"almost unprecedented" implies that there was an earlier wave of DNS hijacking that was even larger (thus setting some kind of precedent). Was there such a precedent? And if so, I didn't see mention of it in the article.
A DNS hijacking wave is targeting companies at an almost unprecedented scale
11–20 of 104 posts
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#12Could this be a big setback for "Let's Encrypt" since it uses DNS resolution for its own authentication instead of being a second factor?
All domain-validated certificates use factors you can control if you control the domain, whether email or web or DNS. This has nothing to do with Let's Encrypt.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#13"One DNS hijacking technique involves changing what’s known as the DNS A record." Could be any record, depends on the intentions of the hijacker. Typically we see web traffic being hijacked to another ipv4 host which indeed, is an A record. Another abuse option could be to alter SPF/DKIM to do a more sophisticated phishing campaign.
And because there are so many SPF records including SPF records including... you can be pretty undetectable.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#14Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#15The "clever trick" seems to be: previously compromised the login credentials for the administration panel of the target’s DNS provider or previously compromised domain registrar or ccTLD Unless I'm missing something, given either of those things, doesn't take much cleverness...
Something I'm always interested in is how vulnerabilities/attacks are leveraged once a system is compromised.
Obviously if an attacker controls DNS they could do all sorts of bad things: setup a phishing site that looks official, put up a fake press release announcing a merger or sale to manipulate the stock price, hold the domain hostage, etc.
Most of those actions (while bad) would be detected pretty readily. What's clever here is that the attackers _maintain_ a working proxy back to the real system for an extended period of time. Time during which they can then inspect the traffic and peel out sensitive data, presumably to re-use those credentials to break into other systems and escalate further.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#16What ever happened to HPKP? It seems like that would somewhat mitigate these attacks since they rely on using their control over the domain to get a new DV cert. A pinned certificate would at least protect those who have accessed the sites before.
HPKP could have potentiated these attacks by allowing an attacker to pin their certificate while they were in control of the domain, making it difficult for the domain owner to ever fully regain control.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#17Note that these attacks involve compromised accounts with authority servers , so despite being the most visible and impactful DNS attacks of the last few years, DNSSEC would have done little to defend against them; in fact, even in the DNSSEC fantasy-world where DANE replaces X.509 CAs, these attackers would still have accomplished their goals.
after reading the headline I immediately thought of "14 DNS Nerds Don't Control the Internet" [0].
[0] https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con...
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#18The "clever trick" seems to be: previously compromised the login credentials for the administration panel of the target’s DNS provider or previously compromised domain registrar or ccTLD Unless I'm missing something, given either of those things, doesn't take much cleverness...
It's some kind of alarmism over letsencrypt ... "letsencrypt will give tricky attackers a valid certificate for a domain!!!" (if they get control over the domain) (... certs have almost always been granted based on control of the domain, though historically it mostly MX records ... so attackers could do pretty much the same thing 15 years ago)
I believe this is why letsencrypt certs are only valid for 3 months. Personally, I'd like it monthly.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#19Could this be a big setback for "Let's Encrypt" since it uses DNS resolution for its own authentication instead of being a second factor?
All domain-validated certificates use factors you can control if you control the domain, whether email or web or DNS. This has nothing to do with Let's Encrypt.
Yeah, but it is a problem with domain-validated certificates in general that kinda defeats the purpose of SSL.
It seems most of the time that a web site is "hacked" (defaced) somebody changed the DNS instead of attacking the actual web server.
SSL signing can potentially be a second line of defense, but only if having control of the DNS (thus web and email) is insufficient to get a cert.
Re: A DNS hijacking wave is targeting companies at an almost unprecedented scale
#20Earlier quoted context omitted.
It's some kind of alarmism over letsencrypt ... "letsencrypt will give tricky attackers a valid certificate for a domain!!!" (if they get control over the domain) (... certs have almost always been granted based on control of the domain, though historically it mostly MX records ... so attackers could do pretty much the same thing 15 years ago)
I believe this is why letsencrypt certs are only valid for 3 months. Personally, I'd like it monthly.
[deleted]