51–60 of 95 posts
I'm trying to find other subdomains that might be still pointing there.
edit: i'm enumerating all the linkedin.com hosts using a dict. 80% of A records are returning the rogue IP 204.11
edit: 96 records still pointing at the rogue server, here is a dump I just uploaded:
fidelity.com is also not accessible. Currently traffic is routed to some domain parking page.
Appears to be corrected at this time.
It seems this website chooses a random selection from a larger pool of nameservers, so if you refresh the page you may get different results.
This isn't over yet - press dot linkedin.com (dont go there) is still pointing to the rogue server at 204.11.56.17 I'm trying to find other subdomains that might be still pointing there. edit: i'm enumerating all the linkedin.com hosts using a dict. 80% of A records are returning the rogue IP 204.11 edit: 96 records still pointing at the rogue server, here is a dump I just uploaded: http://pastebin.com/uc2JXPfB
I'm going to blatantly advertise my own project "RubyDNS" - it can be a lot of fun, and it is especially relevant because it allows you to perform these kinds of attacks in a controlled environment. http://www.codeotaku.com/projects/rubydns/index.en
Have you played with PowerDNS? It would be awesome to see RubyDNS rewritten as a backend.
What do you think the main benefits would be?
DNS hacks on big public companies seems like a big security oversite form the linkedin team. wow. Perhaps my HTTPS anywhere extension could have helped folks.
Can anyone think of a good reason LinkedIn didn't mark their cookies as HTTPS-only? http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly
considering a lot of their subdomains are still hijacked at this point those cookies are being sent to them
Can someone examine the cookies that they set and tell if there is any sensitive information (passwords?) that are hashed in there? Should we consider this a password breach?
This isn't over yet - press dot linkedin.com (dont go there) is still pointing to the rogue server at 204.11.56.17 I'm trying to find other subdomains that might be still pointing there. edit: i'm enumerating all the linkedin.com hosts using a dict. 80% of A records are returning the rogue IP 204.11 edit: 96 records still pointing at the rogue server, here is a dump I just uploaded: http://pastebin.com/uc2JXPfB
What nameserver are you using?
short TTL's on a lot of these domains
I just ran it again this time using Google name servers and still a lot of subdomains are pointing to the 214 server. confirmed it running against their NS, which means it hasn't been changed yet.