Tell HN: Please update your DNS records when abandoning servers • Hacker News Board

Re: Tell HN: Please update your DNS records when abandoning servers

#41

Post by tonyarkles » Sun, Jan 03, 2021, 5:36 PM UTC

nickjj wrote: post #4

Yep. A few years ago I had a server on DigitalOcean and stopped using it. I forgot to remove the A record for it on a sub-domain connected to my main site and suddenly a sub-domain on my main site was serving ~400,000 pirated PDFs because the old server's IP address was in control by someone else. I wrote about it here: https://nickjanetakis.com/blog/a-recycled-ip-address-caused-... And it was discussed on HN back th…

I was in a similar situation for a while. It seems Google's finally updated their index and dropped all of the PDFs, but for a while there it was pretty tough to find the actual content on my (admittedly mediocre) site.

Re: Tell HN: Please update your DNS records when abandoning servers

#42

Post by cjbprime » Sun, Jan 03, 2021, 5:36 PM UTC

Daviey wrote: post #11

(sub)domain takeover is one of the more common security issues affecting organisations, and bounty programmes often pay-out for these issues. https://www.hackerone.com/blog/Guide-Subdomain-Takeovers https://github.com/EdOverflow/can-i-take-over-xyz

And to explain the severity: if you control a subdomain, you're potentially getting trusted access to cookies, cross-origin requests, and so on.

Re: Tell HN: Please update your DNS records when abandoning servers

#43

Post by cpach » Sun, Jan 03, 2021, 5:44 PM UTC

bob33212 wrote: post #5

cpach wrote: post #3

So how did the prospective buyer even find your e-mail address...? If I were you I would configure my web server so that it will only accept HTTP connections for hostnames that are your own. If you had done that then the buyer would probably never have found you.

Do a dns lookup for a large website. Then google that up address. There is a good chance you will see the domain name in one of the results

That is not what happened in this particular case though.

Re: Tell HN: Please update your DNS records when abandoning servers

#44

Post by cpach » Sun, Jan 03, 2021, 5:44 PM UTC

Daviey wrote: post #11

(sub)domain takeover is one of the more common security issues affecting organisations, and bounty programmes often pay-out for these issues. https://www.hackerone.com/blog/Guide-Subdomain-Takeovers https://github.com/EdOverflow/can-i-take-over-xyz

This whas not subdomain takeover though.

Re: Tell HN: Please update your DNS records when abandoning servers

#45

Post by Daviey » Sun, Jan 03, 2021, 5:53 PM UTC

cpach wrote: post #44

Daviey wrote: post #11

(sub)domain takeover is one of the more common security issues affecting organisations, and bounty programmes often pay-out for these issues. https://www.hackerone.com/blog/Guide-Subdomain-Takeovers https://github.com/EdOverflow/can-i-take-over-xyz

This whas not subdomain takeover though.

No, I know - but the impact is the same.

I've also had people abandon domains onto my nameservers and keep renewing them for years, which is similar.

They are now a sort of pseudo-controlled domain now.

Re: Tell HN: Please update your DNS records when abandoning servers

#46

Post by kator » Sun, Jan 03, 2021, 6:06 PM UTC

I've had the reverse, people shutdown small private servers and they change their DNS to the ip of our community forums.

I think they want to "do right by the community" not realizing almost nothing works when people hit the old domain name.

Re: Tell HN: Please update your DNS records when abandoning servers

#47

Post by pontifier » Sun, Jan 03, 2021, 6:07 PM UTC

dheera wrote: post #38

nickjj wrote: post #4

Yep. A few years ago I had a server on DigitalOcean and stopped using it. I forgot to remove the A record for it on a sub-domain connected to my main site and suddenly a sub-domain on my main site was serving ~400,000 pirated PDFs because the old server's IP address was in control by someone else. I wrote about it here: https://nickjanetakis.com/blog/a-recycled-ip-address-caused-... And it was discussed on HN back th…

Although in OP's case someone wanted to buy the domain, so maybe don't update your DNS records, in case your subdomain becomes worth a lot of cash? I mean hell, create a bunch of random bogus A records too just in case any of them wins the lottery ticket. A records are free, after all.

I think you have it backwards. OP didn't own the domain, just inherited the IP address through their host. The actual domain owner is losing out on the sale.

Re: Tell HN: Please update your DNS records when abandoning servers

#48

Post by monkaiju » Sun, Jan 03, 2021, 6:12 PM UTC

If any of y'all need a CLI tool to check your DNS propagation check out dug!

Repo: https://git.kaijucode.com/matt/dug HN Post about dug: https://news.ycombinator.com/item?id=25618012

Re: Tell HN: Please update your DNS records when abandoning servers

#49

Post by pontifier » Sun, Jan 03, 2021, 6:17 PM UTC

mongol wrote: post #8

So obvious in retrospect, and so little talked about. Could something be done with the DNS / IP protocols that would improve this?

This is the fundamental problem in security. You have no idea that there is a problem until after you get robbed.

Re: Tell HN: Please update your DNS records when abandoning servers

#50

Post by pontifier » Sun, Jan 03, 2021, 6:21 PM UTC

bilekas wrote: post #36

detaro wrote: post #20

Earlier quoted context omitted.

The domain owner should care, because OP could misuse the domain.

Right, the domain owner should care. Not OP.

But OP does care about others. If you own a domain it's a non-obvious vulnerability.

Thanks OP!