Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

91–100 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#91

Post by aftbit »

>You would, at this point, be forgiven for thinking that this class of attack - controlling WHOIS server responses to exploit parsing implementations within WHOIS clients - isn’t a tangible threat in the real world.

Let's flip that on its head - are we expected to trust every single WHOIS server in the world to always be authentic and safe? Especially from the point of view of a CA trying to validate TLS, I would not want to find out that `whois somethingarbitrary.ru` leaves me open to an RCE by a Russian server!

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#92

Post by iscoelho »

z3phyr wrote: post #87
iscoelho wrote: post #52

Earlier quoted context omitted.

Let's not fool ourselves by saying we're purely profit driven. Our industry argues about code style (:

Our industry does not argue about code style. There were a few distinct subcultures which were appropriated by the industry who used to argue about code style, lisp-1 vs lisp-2, vim vs emacs, amiga vs apple, single pass vs multi pass compilers, Masters of Deception vs Legion of Doom and the list goes on, depending on the subculture. The industry is profit driven.

Do you use tabs or spaces? Just joking, but:

The point is that our industry has a lot of opinionated individuals that tend to disagree on fundamentals, implementations, designs, etc., for good reasons! That's why we have thousands of frameworks, hundreds of databases, hundreds of programming languages, etc. Not everything our industry does is profit driven, or even rational.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#93

Post by mschuster91 »

nativeit wrote: post #90
mschuster91 wrote: post #72

Earlier quoted context omitted.

Browsers are just one tiny piece of the fossilization issue. We got countless vendors of networking gear, we got clouds (just how many AWS, Azure and GCP services are capable of running IPv6 only, or how many of these clouds can actually run IPv6 dual-stack in production grade?), we got even more vendors of interception middlebox gear (from reverse proxies and load balancers, SSL breaker proxies over virus scanners f…

Ok. You added OEMs to the list, but then just named the same three dominant players as clouds. Last I checked, every device on the planet supports IPv6, if not those other protocols. Everything from the cheapest home WiFi router, to every Layer 3 switch sold in the last 20-years. I think this is a 20-year old argument, and it’s largely irrelevant in 2024.

> I think this is a 20-year old argument, and it’s largely irrelevant in 2024.

It's not irrelevant - AWS lacks support for example in EKS or in ELB target groups, where it's actually vital [1]. GCE also lacks IPv6 for some services and you gotta pay extra [2]. Azure doesn't support IPv6-only at all, a fair few services don't support IPv6 [3].

The state of IPv6 is bloody ridiculous.

[1] https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-su...

[2] https://cloud.google.com/vpc/docs/ipv6-support?hl=de

[3] https://learn.microsoft.com/en-us/azure/virtual-network/ip-s...

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#94

Post by sebstefan »

account42 wrote: post #89
XCSme wrote: post #67

Earlier quoted context omitted.

Wouldn't "eval" in any language result in RCE? Isn't that the point of eval, to execute the given string command?

Fully compiled languages don't even have an eval at all.

Not with that attitude

Start shipping the compiler with your code for infrastructure-agnostic RCEs

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#96

Post by detourdog »

dopylitty wrote: post #33
detourdog wrote: post #27

Earlier quoted context omitted.

That is my point. We need to put value on the face to face relationships and extend trust outward from our personal relationships. This sort of trust is only as strong as it's weakest link but each individual can choose how far to extend their own trust.

This is such a good point. We rely way too much on technical solutions. A better approach is to have hyperlocal offices where you can go to do business. Is this less “efficient”? Yes but when the proceeds of efficiency go to shareholders anyway it doesn’t really matter.

It is only efficient based on particular metrics. Change the metrics and the efficiency changes.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#98

Post by detourdog »

mrguyorama wrote: post #66
dopylitty wrote: post #33

Earlier quoted context omitted.

This is such a good point. We rely way too much on technical solutions. A better approach is to have hyperlocal offices where you can go to do business. Is this less “efficient”? Yes but when the proceeds of efficiency go to shareholders anyway it doesn’t really matter.

>Is this less “efficient”? Yes but when the proceeds of efficiency go to shareholders anyway it doesn’t really matter. I agree with this but that means you need to regulate it. Even banks nowadays are purposely understaffing themselves and closing early because "what the heck are you going to do about it? Go to a different bank? They're closed at 4pm too!"

The regulation needs to be focused on the validity of the identity chain mechanism but not on individuals. Multiple human interactions as well as institutional relationships could be leveraged depending on needs.

The earliest banking was done with letters of introduction. That is why banking families had early international success. They had a familial trust and verification system.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#99

Post by quesera »

8organicbits wrote: post #84
quesera wrote: post #65

Earlier quoted context omitted.

But DNS is all-or-nothing. If you can't trust DNS, you can't trust TLS or anything downstream of it. Even banks are not bothering with EV certificates any more, since browsers removed the indicator (for probably-good reasons). DV certificate issuance depends on trustworthy DNS. Internet security is "good enough" for consumers, most of the time. That's "adequately trustworthy", but it's not "very trustworthy".

Bank websites like chase.com and hsbc.com and web services like google.com, amazon.com, and amazonaws.com intentionally avoid DNSSEC. I wouldn't consider those sites less than "very trustworthy" but my point is that "adequately trustworthy" is the goal. All-or-nothing thinking isn't how we build and secure systems.

I am definitely not arguing in favor of DNSSEC.

However, I don't think it's reasonable to call DNS, as a system, "very trustworthy".

"Well-secured" by active effort, and consequently "adequately trustworthy" for consumer ecommerce, sure.

But DNS is a systemic weak link in the chain of trust, and must be treated with extra caution for "actually secure" systems.

(E.g., for TLS and where possible, the standard way to remove the trust dependency on DNS is certificate pinning. This is common practice, because DNS is systemically not trustworthy!)

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#100

Post by lambda »

account42 wrote: post #89
XCSme wrote: post #67

Earlier quoted context omitted.

Wouldn't "eval" in any language result in RCE? Isn't that the point of eval, to execute the given string command?

Fully compiled languages don't even have an eval at all.

No, but they have system or the like, which is effectively the same, just being evaluated by the shell. https://man7.org/linux/man-pages/man3/system.3.html
Post reply on HN