Tell HN: Microsoft.com added 192.168.1.1 to their DNS record • Hacker News Board

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#31

Post by taspeotis » Wed, Dec 20, 2023, 12:14 AM UTC

_nickwhite wrote: post #25

An entry-level admin is now unemployed, just before the holidays.

The seniors all go on leave and the interns are left to run the place. If they fired the juniors the seniors would have to come back from holiday!

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#32

Post by wrboyce » Wed, Dec 20, 2023, 12:15 AM UTC

timschmidt wrote: post #24

edgineer wrote: post #19

What could a TLA do with this if it had time to plan ahead?

Serve malicious updates from a locally controlled machine, for one. Lord knows about auth.

Do most DNS forwarders not block addresses that resolve to a local IP these days? I know dnsmasq does, and NextDNS too I think.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#33

Post by quickthrower2 » Wed, Dec 20, 2023, 12:18 AM UTC

efortis wrote: post #10

justin_oaks wrote: post #9

I'm trying to figure out how this could have happened, but I control so few IP addresses that many of my DNS entries are manually assigned. And you'd have to be incompetent if you have access to set DNS records and you set them to RFC 1918 addresses. Anyone have any theories on how this could happen?

* Copy/Paste * Copilot told me * Sabotage (internal or external)

Or hard to reason about IaC

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#34

Post by whynotmaybe » Wed, Dec 20, 2023, 12:19 AM UTC

justin_oaks wrote: post #9

I'm trying to figure out how this could have happened, but I control so few IP addresses that many of my DNS entries are manually assigned. And you'd have to be incompetent if you have access to set DNS records and you set them to RFC 1918 addresses. Anyone have any theories on how this could happen?

I'll go with Joseph Conrad on this one.

"It's only those who do nothing that make no mistakes, I suppose."

Now the persons that did it have some proof that they did something.

They will surely put some check in place because there should be another adage somewhere that says that you only learn to use the handrails after you fell in the stairs.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#35

Post by jaza » Wed, Dec 20, 2023, 12:21 AM UTC

kotaKat wrote: post #15

Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minutes TTL ;)

30 minutes minutes or 30 Windows minutes? :P

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#36

Post by stop50 » Wed, Dec 20, 2023, 12:21 AM UTC

quickthrower2 wrote: post #30

For the uninitiated, can some traffic get sent to 192.168.1.1. Is it round robin?

Yes it is.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#37

Post by donkers » Wed, Dec 20, 2023, 12:21 AM UTC

bewaretheirs wrote: post #29

h2odragon wrote: post #3

I get it too, with .1.0 as well Name: microsoft.com Address: 192.168.1.1 Name: microsoft.com Address: 192.168.1.0 "ooopsie!"

1.1 is gone but I'm still seeing the 1.0 entry.

Same here with 1.0

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#38

Post by rasengan » Wed, Dec 20, 2023, 12:22 AM UTC

kotaKat wrote: post #15

Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minutes TTL ;)

This isn’t something that I think should be diluted.

If it’s that simple for a stray record to be included in the dns round robin it could have been bad if it was an external ip with a machine setup by a phisherman especially since control of a domain is all you need to get an ssl cert now.

Couple this with the fact that it’s Microsoft, one of the most relied on companies in our computer world, this is pretty darn horrible.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#39

Post by iameli » Wed, Dec 20, 2023, 12:23 AM UTC

Wait wait wait wait. Bunny.net accidentally changed their DNS to 127.0.0.1 and took a bunch of their CDN users down today too. Coincidence? Weird day.

Re: Tell HN: Microsoft.com added 192.168.1.1 to their DNS record

#40

Post by stkai » Wed, Dec 20, 2023, 12:25 AM UTC

kotaKat wrote: post #15

Through a series of connections I know a guy that knows a guy that works at Microsoft that was made aware and the changes have been reverted. Give 'er 30 minutes TTL ;)

I see them both. My TTL will run out at 16:39 PST, though.