Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hijack of Amazon’s domain service used to reroute web traffic for two hours

doublepulsar.com

Post reply on HN
Print view View original

151–160 of 291 posts

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#151

Post by rocqua »

mehrdadn wrote: post #145
LinuxBender wrote: post #130

Earlier quoted context omitted.

If I control the network, I can strip off any security that might be in DNS. I can change or remove CAA records, DNSSEC, etc. Those things currently fail open, which exception to DNS replication which will take "refresh" time to fail. I can then get new certs for the DNS I now control. HSTS just means use HTTPS. It doesn't validate the previous cert. That is HPKP which almost nobody uses unless they control the clien…

> HSTS just means use HTTPS. It doesn't validate the previous cert. That is HPKP which almost nobody uses unless they control the client, such as mobile apps. I thought HPKP is TOFU, not (necessarily?) preloaded? Meaning you don't need to control the client for the client to be able to take advantage of it?

There might be a small preload list for HPKP. I'm pretty sure google uses key-pinning on their domains on chrome. Not sure if they use HPKP for that though.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#152

Post by rocqua »

CydeWeys wrote: post #139
Moter8 wrote: post #129

Earlier quoted context omitted.

Doesn't work for me (anymore) in Chrome 65. Used to work.

I think it was changed to something like "thisisunsafe" now.

Just checked this on chrome 65 on https://badssl.finn.io/ seems to work (also need to press enter).

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#153

Post by rocqua »

ascorbic wrote: post #122
caymanjim wrote: post #109

Earlier quoted context omitted.

In Chrome, it's a real pain in the ass, and it's buried deeply. It's not available at all in the settings UI (not even in advanced settings).

You can type "badidea" at the warning page to skip it.

Changed to "This is unsafe" (followed by enter) in chrome 65. Try it at https://badssl.finn.io/

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#154

Post by SahAssar »

mehrdadn wrote: post #145
LinuxBender wrote: post #130

Earlier quoted context omitted.

If I control the network, I can strip off any security that might be in DNS. I can change or remove CAA records, DNSSEC, etc. Those things currently fail open, which exception to DNS replication which will take "refresh" time to fail. I can then get new certs for the DNS I now control. HSTS just means use HTTPS. It doesn't validate the previous cert. That is HPKP which almost nobody uses unless they control the clien…

> HSTS just means use HTTPS. It doesn't validate the previous cert. That is HPKP which almost nobody uses unless they control the client, such as mobile apps. I thought HPKP is TOFU, not (necessarily?) preloaded? Meaning you don't need to control the client for the client to be able to take advantage of it?

HPKP can be either TOFU or preloaded. Google maintains a preload list that is included with Chrome, Firefox, Opera, Safari, IE 11 and Edge, but that is not a scalable solution for the future.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#155

Post by lifeisstillgood »

jimktrains2 wrote: post #58
lifeisstillgood wrote: post #35

Can I check my understanding (Somehow) A BGP route was advertised and accepted for the IP range for amazons route53 - so that some / many DNS requests hit a fake server instead of the real amazon one. The only dns requests that changed seem to be for a bitcoin site, and they were redirected to a site that seems to have then grabbed their passwords and then emptied their wallets on the real site. ? Mitigation strategi…

> surely browsers should shout of a certificate that was valid for domain X changes today Why? If the new cert is valid, why sound any alarms?

I visit my bank site and my browser gets a certificate for barclaysbank Ltd, to expire in 12 months. Tomorrow i visit the same site and get a different certificate, or from a different CA.

Should my browser warn me?

I don't know. the chances are high that 99% of people will click OK and 99% of the 1% left will look at it and think "how do i verify this?"

That is probably the reason browsers don't bother with pinning and the rest - there is simply no chain of trust i as an individual can possibly use to verify a fraction of the sites i visit.

but still ... if I pay my landlord every week in cash and one day someone else turns up and says "hi i am your landlord, pay me" I have visual signals to warn me of a possible problem.

The signals are there - my browser could fingerprint the servers, the headers, the response times, a lot could be done. But then most days my browser would act like Donald Sutherland and point at people and say "they have been replaced" and i would have no means to tell.

we really have become reliant on one piece of technology haven't we.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#156

Post by rocqua »

cft wrote: post #116
f2n wrote: post #112

Earlier quoted context omitted.

>HSTS wouldn't help users clicking through warning Actually it would have! Chrome and possible other browsers do not allow clicking throw certificate validation issues on sites with HSTS. For example, try to get to https://badssl.finn.io in Chrome.

Sorry how does that help if the attackers purchase a new "valid" SSL certificate since they control the DNS and thus email?

Once you control DNS, it doesn't require email, you can just use lets-encrypt. The lets-encrypt verification does not check HSTS.

Makes sense because it keeps HSTS from the lockout scenario that makes HPKP so scary.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#157

Post by rocqua »

nodesocket wrote: post #67
bklyn11201 wrote: post #38

Getting a basic certificate issued is incredibly easy these days. If you own the DNS resolution, you can get a cert. Here a few ways I can think of to make this harder for an attacker: * Add a Strict-Transport-Security to all HTTPS requests. This means the attacker will need to get a valid cert (still easy if you can hijack BGP). * Pick a preferred SSL issuer and stick with them. Add a CAA DNS record only allowing th…

A CAA DNS record won't help much if the attacker can just go to the certificate issuer and request a valid SSL certificate because they own DNS. Plus can't they just change the CAA DNS record?

If you have DNSSEC that protects against CAA spoofing, that should also protect against A-record spoofing. Unless we fail open on A records but closed on CAA records.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#158

Post by pshc »

bklyn11201 wrote: post #38

Getting a basic certificate issued is incredibly easy these days. If you own the DNS resolution, you can get a cert. Here a few ways I can think of to make this harder for an attacker: * Add a Strict-Transport-Security to all HTTPS requests. This means the attacker will need to get a valid cert (still easy if you can hijack BGP). * Pick a preferred SSL issuer and stick with them. Add a CAA DNS record only allowing th…

An Expect-CT header would have mitigated this attack (but not for new users).

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#159

Post by influx »

kentt wrote: post #95

Wow myetherwallet is trusted for transaction very non-trivial amounts. What would a good mitigation strategy be for these types of attacks.

Using a hardware wallet and verifying the address on your hardware wallet is the same you entered into the website.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#160

Post by verbify »

CydeWeys wrote: post #139
Moter8 wrote: post #129

Earlier quoted context omitted.

Doesn't work for me (anymore) in Chrome 65. Used to work.

I think it was changed to something like "thisisunsafe" now.

That's correct, tested it with https://badssl.finn.io/
Post reply on HN