As an aside, I haven't seen a .mobi domain out in the wild in the past 6 years.
We spent $20 to achieve RCE and accidentally became the admins of .mobi
241–250 of 391 posts
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#242Earlier quoted context omitted.
Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/
interesting, why is this?
There's historical reasons regarding per-host connection limitations of browsers. You would put your images, scripts, etc each on their own subdomain for the sake of increased parallelization of content retrieval. Then came CDNs after that. I feel like I was taught in my support role at a webhost that this was _the_ reasoning for subdomains initially, but that may have been someone's opinion.
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#243Earlier quoted context omitted.
interesting, why is this?
I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf. 2. if a user uploaded something like an html file, you wouldn't want it to be able to run j…
Wouldn't usercontent.github.com work just as well?
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#244> $ sqlite3 whois-log-copy.db "select source from queries"|sort|uniq|wc -l Oh cool they saved the logs in a database ! Wait... |sort|uniq|wc -l ?? But why ?
bash nerds vs sql nerds I guess, these people are bash nerds
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#245Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…
> If you're a business and you're looking to pick up a new domain because it's only $10/year, consider that you're going to be paying $10/year forever, because once you associate that domain with your business, you can never get rid of that association. Please elaborate... Also, what about personal domains? Does it apply there as well?
You might have accounts associated with the email. You might be a trusted or respectable member who would never.....
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#246Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#247The real solution to WHOIS is RDAP. Unfortunately, it isn't required for ccTlds, and there are plenty of non-ccTlds that aren't working. https://en.wikipedia.org/wiki/Registration_Data_Access_Proto... https://resolve.rs/domains/rdap-missing.html
How does it mitigate the issues outlined in the article?
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#248Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…
Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.
I felt the need to get in addition to (shall we say) foo-bar.nl the foobar.nl the foo-bar.com and foobar.com because I dont want a competitor picking up those and customers might type it like that.
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#249Earlier quoted context omitted.
I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf. 2. if a user uploaded something like an html file, you wouldn't want it to be able to run j…
> if a user uploaded something like an html file, you wouldn't want it to be able to run javascript on google.com (because then you can steal cookies and do bad stuff) Cookies are the only problem here, as far as I know, everything else should be sequestered by origin, which includes the full domain name (and port and protocol). Cookies predate the same-origin policy and so browsers scope them using their best guess…
There might be reason to block your user content.
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#250Earlier quoted context omitted.
100% - another for the BGP hijack!
The current CAB Forum Baseline Requirements call for "Multi-Perspective Issuance Corroboration" [1] i.e. make sure the DNS or HTTP challenge looks the same from several different data centres in different countries. By the end of 2026, CAs will validate from 5 different data centres. This should make getting a cert via BGP hijack very difficult. [1] https://github.com/cabforum/servercert/blob/main/docs/BR.md#...
It is hypothesised to make this more difficult but it's unclear how effective it is in practice. I wouldn't expect it to make a significant difference. We've been here before.