Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hijack of Amazon’s domain service used to reroute web traffic for two hours

doublepulsar.com

Post reply on HN
Print view View original

131–140 of 291 posts

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#131

Post by isostatic »

outworlder wrote: post #79
isostatic wrote: post #59

Earlier quoted context omitted.

> I got an alert from our monitoring saying the website was down for 1hr 2min 59sec. That's a very accurate time. What system do you use to allow sampling at under 1 second intervals? My nagios boxes poll every minute, so an outage could be 2 seconds, or nearly 2 minutes, and nagios would report the downtime as 1 minute.

They could be alerting based on metrics, instead of "pinging" the site.

Yes, if the site serves up lots of traffic (multiple hits per second), then the hole in the logs would certainly give an indication.

I get very suspicious when people quote things accurate to 1 part in 1000

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#132

Post by ryanlol »

balls187 wrote: post #120
ryanlol wrote: post #102

Earlier quoted context omitted.

>by Russia Sounds like xenophobic bullshit.

More correct to say "Russian Government"

The correct thing to say is “ISP in Russia”, could be Norwegian hackers using their routers for all you know.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#133

Post by 7ewis »

How would you see this in ThousandEyes? I see he has a screenshot of it in the post, and doesn't appear to be logged in.

Was troubleshooting this for the two hours, until I started reading reports of the BGP leak. Not in networking, so don't fully understand how it works.

I'd just like to know how to troubleshoot this in the future, and check for leaks, if any. Are there any other online tools I could use? Obviously don't have an edge router or anything like that.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#134

Post by raldi »

tptacek wrote: post #108
knome wrote: post #57

Earlier quoted context omitted.

DNSSEC adoption would prevent a hijacker from manipulating responses.

No, it wouldn't. It comically wouldn't: in a BGP hijacking attack, the attackers control IP. It doesn't matter what your signed DNS record points to; attackers will just make that address theirs.

Wouldn't https://tools.ietf.org/html/rfc4025 and https://tools.ietf.org/html/rfc4398 cover those cases?

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#135

Post by ohiovr »

kolpa wrote: post #31
reaperducer wrote: post #3

How do we know it was unnoticed? It could very well have been noticed and taken two hours for Amazon to mitigate it. I don't know the technical process behind making such a correction, but in any large organization there are steps that have to be followed. It's not like some kid typing out a shell command on his basement Linux box. Inflammatory/clickbait headlines do not make the internet a better place.

If no one mentioned this important outage, it's likely that many/most/all people didn't notice.

How big was the attack? You can't fool all the people all the time. But fooling all their targets for even 30 minutes is a significant achievement considering what info they could have obtained. What do we know about the victims? What reason do we have for believing it was a random victim attack? Besides the insane difficulty part..

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#136

Post by jakasto »

tptacek wrote: post #124
AndyMcConachie wrote: post #115

Earlier quoted context omitted.

I think in this instance DNSSEC would have prevented the entire attack. If I understand the sequence of events correctly, the route hijack was done to the auth DNS servers hosting myetherwallet.com. Then these rogue DNS servers redirected users to a fake myetherwallet.com. If myetherwallet.com had been DNSSEC signed then users who validated the signature chain would have not been redirected to the fake site. But it's…

In a BGP hijacking attack against a DNSSEC-signed zone, the attacker just looks at which IP address is in the signed A record, and then injects that prefix. Note that "the auth servers hosting myetherwallet.com" aren't some random IP addresses in Tallinn, Estonia. It's Route53! I get what you're saying with your counterfactual, that DNSSEC "breaks the exploit", requiring the attackers to use a slightly different expl…

If I understand the discussion correctly, I think tptacek is right but he's not explaining his position well, which might be why he's been downvoted.

I think he's saying: let's say the correct IP address for example.com is 192.0.2.80. Instead of hijacking the prefix containing example.com's nameservers, an attacker could just hijack 192.0.2.0/24 and immediately get a DV cert. Within seconds they would be up and running and DNSSEC wouldn't have done a thing to prevent it.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#138

Post by tptacek »

raldi wrote: post #134
tptacek wrote: post #108

Earlier quoted context omitted.

No, it wouldn't. It comically wouldn't: in a BGP hijacking attack, the attackers control IP. It doesn't matter what your signed DNS record points to; attackers will just make that address theirs.

Wouldn't https://tools.ietf.org/html/rfc4025 and https://tools.ietf.org/html/rfc4398 cover those cases?

I don't know what IPSEC has to do with this.

Your second link is a reference to what is now called DANE. There is an alternate universe in which DANE helps this problem. In that universe, there are no CAs anymore (otherwise, DANE is effectively just another CA, and attackers will just choose whichever CA allows them to execute their attack).

But DANE is already dead on arrival. Both Mozilla and Chrome flirted with DANE support a few years ago, and then withdrew it. Adam Langley wrote a post on why DANE support turned out to be untenable.

There's another big reason why you shouldn't be excited for DANE deployment, which is that it is essentially a TLS key escrow system. The most important TLDs in the world are controlled by world governments with massive SIGINT infrastructure. DANE turns those TLDs into the new Web PKI roots.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#139

Post by CydeWeys »

Moter8 wrote: post #129
ascorbic wrote: post #122

Earlier quoted context omitted.

You can type "badidea" at the warning page to skip it.

Doesn't work for me (anymore) in Chrome 65. Used to work.

I think it was changed to something like "thisisunsafe" now.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#140

Post by textmode »

"Between 11am until 1pm UTC today, DNS traffic-the phone book of the internet, routing you to your favourite websites-was hijacked by an unknown actor."

Is it worth keeping a record of the IP addresses for "your favorite websites"?

For example, with IP addresses saved, would this enable reaching the websites ven if DNS is not working?

How often do these "favorite websites" change IP addresses?

Are they all the same in that regard?

(The frequency with which they chaange IP addresses.)

Is it worth paying attention when one of them changes its IP address?

Is it worth noting where these addresses are thought to be located (e.g. the countries)?

What if several of "your favorite websites" each change their IP address on the same day, the same week or even the same month?

Is this worth noting?

Post reply on HN