LinkedIn suffers DNS hijack • Hacker News Board

Re: LinkedIn suffers DNS hijack

#31

Post by dsl » Thu, Jun 20, 2013, 3:30 AM UTC

raldi wrote: post #14

Can anyone think of a good reason LinkedIn didn't mark their cookies as HTTPS-only? http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

I often describe LinkedIn as a bunch of business people, who have a website. It's not a tech company and the hiring reflects that.

Re: LinkedIn suffers DNS hijack

#32

Post by dsl » Thu, Jun 20, 2013, 3:36 AM UTC

kcen wrote: post #12

The DNS was not exactly hijacked, there were issues inside of LinkedIn's top level DNS provider whom were delegating www.linkedin.com authorization to unauthorized nameservers, namely NS[SOMETHING].ztomy.com. The ztomy DNS replaces its delegated domains to point to a domain parking page if there is no record exiting. These changes were then propagated to other nameservers and thus to the end user. End result, dns doe…

You used a lot of the right words, but not in the right context. Could you share your source do we can get the full picture?

Re: LinkedIn suffers DNS hijack

#33

Post by dsl » Thu, Jun 20, 2013, 3:40 AM UTC

ioquatix wrote: post #16

I'm going to blatantly advertise my own project "RubyDNS" - it can be a lot of fun, and it is especially relevant because it allows you to perform these kinds of attacks in a controlled environment. http://www.codeotaku.com/projects/rubydns/index.en

Have you played with PowerDNS? It would be awesome to see RubyDNS rewritten as a backend.

Re: LinkedIn suffers DNS hijack

#34

Post by mncaudill » Thu, Jun 20, 2013, 3:40 AM UTC

dsl wrote: post #31

raldi wrote: post #14

Can anyone think of a good reason LinkedIn didn't mark their cookies as HTTPS-only? http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

I often describe LinkedIn as a bunch of business people, who have a website. It's not a tech company and the hiring reflects that.

Seriously?

http://blog.linkedin.com/2011/01/11/open-source-linkedin-kaf... http://blog.linkedin.com/2009/03/20/project-voldemort-scalin...

Re: LinkedIn suffers DNS hijack

#35

Post by dsl » Thu, Jun 20, 2013, 3:41 AM UTC

mattbarrie wrote: post #18

Seems legit. www.ztomy.com

ztomy.com is part of the DirectI/ResellerClub/etc. group of companies. They operate paid domain parking programs for registrars.

Re: LinkedIn suffers DNS hijack

#36

Post by quackerhacker » Thu, Jun 20, 2013, 3:47 AM UTC

I think confluence-networks.com may be apart of Network Solutions (which is whom LinkedIn is registered with).

I had a domain (nitren.com), that I let expire after 3yrs and confluence-networks.com back ordered it, I remember looking it up a while back, but if I remember right, all the ip and domains were registered or associated with netsol.

Re: LinkedIn suffers DNS hijack

#37

Post by _j5l3 » Thu, Jun 20, 2013, 3:55 AM UTC

dsl wrote: post #31

raldi wrote: post #14

Can anyone think of a good reason LinkedIn didn't mark their cookies as HTTPS-only? http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

I often describe LinkedIn as a bunch of business people, who have a website. It's not a tech company and the hiring reflects that.

I was an engineering intern there for a summer. The interviews were as difficult as any other tech company in the valley, as was the workload. It is most certainly a tech company.

Re: LinkedIn suffers DNS hijack

#38

Post by kcen » Thu, Jun 20, 2013, 4:10 AM UTC

bryanh wrote: post #15

Was api.linkedin.com compromised/hijacked? If so, that means they'll need to reset a lot of OAuth token/secrets which will be very painful indeed (worse than just a site-wide session reset).

Isn't that the point of OAuth? (versus HTTP basic auth)

Your secret key shouldn't be compromised, because you're supposed to keep that secret. Also if you use HTTPS for requests you'd still get a cert error even if DNS was routing incorrectly. You're probably fine.

Re: LinkedIn suffers DNS hijack

#39

Post by kcthota » Thu, Jun 20, 2013, 4:12 AM UTC

fidelity.com is also not accessible. Currently traffic is routed to some domain parking page.

Re: LinkedIn suffers DNS hijack

#40

Post by memmove » Thu, Jun 20, 2013, 4:12 AM UTC

dsl wrote: post #31

raldi wrote: post #14

Can anyone think of a good reason LinkedIn didn't mark their cookies as HTTPS-only? http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

I often describe LinkedIn as a bunch of business people, who have a website. It's not a tech company and the hiring reflects that.

dsl, no offense, but you seem to have a problem with any company that doesn't hire/provide employment to your average local community college CS grad and instead hires globally based purely on merit.

Linkedin interviews are on par with facebook/google et al.