21–30 of 104 posts
* ensure they’re using multifactor authentication to protect the domain’s administration panel
* check that their A and NS records are valid
* search transparency logs for unauthorized TLS certificates covering their domains and
*conduct internal investigations to assess if networks have been compromised"
https://news.ycombinator.com/item?id=17704828
I pitched that idea at startup school, and got accepted. However, after a while I pivoted to something else, as I decided that the name registry and DNS market is just too crowded. I was afraid that we'd be spending 99% of the time and budget on convincing people they need secure domain/DNS management, instead of building the technology.
Note that these attacks involve compromised accounts with authority servers , so despite being the most visible and impactful DNS attacks of the last few years, DNSSEC would have done little to defend against them; in fact, even in the DNSSEC fantasy-world where DANE replaces X.509 CAs, these attackers would still have accomplished their goals.
DNSSEC has the unique advantage of permitting offline signing. If you go this route, even somebody controlling your authoritative servers wouldn't be able to modify your records.
But it's worth keeping in mind that most organizations can't use offline signing, because the duct-tape-and-baling-wire solutions DNSSEC applies to people dumping zones with NSEC records all require online signers.
Earlier quoted context omitted.
Deprecated/killed. https://www.chromestatus.com/feature/5903385005916160
If you're confused as to why, this article was illuminating: https://scotthelme.co.uk/using-security-features-to-do-bad-t...
There's validity in the approach and I hope it comes back sometime, maybe with additional mechanism around managing pins.
Earlier quoted context omitted.
All domain-validated certificates use factors you can control if you control the domain, whether email or web or DNS. This has nothing to do with Let's Encrypt.
Yeah, but it is a problem with domain-validated certificates in general that kinda defeats the purpose of SSL. It seems most of the time that a web site is "hacked" (defaced) somebody changed the DNS instead of attacking the actual web server. SSL signing can potentially be a second line of defense, but only if having control of the DNS (thus web and email) is insufficient to get a cert.
About 20 years ago, I remember having to go through tons of hoops to get a certificate. Faxing corporate docs and other bureaucracy. That can all be forged.
Source link: https://www.fireeye.com/blog/threat-research/2019/01/global-...
Note that these attacks involve compromised accounts with authority servers , so despite being the most visible and impactful DNS attacks of the last few years, DNSSEC would have done little to defend against them; in fact, even in the DNSSEC fantasy-world where DANE replaces X.509 CAs, these attackers would still have accomplished their goals.
after reading the headline I immediately thought of "14 DNS Nerds Don't Control the Internet" [0]. [0] https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con...
But instead of 14 nerds, it's the US government (for .com).
I need to read up on DNSSEC.
Earlier quoted context omitted.
after reading the headline I immediately thought of "14 DNS Nerds Don't Control the Internet" [0]. [0] https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con...
What a strange article. I thought it was leading up to saying that control of DNSSEC is decentralized, or has a transparency process, or something. But instead of 14 nerds, it's the US government (for .com). I need to read up on DNSSEC.
The "clever trick" seems to be: previously compromised the login credentials for the administration panel of the target’s DNS provider or previously compromised domain registrar or ccTLD Unless I'm missing something, given either of those things, doesn't take much cleverness...
It's some kind of alarmism over letsencrypt ... "letsencrypt will give tricky attackers a valid certificate for a domain!!!" (if they get control over the domain) (... certs have almost always been granted based on control of the domain, though historically it mostly MX records ... so attackers could do pretty much the same thing 15 years ago)