Step one: Hijack the DNS entries so they point at your site. Step two: Obtain a certificate from Let's Encrypt using website validation. Step three: Proxy traffic through a proxy you provide that SSL cert for and capture anything you like. In the event that a website legitimately has a higher-class Extended Validation cert or other such thing, hope users don't notice the downgrade from Extended Validation correct SSL…

For some reason I thought CA's at least talked to each other to see if someone else had issued a valid cert for a given domain along the lines of owning a domain name itself through a registrar. Clearly that only works when DNS isn't being abused like this...

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#55

Post by DividableMiddle »

bklyn11201 wrote: post #51
EE84M3i wrote: post #45

Earlier quoted context omitted.

Forgive my ignorance but I have a few questions: * Why would HSTS help in this case? While HSTS is active, does it prevent clicking through the warning (which was done here)? * How would a CAA record help against cert issuance in this case? Is it only helping against compromise of the authoritative during the remaining TTL of the record in recursives AND if the CAA record points to something that doesn't have on-dema…

HSTS wouldn't help users clicking through warnings, but it's a good thing to have (myetherwallet doesn't use HSTS). CAA record would only help in remaining TTL. Once expired, then it doesn't matter. So yeah, these seem like decent steps to help protect but certainly not going to 100% prevent an attack like this one.

wait, myetherwallet doesn't use HSTS? I thought they had a vulnerability analysis done a few months ago. I feel like this should have been something that was caught.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#56

Post by cowkingdeluxe »

omarforgotpwd wrote: post #43

Wow. Just wow. These BGP vulnerabilities are ridculous. Imagine, someone taking over DNS for even a small subset of people and being able to basically just rewrite the internet as they see fit, completely taking control of anything. Even without being able to get a valid SSL certificate you could do a lot of damage. For example, let's say I rewrote requests for SomeNationalBank.com to my proxy server. I make a reques…

How similar was this to the BGP attack by Russia in late 2017?

https://arstechnica.com/information-technology/2017/12/suspi...

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#57

Post by knome »

omarforgotpwd wrote: post #43

Wow. Just wow. These BGP vulnerabilities are ridculous. Imagine, someone taking over DNS for even a small subset of people and being able to basically just rewrite the internet as they see fit, completely taking control of anything. Even without being able to get a valid SSL certificate you could do a lot of damage. For example, let's say I rewrote requests for SomeNationalBank.com to my proxy server. I make a reques…

DNSSEC adoption would prevent a hijacker from manipulating responses.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#58

Post by jimktrains2 »

lifeisstillgood wrote: post #35

Can I check my understanding (Somehow) A BGP route was advertised and accepted for the IP range for amazons route53 - so that some / many DNS requests hit a fake server instead of the real amazon one. The only dns requests that changed seem to be for a bitcoin site, and they were redirected to a site that seems to have then grabbed their passwords and then emptied their wallets on the real site. ? Mitigation strategi…

> surely browsers should shout of a certificate that was valid for domain X changes today

Why? If the new cert is valid, why sound any alarms?

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#59

Post by isostatic »

rgbrenner wrote: post #2

A website I own was affected by this. I got an alert from our monitoring saying the website was down for 1hr 2min 59sec. Luckily, they didn't redirect it to anything. I have other domains using Route53 (and hosted at AWS, just like this one).. that weren't affected AFAICT.

> I got an alert from our monitoring saying the website was down for 1hr 2min 59sec.

That's a very accurate time. What system do you use to allow sampling at under 1 second intervals? My nagios boxes poll every minute, so an outage could be 2 seconds, or nearly 2 minutes, and nagios would report the downtime as 1 minute.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#60

Post by an_account_name »

peterwwillis wrote: post #39
vertex-four wrote: post #32

Earlier quoted context omitted.

The solution to this is the CAA issue record combined with DNSSEC. DNSSEC ensures that an attacker can't spoof your DNS even if they have your DNS traffic directed to them globally, and then CAA ensures that only the issuers you want can create certificates for your domain. This is a solved problem, it just requires caring about it.

CAA depends on CAs (all 650 of them) to respect it, and for all of them to implement everything perfectly (it was shown in 2017 that they don't). This also depends on DNS again, which again not everyone will do properly, so CAA requests from CAs can be hijacked. So CAA is stupid. The client should be getting the list of authorized CAs for the domain from DNS on first connection, and/or from inside the first cert, wit…

CAA support wasn't mandatory for WebPKI CAs until 2017-09-08 so it's likely that it's better supported now than it was last year.
Post reply on HN