Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

211–220 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#211

Post by epc »

forgotpwd16 wrote: post #176

Very cool work. >The dotmobiregistry.net domain, and whois.dotmobiregisry.net hostname, has been pointed to sinkhole systems provided by ShadowServer that now proxy the legitimate WHOIS response for .mobi domains. If those domains were meant to be deprecated should be better to return a 404. Keeping them active and working like normal reduces the insensitive to switch to the legitimate domain.

Whois doesn't support HTTP status codes, but the shadowserver sinkhole responds with:

   Domain not found.

   >>> Please update your code or tell your system administrator to use whois.nic.mobi, the authoritative WHOIS server for this domain.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#212

Post by wiradikusuma »

varun_ch wrote: post #199
joelanman wrote: post #190

Earlier quoted context omitted.

interesting, why is this?

I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf. 2. if a user uploaded something like an html file, you wouldn't want it to be able to run j…

I'm wondering, many SaaS offer companyname.mysaas.com. Is that totally secure?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#213

Post by liquidgecka »

yumraj wrote: post #205
post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

> If you're a business and you're looking to pick up a new domain because it's only $10/year, consider that you're going to be paying $10/year forever, because once you associate that domain with your business, you can never get rid of that association. Please elaborate... Also, what about personal domains? Does it apply there as well?

My brother used to own .com and wrote on it a bunch. Eventually he bailed out and let it expire. It turned into a porn site for a few years and now its for sale for like $2k from some predatory reseller.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#214

Post by sentientslug »

Suppafly wrote: post #106
develatio wrote: post #59

I have the feeling that any day now I’m gonna wake up in the morning and I’ll find out that there just isn’t internet anymore because somebody did something from a hotel room in the middle of nowhere with a raspberry pi connected to a wifi hotspot of a nearby coffee shop.

Reminds me of the dorms in college where the internet would get messed up because someone would plug in a random router from home that would hand out junk dhcp ip addresses. It's like that but for the whole world.

Sounds like BGP…

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#215

Post by CountVonGuetzli »

darkr wrote: post #204
stagalooo wrote: post #152

Earlier quoted context omitted.

Could you elaborate on why? The companies I have worked for have pretty much all used domain.com for marketing and app.domain.com for the actual application. What's wrong with this approach?

If there’s any scope for a user to inject JavaScript, then potentially this gives a vector of attack against other internal things (e.g admin.domain.com, operations.domain.com etc)

Also, if for example the SaaS you’re running sends a lot of system emails that really shouldn’t end up in spam filters, you can’t afford to let things like marketing campaigns negatively influence your domain’s spam score.

Easier and safer to have separate domains.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#217

Post by mananaysiempre »

varun_ch wrote: post #199
joelanman wrote: post #190

Earlier quoted context omitted.

interesting, why is this?

I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf. 2. if a user uploaded something like an html file, you wouldn't want it to be able to run j…

> if a user uploaded something like an html file, you wouldn't want it to be able to run javascript on google.com (because then you can steal cookies and do bad stuff)

Cookies are the only problem here, as far as I know, everything else should be sequestered by origin, which includes the full domain name (and port and protocol). Cookies predate the same-origin policy and so browsers scope them using their best guess at what the topmost single-owner domain name is, using—I kid you not—a compiled-in list[1]. (It’s as terrifying as it sounds.)

[1] https://publicsuffix.org/

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#218

Post by sjm-lbm »

snerbles wrote: post #155
btown wrote: post #134

Earlier quoted context omitted.

The saving grace of JS is that the ecosystem had a reset when React came out; there's plenty of horrifying JQuery code littering the StackOverflow (and Experts Exchange!) landscape, but by the time React came around, Backbone and other projects had already started to shift the ecosystem away from "you're writing a script" to "you're writing an application," so someone searching "how do I do X react" was already a hug…

Laravel, maybe. But not as much as React, or the other myriad JS frontend frameworks. (to include the ones that appeared in the time I spent typing this post)

I'd argue that PHP7 is the closest thing PHP has had to a quality revolution. It fixed a zillion things, got rid of some footguns like legacy mysql, and in general behaved a lot more rationally.

If you were doing things right, by that point you were already using Laravel or Symphony or something, so the change didn't seem as revolutionary as it was, but that was the moment a lot of dumb string concatenated query code (for example) no longer worked out of the box.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#219

Post by ohashi »

post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

This is the most obvious reason why Verisign is a monopolist and should be regulated like a utility. They make false claims about choice and not being locked in. You buy a domain, you use it, you're locked in forever. And they know it. That's why they fight tooth and nail to protect their monopoly.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#220

Post by ryanmcbride »

post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

But if companies did that then I never would have been able to buy coolchug.com!
Post reply on HN