Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Taking control of all .io domains with a targeted registration

thehackerblog.com

Post reply on HN
Print view View original

231–240 of 258 posts

Re: Taking control of all .io domains with a targeted registration

#231

Post by mattferderer »

billyhoffman wrote: post #8
justboxing wrote: post #2

I read this, but still don't fully understand the implications or impact for .IO TLD services and domain owners. From the OP's "Impact" section. > Given the fact that we were able to take over four of the seven authoritative nameservers for the .io TLD we would be able to poison/redirect the DNS for all .io domain names registered. Not only that, but since we have control over a majority of the nameservers it’s actua…

Yes. It does. Someone noticed that the 4 of the 7 hostnames that were assigned for authoritative names servers for .IO were available for registration. They registered them, and started receiving DNS lookups for .IO hosts from what appears to be actual internet users. Since the user had 4 or the 7, its possible that the majority of DNS lookups for .IO hosts would be sent and answer by the author's systems. The author…

I feel any mention of HTTP Public Key Pinning should have the words "WARNING" surrounding it.

It can take down your site if you screw it up - https://www.smashingmagazine.com/be-afraid-of-public-key-pin...

I also believe it is one of the more difficult security features to implement & doesn't work well with Let's Encrypt https://community.letsencrypt.org/t/hpkp-best-practices-if-y...

I'm not against it and this case does seem to make me reconsider my prior risk balance assessment of implementing it.

Re: Taking control of all .io domains with a targeted registration

#232

Post by creeble »

mpounsett wrote: post #136

While it's definitely an error on the part of the backend registry operator for .io, this is not the major security issue the author describes. He couldn't have hijacked any DNS traffic this way. I've written in detail about why this is the case at https://mpounsett.blogspot.ca/2017/07/the-io-error-problem-w...

>The author assumes that because he's able to register a domain name that matches several of the authoritative name server names for the .io TLD that it is "likely that clients will randomly select our hijacked nameservers over any of the legitimate nameservers..." This is wrong.

It is definitely not wrong for a large number of resolvers. This bears out in his traffic.

It is very common for a resolver to take the list of nameservers from the root and resolve them rather than using the A records provided by the root. Quite wrong, but common. If they didn't, he would have received zero traffic.

Thus it would have been quite easy to redirect traffic for bit.io by also supplying a different set of NS records for it.

Re: Taking control of all .io domains with a targeted registration

#233

Post by rkeene2 »

Clubber wrote: post #191
michaelbuckbee wrote: post #25

So, the real question is: "How much should we freak out about this?" If you scroll back a few months to Cloudbleed/Cloudflare we sort of collectively decided that because cache data containing sensitive info (passwords, tokens, whatever) might be accessible for your site using Cloudflare that everything should be revoked, force password resets, etc. Now we have this vuln, which I'll dub "IOgate" because it's the cool…

>I'll dub "IOgate" because it's the cool thing to name these. FWIW, I've found that whenever major news outlets use the "gate" postfix for anything other than Watergate, it's an indicator that they're being manipulative (it's tabloid bullshit). The certainly didn't call it Snowdengate or Trump/Russiagate. Keep an eye out and see if you don't agree. I deem this Clubber's Law!

Clubbergate is well underway, I see.

Re: Taking control of all .io domains with a targeted registration

#234

Post by Karunamon »

sillysaurus3 wrote: post #131
Karunamon wrote: post #128

Earlier quoted context omitted.

It represents a moral judgement that it is absolutely not okay (or perhaps: irresponsible) to screw over n+y people for the actions of n people.

This moral judgement is mistaken because its premise is false. The moral blame lies on the company that allowed the problem to happen, not the person calling attention to it. It's not at all the same as "if I leave my door unlocked..." type scenarios. It's perfectly legal to register .io's nameservers.

That's a cop out. If your actions reasonably cause harm to other people, regardless if those actions are "calling attention to" or actually pulling the trigger, that's a moral evil.

If someone goes around the town telling everyone that you leave your door unlocked, while they can't be legally held responsible, they're still morally responsible if someone goes in and steals your stuff armed with that knowledge.

Companies fixing their stuff before that happens is in everyone's best interests at the end of the day - hence responsible disclosure.

Re: Taking control of all .io domains with a targeted registration

#235

Post by panglott »

moo360 wrote: post #163
nimchimpsky wrote: post #160

Earlier quoted context omitted.

> That it is a distinction is important to me. Why ?

Are you being deliberately obtuse? It's a pretty important distinction that these were not some native tribesmen with millennia of ancestral history tied up in the lands.

If a man shows up with a gun to run me off my land, it doesn't matter whether it was my father that bought it or my grandfather or my great-grandfather. What's important is the forcible dispropriation itself.

Cases like this just make a mockery of the Lockean natural rights theory of property.

Re: Taking control of all .io domains with a targeted registration

#237

Post by peterwwillis »

sillysaurus3 wrote: post #120
djsumdog wrote: post #41

Earlier quoted context omitted.

I own an .IO domain. Do I deserve to have fake LetsEncrypt certs issued against me and my domain hijacked because some engineer forgot to remove some critical NS records or forgot to register some aliases? Responsible disclosure cat is responsible!

"Responsible disclosure" is a coercive term. It implies that it's irresponsible to do anything else. "Coordinated disclosure" is far better. That said, coordinated disclosure is the neighborly thing to do, but it's by no means a moral obligation. It would be perfectly fine for the author to tweet about it, for example.

That would still be unethical. An ethical person would not commit acts which they know have the potential to cause harm to innocent people.

If you're a black hat and you don't give a shit about potential legal ramifications or any injury to anyone (partly because you fear no consequence), there's probably nothing unethical to you about fucking over a bunch of innocent people just so you can "spank" some douchebag management company into following best practices.

If you're a professional, or even a non-douchebag adult, who finds value in the ideal of protecting the innocent customers of a dangerously irresponsible corporation, you would want to work first toward protecting those individuals, and then focus on disciplining the corporation.

Re: Taking control of all .io domains with a targeted registration

#238

Post by LinuxBender »

ConfucianNardin wrote: post #229
LinuxBender wrote: post #161

Earlier quoted context omitted.

If you control the root DNS servers for .io, you can simply not answer the DNSSEC queries. Many resolvers will fail open. HSTS requires the site is HTTPS with a valid cert. If you own all .io, you can use LetsEncrypt to get that for free. They now even support Wildcard Certs! :-) That said, you would have to choose your targets carefully and/or load balance your requests to LetsEncrypt. There is a rate limit. There a…

LetsEncrypt don't support wildcards yet . They will, starting January next year.

Ah, I was not aware it would be January. Then for now the targets would have to be specific DNS records.

Re: Taking control of all .io domains with a targeted registration

#240

Post by hk__2 »

CrystalLangUser wrote: post #183
hk__2 wrote: post #84

Side note: Please don’t use such gray and thin fonts. I had to modify the CSS to use black instead of #555 for the text color.

I don't mean this pejoratively, but how old are you? I'm just curious as I had no problems with the color / font weight. For my sites I usually use something like #232323 instead of pure black.

I’m 25. I agree with other commenters that the issue is more with the font-weight than the color; I don’t have issues reading e.g. text in #666 or even #999.
Post reply on HN