Live data from Hacker News

Possible BGP hijack of 1.1.1.1

bgpstream.com

141–150 of 158 posts

Re: Possible BGP hijack of 1.1.1.1

#141
post #137
post #116

Earlier quoted context omitted.

On an airgapped lab it is bad practice. Same -though DNS related- with using *.local as a LAN TLD We just should not.

.local is perfectly fine according to the IETF https://tools.ietf.org/html/rfc6762

For mDNS, yes. There are resolvers that don't even try DNS when looking up a name in .local.

Some of them were made more lenient because just as Microsoft finally stopped encouraging this nonsense, the Kubernetes people picked it up from ancient Windows Server folklore and apparently decided to make it web-scale.

Re: Possible BGP hijack of 1.1.1.1

#142

Earlier quoted context omitted.

Nothing prevents them from applying but... * They need to do that, and get the resulting certificate, and install it, during the attack. The weirder the product (and certificates for IP addresses are relatively weird) the more humans end up involved in your order, and humans are slow. * This leaves a smoking gun in the Certificate Transparency logs. So we all get to know (in maximum 24 hours but usually the reality w…

1) would take about 20 seconds, thanks to Let's Encrypt, but probably only marginally more time for some other CA with an API. 2) Who exactly is staring at CT logs and going "oh, I don't remember this domain using this CA, maybe I should investigate this" ? Sure there's a record of it. Doesn't really matter during an attack, because public attacks like this aren't intended to last long. All you need is a half hour or…

"would take about 20 seconds, thanks to Let's Encrypt"

Let's Encrypt does not offer certificates for IP addresses. They choose only to offer DV certificates using methods 3.2.2.4.6 and 3.2.2.4.7

How much of your hypothetical half hour will you spend trying to figure out why your chosen ACME client reports "Policy forbids issuance" when asked for an IP address?

As to who is staring at CT logs, well there's the fun thing about the design of CT, the _logs_ aren't where you would be staring, you would be looking at a _monitor_ and a monitor can be configured to do whatever it so happens you think is important. We know that commercial CAs already sell monitoring as part of "Enterprise security" type offerings.

Facebook took... I want to say minutes here, but I can't find an exact timeline, to spot that a certificate had been issued by Let's Encrypt for a name in their DNS hierarchy and begin investigating what went wrong.

Certificate Transparency isn't finished. As it stands today your authoritarian government "only" needs to ensure that nobody notices these shenanigans as unavoidably they create a "smoking gun" which would lead to their pet CA being distrusted. That's a tall order, but certainly not impossible in the short term, or for attacks in which the bogus certs are shown to a small number of individual targets rather than a broad population that will invariably notice by accident.

But longer term CT is intended for use with a gossip protocol so that it's impossible for the pretence to be kept up. Sooner or later a node somewhere will end up realising that there's an inconsistency, either it has seen SCTs that weren't logged, or it has seen logs that aren't consistent with the logs other nodes see, either of which is a matter for distrust.

BGP has no relationship to the Web PKI, which is what I presume you're referring to by "the CA system". The relatively small number of parties interested in BGP have developed their own PKI to fit their needs.

Re: Possible BGP hijack of 1.1.1.1

#144

Earlier quoted context omitted.

Why let people access BGP that don't even know that 1.0.0.0/8 or 1.1.1.0/24 are part of the public internet or that decide they can use random prefixes to "test" things? :-/

It could also be an ISP leaking a loopback identifier into their routes. A lot of ISP's will give their BGP routers lo0 interfaces named things like 1.1.1.1 and 2.2.2.2. It serves as a label and not as an address. It's been a while, but I can't count the number of times that I've seen that.

If that were the case, they would have been advertising a /32 (which, hopefully, would have been dropped -- or, the least, not redistributed) instead of a /24.

Re: Possible BGP hijack of 1.1.1.1

#145

Earlier quoted context omitted.

That's not correct, anyone could 'accidentally' do this to every other provider. It's not a special weakness of cloudflare.

I'm sorry, I went for brevity because someone was asking for possible impacts. If I were using 1.1.1.1 as a DNS server and saw this news story, I would change to a different DNS server until the problem was resolved. My goal was to provide actionable information quickly. I never said it was specific to Cloudflare. :) It is specifically a mistake which would break an assumption - that putting 1.1.1.1 into your resolve…

Okay, thanks for your polite explanation.

