Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

261–270 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#261

Post by playingalong »

declan_roberts wrote: post #151
playingalong wrote: post #141

Earlier quoted context omitted.

I think it's a sane practice to keep the marketing landing page on a separate domain than the product in case of SaaS.

Why? I always get frustrated when I end up in some parallel universe of a website (like support or marketing) and I can't easily click back to the main site.

The non-technical reason is that these are usually owned by different teams in your org (after you mature beyond a 5-person startup).

The technical perspective is that things like wildcard subdomains (e.g. to support yourcustomername.example.com), or DNSSec if your compliance requires it, etc. cause an extra burden if done for these two use-cases at a time.

> can't easily click

Http pages don't have problems with having a link to example.net from within example.com. Or the opposite. Seems like an unrelated problem.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#262

Post by heavyset_go »

joelanman wrote: post #190
craftkiller wrote: post #162

Earlier quoted context omitted.

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/

interesting, why is this?

Search engines, anti-malware software, etc track sites' reputations. You don't want users' bad behavior affecting the reputation of your company's main domain.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#263

Post by astrange »

mapt wrote: post #236
ohashi wrote: post #219

Earlier quoted context omitted.

This is the most obvious reason why Verisign is a monopolist and should be regulated like a utility. They make false claims about choice and not being locked in. You buy a domain, you use it, you're locked in forever. And they know it. That's why they fight tooth and nail to protect their monopoly.

See also personal phone numbers, which are now "portable" and thus "required for every single identity verification you will ever perform", without being regulated, which means your identity is one $30 bill autopayment or one dodgy MVNO customer service interaction from being lost forever.

Not regulated? They're portable because they're regulated.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#264

Post by lilyball »

lovasoa wrote: post #206

> $ sqlite3 whois-log-copy.db "select source from queries"|sort|uniq|wc -l Oh cool they saved the logs in a database ! Wait... |sort|uniq|wc -l ?? But why ?

yeah, they could have done `sqlite …|sort -u|wc -l` instead and saved themselves a process invocation!

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#265

Post by klingoff »

astrange wrote: post #263
mapt wrote: post #236

Earlier quoted context omitted.

See also personal phone numbers, which are now "portable" and thus "required for every single identity verification you will ever perform", without being regulated, which means your identity is one $30 bill autopayment or one dodgy MVNO customer service interaction from being lost forever.

Not regulated? They're portable because they're regulated.

I'd assume regulated in the sense of identity verification and transactions. There's no legal basis for needing a north American phone number, but good luck with any US obligations if you are without one.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#266

Post by iscoelho »

michaelt wrote: post #183
iscoelho wrote: post #86

Earlier quoted context omitted.

100% - another for the BGP hijack!

The current CAB Forum Baseline Requirements call for "Multi-Perspective Issuance Corroboration" [1] i.e. make sure the DNS or HTTP challenge looks the same from several different data centres in different countries. By the end of 2026, CAs will validate from 5 different data centres. This should make getting a cert via BGP hijack very difficult. [1] https://github.com/cabforum/servercert/blob/main/docs/BR.md#...

See my post above about BGP hijacks: https://news.ycombinator.com/item?id=41511582 - They're way easier than you think.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#267

Post by neuralkoi »

develatio wrote: post #59

I have the feeling that any day now I’m gonna wake up in the morning and I’ll find out that there just isn’t internet anymore because somebody did something from a hotel room in the middle of nowhere with a raspberry pi connected to a wifi hotspot of a nearby coffee shop.

A significant amount of stuff is indeed held up by hopes and prayers [0], but by design, the internet was built to be robust [1]. In this case the scope was limited to .mobi.

[0] https://xkcd.com/2347/

[1] https://en.wikipedia.org/wiki/ARPANET#Debate_about_design_go...

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#268

Post by oasisbob »

declan_roberts wrote: post #102
post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

Don't forget about infrastructure domains, static-asset domains, separation of product domains from corporate domains ... there are plenty of good reasons to use multiple domains, especially if you're doing anything with the web where domain hierarchies and the same-origin policy are so critical to the overall security model.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#269

Post by semiquaver »

mapt wrote: post #236
ohashi wrote: post #219

Earlier quoted context omitted.

This is the most obvious reason why Verisign is a monopolist and should be regulated like a utility. They make false claims about choice and not being locked in. You buy a domain, you use it, you're locked in forever. And they know it. That's why they fight tooth and nail to protect their monopoly.

See also personal phone numbers, which are now "portable" and thus "required for every single identity verification you will ever perform", without being regulated, which means your identity is one $30 bill autopayment or one dodgy MVNO customer service interaction from being lost forever.

Phone number portability is required by law in the US since 2003. See 47 U.S.C. § 251(b)(2)

https://www.fcc.gov/general/wireless-local-number-portabilit...

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#270

Post by Wowfunhappy »

semiquaver wrote: post #269
mapt wrote: post #236

Earlier quoted context omitted.

See also personal phone numbers, which are now "portable" and thus "required for every single identity verification you will ever perform", without being regulated, which means your identity is one $30 bill autopayment or one dodgy MVNO customer service interaction from being lost forever.

Phone number portability is required by law in the US since 2003. See 47 U.S.C. § 251(b)(2) https://www.fcc.gov/general/wireless-local-number-portabilit...

What if you need to stop paying for a phone bill entirely though? Maybe you're living paycheck to paycheck and money is just too tight this month. That's what I think GP was talking about.

Is it possible to "park" your phone number until you can start a new plan?

Post reply on HN