Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

101–110 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#101

Post by post-it »

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit:

> As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023.

Never ever ever ever let a domain expire. If you're a business and you're looking to pick up a new domain because it's only $10/year, consider that you're going to be paying $10/year forever, because once you associate that domain with your business, you can never get rid of that association.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#102

Post by declan_roberts »

post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#103

Post by SSLy »

rixthefox wrote: post #38

> We recently performed research that started off "well-intentioned" (or as well-intentioned as we ever are) - to make vulnerabilities in WHOIS clients and how they parse responses from WHOIS servers exploitable in the real world (i.e. without needing to MITM etc). R̶i̶g̶h̶t̶ o̶f̶f̶ t̶h̶e̶ b̶a̶t̶, S̶T̶O̶P̶. I̶ d̶o̶n̶'t̶ c̶a̶r̶e̶ w̶h̶o̶ y̶o̶u̶ a̶r̶e̶ o̶r̶ h̶o̶w̶ "w̶e̶l̶l̶-̶i̶n̶t̶e̶n̶t̶i̶o̶n̶e̶d̶" s̶o̶m̶e̶o̶n̶e̶ i̶s̶.…

you'd rather have blackhats do it and sell it to asian APT's?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#104

Post by ganoushoreilly »

declan_roberts wrote: post #102
post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

I actually think they need 2, usually need a second domain / setup for failover. Especially if the primary domain is a novelty TLD like.. .IO which showed that things can happen at random to the TLD. If the website down it's fine, but if you have systems calling back to subdomains on that domain, you're out of luck. A good failover will help mitigate / minimize these issues. I'd also keep it on a separate registrar.

Domains are really cheap, I try to just pay for 5-10 year blocks (as many as I can), when I can just to reduce the issues.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#105

Post by sundarurfriend »

The article puts the blame on

> Never Update, Auto-Updates And Change Are Bad

as the source of the problem a couple of times.

This is pretty common take from security professionals, and I wish they'd also call out the other side of the equation: organizations bundling their "feature" (i.e. enshittification) updates and security updates together. "Always keep your programs updated" is just not feasible advice anymore given that upgrades as just as likely to be downgrades these days. If that were to be realistic advice, we need more pressure on companies to separate out security-related updates and allow people to get updates only on that channel.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#106

Post by Suppafly »

develatio wrote: post #59

I have the feeling that any day now I’m gonna wake up in the morning and I’ll find out that there just isn’t internet anymore because somebody did something from a hotel room in the middle of nowhere with a raspberry pi connected to a wifi hotspot of a nearby coffee shop.

Reminds me of the dorms in college where the internet would get messed up because someone would plug in a random router from home that would hand out junk dhcp ip addresses. It's like that but for the whole world.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#108

Post by zoover2020 »

donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

This is why PHP is mostly banned at bigCo

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#109

Post by bootsmann »

account42 wrote: post #77
iscoelho wrote: post #3

Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to veri…

> 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) HTTP-based ACME verification also uses unencrypted port-80 HTTP. Similar for DNS-based verification.

> HTTP-based ACME verification also uses unencrypted port-80 HTTP

I mean, they need to bootstrap the verification somehow no? You cannot upgrade the first time you request a challenge.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#110

Post by crote »

hansjorg wrote: post #19

Why are tools using hardcoded lists of WHOIS servers? Seems there is a standard (?) way of registering this in DNS, but just from a quick test, a lot of TLDs are missing a record. Working example: dig _nicname._tcp.fr SRV +noall +answer _nicname._tcp.fr. 3588 IN SRV 0 0 43 whois.nic.fr. Edit: There's an expired Internet Draft for this: https://datatracker.ietf.org/doc/html/draft-sanz-whois-srv-0...

A plain

  mobi.whois.arpa. CNAME whois.nic.mobi
could've already solved the issue. But getting everyone to agree and adopt something like that is hard.

Although as fanf2 points out below, it seems you could also just start with the IANA whois server. Querying https://www.iana.org/whois for `mobi` will return `whois: whois.nic.mobi` as part of the answer.

Post reply on HN