Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

21–30 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#21

Post by devvvvvvv »

DexesTTP wrote: post #20
devvvvvvv wrote: post #9

Entertaining and informative read. Main takeaways for me from an end user POV: - Be inherently less trustworthy of more unique TLDs where this kind of takeover seems more likely due to less care being taken during any switchover. - Don't use any "TLS/SSL Certificate Authorities/resellers that support WHOIS-based ownership verification."

None of these are true for the MitM threat model that caused this whole investigation: - If someone manages to MitM the communication between e.g. Digicert and the .com WHOIS server, then they can get a signed certificate from Digicert for the domain they want - Whether you yourself used LE, Digicert or another provider doesn't have an impact, the attacker can still create such a certificate. This is pretty worrying…

Thank you for clarifying. That is indeed much more worrying.

If we were able to guarantee NO certificate authorities used WHOIS, this vector would be cut off right?

And is there not a way to, as a website visitor, tell who the certificate is from and reject/distrust ones from certain providers, e.g. Digicert? Edit: not sure if there's an extension for this, but seems to have been done before at browser level by Chrome: https://developers.google.com/search/blog/2018/04/distrust-o...

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#23

Post by hypeatei »

larsnystrom wrote: post #18
sebstefan wrote: post #8

>The first bug that our retrospective found was CVE-2015-5243. This is a monster of a bug, in which the prolific phpWhois library simply executes data obtained from the WHOIS server via the PHP ‘eval’ function, allowing instant RCE from any malicious WHOIS server. I don't want to live on this planet anymore

The fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would've been equivalent to their eval statement, but with less code and no RCE.

The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#24

Post by dpcx »

hypeatei wrote: post #23
larsnystrom wrote: post #18

Earlier quoted context omitted.

The fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would've been equivalent to their eval statement, but with less code and no RCE.

The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.

I'm curious about some specifics of why you wouldn't use PHP for _critical_ web infrastructure?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#25

Post by lobsterthief »

detourdog wrote: post #10
iscoelho wrote: post #3

Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to veri…

For reasons not important hear I purchase my SSL certificates and barely have any legitimating business documents. If Dunn & Bradstreet calls I hang up... It took me 3 years of getting SSL certs from the same company through a convoluted process before I tried a different company. My domain has been with the same registrar since private citizens could register DNS names. That relationship meant nothing when trying to…

Human relationships also open you up to social engineering attacks. Unless they’re face-to-face, in person, with someone who remembers what you actually look like. Which is rare these days.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#26

Post by bell-cot »

hypeatei wrote: post #23
larsnystrom wrote: post #18

Earlier quoted context omitted.

The fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would've been equivalent to their eval statement, but with less code and no RCE.

The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.

Modern PHP is about as solid as comparable languages. It's two biggest problems are:

Lingering bad reputation, from the bad old days

Minimal barrier to entry - which both makes it a go-to for people who should not be writing production code in any language, and encourages many higher-skill folks to look down on it

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#27

Post by detourdog »

lobsterthief wrote: post #25
detourdog wrote: post #10

Earlier quoted context omitted.

For reasons not important hear I purchase my SSL certificates and barely have any legitimating business documents. If Dunn & Bradstreet calls I hang up... It took me 3 years of getting SSL certs from the same company through a convoluted process before I tried a different company. My domain has been with the same registrar since private citizens could register DNS names. That relationship meant nothing when trying to…

Human relationships also open you up to social engineering attacks. Unless they’re face-to-face, in person, with someone who remembers what you actually look like. Which is rare these days.

That is my point. We need to put value on the face to face relationships and extend trust outward from our personal relationships.

This sort of trust is only as strong as it's weakest link but each individual can choose how far to extend their own trust.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#28

Post by candiddevmike »

iscoelho wrote: post #3

Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to veri…

Our industry needs to finish what it starts. Between IPv6, DNSSEC, SMTP TLS, SCTP/QUIC, etc all of these bedrock technologies feel like they're permanently stuck in a half completed implementation/migration. Like someone at your work had all these great ideas, started implementing them, then quit when they realized it would be too difficult to complete.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#29

Post by KMnO4 »

hypeatei wrote: post #23
larsnystrom wrote: post #18

Earlier quoted context omitted.

The fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would've been equivalent to their eval statement, but with less code and no RCE.

The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.

Any language can be insecure. There’s nothing inherently bad about PHP, other than it’s the lowest-hanging fruit of CGI languages and has some less-than-ideal design decisions.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#30

Post by sebstefan »

dpcx wrote: post #24
hypeatei wrote: post #23

Earlier quoted context omitted.

The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.

I'm curious about some specifics of why you wouldn't use PHP for _critical_ web infrastructure?

https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp

https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp

>crc32($str) and hash("crc32",$str) use different algorithms ..

>Password_verify() always returns true with some hash

>md5('240610708') == md5('QNKCDZO')

>crypt() on failure: return > strcmp() will return 0 on error, can be used to bypass authentication

> crc32 produces a negative signed int on 32bit machines but positive on 64bit mahines

>5.3.7 Fails unit test, released anyway

The takeaway from these titles is not the problems themselves but the pattern of failure and the issue of trusting the tool itself. Other than that if you've used php enough yourself you will absolutely find frustration in the standard library

If you're looking for something more exhaustive there's the certified hood classic "PHP: A fractal of bad design" article as well that goes through ~~300+~~ 269 problems the language had and/or still has.

https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/

Though most of it has been fixed since 2012, there's only so much you can do before the good programmers in your community (and job market) just leave the language. What's left is what's left.

Post reply on HN