Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

61–70 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#61

Post by NovemberWhiskey »

iscoelho wrote: post #3

Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to veri…

None of these relate to TLS/SSL - that's the wrong level of abstraction: they relate to fragility of the roots of trust on which the registration authorities for Internet PKI depend.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#62

Post by 123sereusername »

iscoelho wrote: post #52
dogleash wrote: post #49

Earlier quoted context omitted.

> Our industry needs to finish what it starts. "Our industry" is a pile of snakes that abhor the idea of collaboration on common technologies they don't get to extract rents from. ofc things are they way they are.

Let's not fool ourselves by saying we're purely profit driven. Our industry argues about code style (:

[dead]

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#63

Post by goodpoint »

iscoelho wrote: post #32
candiddevmike wrote: post #28

Earlier quoted context omitted.

Our industry needs to finish what it starts. Between IPv6, DNSSEC, SMTP TLS, SCTP/QUIC, etc all of these bedrock technologies feel like they're permanently stuck in a half completed implementation/migration. Like someone at your work had all these great ideas, started implementing them, then quit when they realized it would be too difficult to complete.

obligatory https://xkcd.com/927/ Honestly: we're in this situation because we keep trying to band-aid solutions onto ancient protocols that were never designed to be secure. (I'm talking about you DNS.) Given xkcd's wisdom though, I'm not sure if this is easily solvable.

Standards evolve for good reasons. That's just a comic.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#64

Post by donatj »

I have written PHP for a living for the last 20 years and that eval just pains me to no end

    eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";');
Why? Dear god why. Please stop.

PHP provides a built in escaper for this purpose

    eval($var . '=' . var_export($itm, true) . ';');
But even then you don't need eval here!

    ${$var} = $itm;
Is all you really needed... but really just use an array(map) if you want dynamic keys... don't use dynamically defined variables...

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#65

Post by quesera »

8organicbits wrote: post #56
iscoelho wrote: post #47

Earlier quoted context omitted.

If my DNS can be MITM'd, and is thus insecure, it is not trustworthy.

This sort of all-or-nothing thinking isn't helpful. DNS points you to a server, TLS certificates help you trust that you've arrived at the right place. It's not perfect, but we build very trustworthy systems on this foundation.

But DNS is all-or-nothing.

If you can't trust DNS, you can't trust TLS or anything downstream of it.

Even banks are not bothering with EV certificates any more, since browsers removed the indicator (for probably-good reasons). DV certificate issuance depends on trustworthy DNS.

Internet security is "good enough" for consumers, most of the time. That's "adequately trustworthy", but it's not "very trustworthy".

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#66

Post by mrguyorama »

dopylitty wrote: post #33
detourdog wrote: post #27

Earlier quoted context omitted.

That is my point. We need to put value on the face to face relationships and extend trust outward from our personal relationships. This sort of trust is only as strong as it's weakest link but each individual can choose how far to extend their own trust.

This is such a good point. We rely way too much on technical solutions. A better approach is to have hyperlocal offices where you can go to do business. Is this less “efficient”? Yes but when the proceeds of efficiency go to shareholders anyway it doesn’t really matter.

>Is this less “efficient”? Yes but when the proceeds of efficiency go to shareholders anyway it doesn’t really matter.

I agree with this but that means you need to regulate it. Even banks nowadays are purposely understaffing themselves and closing early because "what the heck are you going to do about it? Go to a different bank? They're closed at 4pm too!"

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#67

Post by XCSme »

hypeatei wrote: post #23
larsnystrom wrote: post #18

Earlier quoted context omitted.

The fact they're using `eval()` to execute variable assignment... They could've just used the WTF-feature in PHP with double dollar signs. $$var = $itm; would've been equivalent to their eval statement, but with less code and no RCE.

The fact PHP is used for any critical web infrastructure is concerning. I used PHP professionally years ago and don't think it's that awful but certainly not something I'd consider for important systems.

Wouldn't "eval" in any language result in RCE? Isn't that the point of eval, to execute the given string command?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#68

Post by rty32 »

sebstefan wrote: post #30
dpcx wrote: post #24

Earlier quoted context omitted.

I'm curious about some specifics of why you wouldn't use PHP for _critical_ web infrastructure?

https://duckduckgo.com/?q=hash+site:reddit.com/r/lolphp https://duckduckgo.com/?q=crypt+site:reddit.com/r/lolphp >crc32($str) and hash("crc32",$str) use different algorithms .. >Password_verify() always returns true with some hash >md5('240610708') == md5('QNKCDZO') >crypt() on failure: return > strcmp() will return 0 on error, can be used to bypass authentication > crc32 produces a negative signed int on 32bit machi…

People keep saying "oh it's php 5.3 and before that are bad, things are much better now", but ...

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#69

Post by fanf2 »

This is a fantastic exploit and I am appalled that CAs are still trying to use whois for this kind of thing. I expected the rise of the whois privacy services and privacy legislation would have made whois mostly useless for CAs years ago.

>

This is the approach taken by whois on Debian.

Years ago I did some hacking on FreeBSD’s whois client, and its approach is to have as little built-in hardcoded knowledge as possible, and instead follow whois referrals. These are only de-facto semi-standard, i.e. they aren’t part of the protocol spec, but most whois servers provide referrals that are fairly easy to parse, and the number of exceptions and workarounds is easier to manage than a huge hardcoded list.

FreeBSD’s whois starts from IANA’s whois server, which is one of the more helpful ones, and it basically solves the problem of finding TLD whois servers. Most of the pain comes from dealing with whois for IP addresses, because some of the RIRs are bad at referrals. There are some issues with weird behaviour from some TLD whois servers, but that’s relatively minor in comparison.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#70

Post by doubled112 »

candiddevmike wrote: post #28
iscoelho wrote: post #3

Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to veri…

Our industry needs to finish what it starts. Between IPv6, DNSSEC, SMTP TLS, SCTP/QUIC, etc all of these bedrock technologies feel like they're permanently stuck in a half completed implementation/migration. Like someone at your work had all these great ideas, started implementing them, then quit when they realized it would be too difficult to complete.

Doesn't every place have a collection of ideas that are half implemented? I know I often choose between finishing somebody else's project or proving we don't need it and decommissioning it.

I'm convinced it's just human nature to work on something while it is interesting and move on. What is the motivation to actually finish?

Why would the the technologies that should hold up the Internet itself be any different?

Post reply on HN