Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

111–120 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#111

Post by shafoshaf »

declan_roberts wrote: post #102
post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

And a second for when your main domain gets banned for spam for innocuous reasons.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#113

Post by gavindean90 »

nativeit wrote: post #90
mschuster91 wrote: post #72

Earlier quoted context omitted.

Browsers are just one tiny piece of the fossilization issue. We got countless vendors of networking gear, we got clouds (just how many AWS, Azure and GCP services are capable of running IPv6 only, or how many of these clouds can actually run IPv6 dual-stack in production grade?), we got even more vendors of interception middlebox gear (from reverse proxies and load balancers, SSL breaker proxies over virus scanners f…

Ok. You added OEMs to the list, but then just named the same three dominant players as clouds. Last I checked, every device on the planet supports IPv6, if not those other protocols. Everything from the cheapest home WiFi router, to every Layer 3 switch sold in the last 20-years. I think this is a 20-year old argument, and it’s largely irrelevant in 2024.

Plenty doesn’t support IPv6.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#114

Post by NovemberWhiskey »

zoover2020 wrote: post #108
donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

This is why PHP is mostly banned at bigCo

To paraphrase: you can write PHP in any language. PHP is a negative bias for bigCo mostly because of the folkloric history of bad security practices by some PHP software developers.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#115

Post by whafro »

I’ve seen so many teams that fail to realize that once you use a domain in any significant way, you’re basically bound to renewing it until the heat death of the universe – or at least the heat death of your team.

Whether it’s this sort of thing, a stale-but-important URL hanging out somewhere, someone on your team signing up for a service with an old domain-email, or whatever, it’s just so hard to know when it’s truly okay let an old domain go.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#116

Post by 8organicbits »

quesera wrote: post #99
8organicbits wrote: post #84

Earlier quoted context omitted.

Bank websites like chase.com and hsbc.com and web services like google.com, amazon.com, and amazonaws.com intentionally avoid DNSSEC. I wouldn't consider those sites less than "very trustworthy" but my point is that "adequately trustworthy" is the goal. All-or-nothing thinking isn't how we build and secure systems.

I am definitely not arguing in favor of DNSSEC. However, I don't think it's reasonable to call DNS, as a system, "very trustworthy". "Well-secured" by active effort, and consequently "adequately trustworthy" for consumer ecommerce, sure. But DNS is a systemic weak link in the chain of trust, and must be treated with extra caution for "actually secure" systems. (E.g., for TLS and where possible, the standard way to re…

Is certificate pinning common? On the web we used to have HPKP, but that's obsolete and I didn't think it was replaced. I know pinning is common in mobile apps, but I've generally heard that's more to prevent end-user tampering than any actual distrust of the CAs/DNS.

I think you're "well-secured" comment is saying the same thing I am, with some disagreement about "adequate" vs "very". I don't spend any time worrying that my API calls to AWS or online banking transactions are insecure due to lack of DNSSEC, so the DNS+CA system feels "very" trustworthy to me, even outside ecommerce. The difference between "very" and "adequate" is sort of a moot point anyway: you're not getting extra points for superfluous security controls. There's lots of other things I worry about, though, because attackers are actually focusing their efforts there.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#117

Post by phplovesong »

zoover2020 wrote: post #108
donatj wrote: post #64

I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Why? Dear god why. Please stop. PHP provides a built in escaper for this purpose eval($var . '=' . var_export($itm, true) . ';'); But even then you don't need eval here! ${$var} = $itm; Is all you really needed... but really just use an array(map) if you want dynamic…

This is why PHP is mostly banned at bigCo

Pretty much. PHP for a banking software? For anything money related? Goomg to have a bad time.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#118

Post by Fileformat »

The real solution to WHOIS is RDAP.

Unfortunately, it isn't required for ccTlds, and there are plenty of non-ccTlds that aren't working.

https://en.wikipedia.org/wiki/Registration_Data_Access_Proto...

https://resolve.rs/domains/rdap-missing.html

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#119

Post by GTP »

colmmacc wrote: post #40
candiddevmike wrote: post #28

Earlier quoted context omitted.

Our industry needs to finish what it starts. Between IPv6, DNSSEC, SMTP TLS, SCTP/QUIC, etc all of these bedrock technologies feel like they're permanently stuck in a half completed implementation/migration. Like someone at your work had all these great ideas, started implementing them, then quit when they realized it would be too difficult to complete.

If you look at say 3G -> 4G -> 5G or Wifi, you see industry bodies of manufacturers, network providers, and middle vendors who both standardize and coordinate deployment schedules; at least at the high level of multi-year timelines. This is also backed by national and international RF spectrum regulators who want to ensure that there is the most efficient use of their scarce airwaves. Industry players who lag too muc…

AFAIK, in the case of IPv6 it's not even that: there's still the open drama of the peering agreement between Cogent and Hurricane Electrics.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#120

Post by Arch-TK »

account42 wrote: post #77
iscoelho wrote: post #3

Great write-up - the tip of the iceberg on how fragile TLS/SSL is. Let's add a few: 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) 2. DNS CAA records aren't protected by DNSSEC, as absence of a DNS record isn't sign-able (correction: NSEC is an optional DNSSEC extension) 3. DNS root & TLD servers are poorly protected against BGP hijacks (adding that DNSSEC is optional for CAs to veri…

> 1. WHOIS isn't encrypted or signed, but is somehow suitable for verification (?) HTTP-based ACME verification also uses unencrypted port-80 HTTP. Similar for DNS-based verification.

If it used HTTPS you would have a bootstrapping problem.
Post reply on HN