Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

Post by marshray » Thu, Dec 21, 2023, 1:06 AM UTC

Zuiii wrote: post #123

ajb wrote: post #42

Earlier quoted context omitted.

Well in my case (and a lot of other people), 192.168.1.1 is the local address of my home router. So if I go to microsoft.com I have a 1 in 7 chance of getting my home router instead (if I ignore the certificate warning). Other random breakage will happen depending on what that local address is assigned to for you. In theory this could be leveraged for hacking, but I think that would require setup in advance.

yep. If a hacker can somehow control 192.168.1.1 or 192.168.0.1 they get access to your microsoft.com cookies at least. I'm sure there are more microsoft specific ways to leverage this too (e.g. data/updates hosted on microsoft.com that misuse HTTPS as a poor man's authentication. The curl | sh crowd are especially susceptible to this problem.)

Post by account42 » Thu, Dec 21, 2023, 10:30 AM UTC

iameli wrote: post #39

Wait wait wait wait. Bunny.net accidentally changed their DNS to 127.0.0.1 and took a bunch of their CDN users down today too. Coincidence? Weird day.

Post by devilsAdv0cate » Thu, Dec 21, 2023, 11:23 PM UTC

Post by zenexer » Mon, Dec 25, 2023, 11:16 PM UTC

awill wrote: post #139

zenexer wrote: post #82

Earlier quoted context omitted.

Only one of those is authoritative. All of the authoritative servers have dropped it. Microsoft has fixed the issue.

Yea, sure, but that's like saying "company X stopped selling poison, it's Shop Y's fault that they're still selling it". Nope. This is still Microsoft's fault while non-auth servers update.