Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Possible BGP hijack of 1.1.1.1

bgpstream.com

Post reply on HN
Print view View original

61–70 of 158 posts

Re: Possible BGP hijack of 1.1.1.1

#61

Post by floatingatoll »

moviuro wrote: post #27
floatingatoll wrote: post #24

Would this affect certificate-validating clients doing DNS-over-HTTPS to 1.1.1.1 — doesn’t it have an ipAddress certificate and demand HTTPS resolution only?

Well, if you control the host behind the IP, you could have any CA issue a challenge, and successfully pass it (e.g. if Let's encrypt uses the erroneous routes). So no. The only thing protecting you would be to have the expected hash of the certificate you expect to see (TOFU - Trust on First use, though you're screwed if you didn't contact 1.1.1.1 before the incident!).

Is there a CAA equivalent for ARIN assignments?

Re: Possible BGP hijack of 1.1.1.1

#62

Post by Operyl »

HankB99 wrote: post #17
bonyt wrote: post #4

Earlier quoted context omitted.

Traffic meant to go to 1.1.1.1 (cloudflare DNS) could be routed elsewhere. Since this is a common DNS server, this could be used to alter domain resolution for people that use it.

I'm assuming this would/could be done by a malicious party in order to substitute different IP addresses for some sites in an attempt to direct traffic for nefarious purposes. If my host is configured to use DNSSEC would that prevent sites from resolving? If DNSSEC is not employed and a connection is directed to a malicious site (using https) wouldn't that prevent the connection? (I'm afraid I'm out of my depth on th…

For DNSSEC: it depends, I don’t think many clients hardfail yet. For HTTPS: if you can BGP attack, theoretically you could get a TLS certificate issued.

There’s a lot of ifs on both those roads, though.

Re: Possible BGP hijack of 1.1.1.1

#63

Post by Operyl »

moviuro wrote: post #27
floatingatoll wrote: post #24

Would this affect certificate-validating clients doing DNS-over-HTTPS to 1.1.1.1 — doesn’t it have an ipAddress certificate and demand HTTPS resolution only?

Well, if you control the host behind the IP, you could have any CA issue a challenge, and successfully pass it (e.g. if Let's encrypt uses the erroneous routes). So no. The only thing protecting you would be to have the expected hash of the certificate you expect to see (TOFU - Trust on First use, though you're screwed if you didn't contact 1.1.1.1 before the incident!).

Doesn’t LE use their own resolvers?

EDIT: https://community.letsencrypt.org/t/where-does-letsencrypt-r...

Re: Possible BGP hijack of 1.1.1.1

#64

Post by Operyl »

floatingatoll wrote: post #61
moviuro wrote: post #27

Earlier quoted context omitted.

Well, if you control the host behind the IP, you could have any CA issue a challenge, and successfully pass it (e.g. if Let's encrypt uses the erroneous routes). So no. The only thing protecting you would be to have the expected hash of the certificate you expect to see (TOFU - Trust on First use, though you're screwed if you didn't contact 1.1.1.1 before the incident!).

Is there a CAA equivalent for ARIN assignments?

I assume you’re looking for: https://tools.ietf.org/html/bcp38

Re: Possible BGP hijack of 1.1.1.1

#66

Post by sdfgdfhjdgj »

akw28888 wrote: post #41

I'm using AnchNet's services. And We've asked AnchNet when I recieved a e-mail from our BGPMon. They said their staff was configured a wrong config on router. Also they don't know 1.1.1.0/24 is used by CloudFlare&APNIC. So they used this prefix to test.

Why let people access BGP that don't even know that 1.0.0.0/8 or 1.1.1.0/24 are part of the public internet or that decide they can use random prefixes to "test" things? :-/

Re: Possible BGP hijack of 1.1.1.1

#67

Post by jedisct1 »

tazjin wrote: post #57
akw28888 wrote: post #41

I'm using AnchNet's services. And We've asked AnchNet when I recieved a e-mail from our BGPMon. They said their staff was configured a wrong config on router. Also they don't know 1.1.1.0/24 is used by CloudFlare&APNIC. So they used this prefix to test.

It shouldn't really matter who is currently using that net, it's not a private range :/

Tell Cisco.

Re: Possible BGP hijack of 1.1.1.1

#68

Post by digi_owl »

amaccuish wrote: post #21

Does anyone else find it sort of beautiful watching replays of events like this? It's amazing to watch how the routers organise themselves, making and breaking connections when needed.

I must admit, what drew me to computing back in the day was the low level networking stuff.

Re: Possible BGP hijack of 1.1.1.1

#69

Post by davidkuhta »

kchr wrote: post #51
amaccuish wrote: post #21

Does anyone else find it sort of beautiful watching replays of events like this? It's amazing to watch how the routers organise themselves, making and breaking connections when needed.

There are at least two of us, dear friend!

Three's company.
Post reply on HN