Re: Possible BGP hijack of 1.1.1.1

#146
post #43
post #7

Earlier quoted context omitted.

1.1.1.1 is a DNS resolver that does not track activity. A BGP compromise means that someone could have compromised it and redirect/intercept traffic of those trusting it to be Cloudflare.

A BGP attack does not compromise the destination host. It reroutes (some) traffic destined for the host. Any traffic using TLS to establish destination authenticity (e.g DNS TLS, DNS over HTTP) or content authenticity (e.g. DNSSEC) would detect the attack, while other types of traffic (traditional DNS) could be exploited.

DNSSEC does not in fact mitigate BGP attacks, because to the extent it works at all, DNSSEC protects only the mapping between IP addresses and names. A BGP attacker controls the semantics of the addresses themselves, and can simply leave DNS pointing where it's supposed to, but hijack the underlying address.

TLS, on the other hand, does address this attack, because controlling all the traffic to a TLS-protected site still doesn't give you a private key that produces a valid signature on a certificate for that site.

Re: Possible BGP hijack of 1.1.1.1

#147
post #129
post #109

Earlier quoted context omitted.

Could one argue for tort/negligence against the ISP who should have filtered, but didn't, if one's coins were stolen through that? Or even possibly the same, but in criminal court?

I doubt it, since the argument you're suggesting is that the ISP didn't take the best possible care, whereas the standard for negligence is, I believe (IANAL), reasonable care. They may also not even have a duty of care in the first place, as to the truth of any metadata they're passing on. As a sibling comment pointed out, it's not as if there are laws for this.

> IANAL

I'm not here to judge. What you choose to do in your own time is none of our business :)

Re: Possible BGP hijack of 1.1.1.1

#148

Large companies misuse "unassigned" space all the time. I have heard engineers at my work propose using the non public routed DOD /8 before. Not on my watch!

If you happen to know why, could you explain their reasoning? In what ways are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 insufficient?

Re: Possible BGP hijack of 1.1.1.1

#149

Earlier quoted context omitted.

1) would take about 20 seconds, thanks to Let's Encrypt, but probably only marginally more time for some other CA with an API. 2) Who exactly is staring at CT logs and going "oh, I don't remember this domain using this CA, maybe I should investigate this" ? Sure there's a record of it. Doesn't really matter during an attack, because public attacks like this aren't intended to last long. All you need is a half hour or…

"would take about 20 seconds, thanks to Let's Encrypt" Let's Encrypt does not offer certificates for IP addresses. They choose only to offer DV certificates using methods 3.2.2.4.6 and 3.2.2.4.7 How much of your hypothetical half hour will you spend trying to figure out why your chosen ACME client reports "Policy forbids issuance" when asked for an IP address? As to who is staring at CT logs, well there's the fun thi…

BGP allows anyone to issue fake certs, so it does have a relationship to web PKI.

And sure, if you have a couple billion dollars, you can set up fancy infrastructure and response teams to monitor the whole web (that you are aware of, that participate in CT) for a strangely-issued cert.

Or you could just get a cert issued by the CA you normally use. In which case, now we have to track some kind of "customer number" per CA. If you use more than one CA (Google does) now you're tracking different customer numbers on different CAs. And all that has to be standardized.

Most of these "fixes" for web PKI's glaring holes are intended for large multinational corporations, or are optional, or specific to a particular browser, and don't address the main concern: _do not trust an IP address to be who it claims to be_.

Re: Possible BGP hijack of 1.1.1.1

#150
post #116

Earlier quoted context omitted.

To be fair, unallocated or unassigned IP space isn't fair game to use for testing outside of an air gapped lab. I've never in my career thought it would be a good idea to "test" unallocated public unicast address space on my edge routers.

On an airgapped lab it is bad practice. Same -though DNS related- with using *.local as a LAN TLD We just should not.

There are instances where completely replicating an environment in an air gapped lab is acceptable. For instance, you could be encountering some edge case where a bit is being flipped in an IP address, or a bit is stuck on somewhere and replicating the environment down to the individual IP addresses plays a huge part in reproducing the issue.

An edge router is not one of these cases though.

Post reply on HN