Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malaysia Airlines Defaced - 404 Plane Not Found

wsj.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Malaysia Airlines Defaced - 404 Plane Not Found

#31

Post by ryanlol »

Tiksi wrote: post #30
ryanlol wrote: post #24

Earlier quoted context omitted.

Akamai makes you to set your own DNS server for it to pull records from, the domain getting hijacked should not have any effect on what that DNS server is returning.

I may be missing something, but this: >It added that its domain name system was compromised. sounds like their DNS server was compromised. Also, I've never worked with Akamai, but every cdn I have worked with just follows the ns records and resolves against that, which could be changed with access to the domain/registrar. Does Akamai not do that?

Their domains DNS servers were switched to cloudflare, I'd imagine that's the DNS compromise they're referring to.

Not _their_ DNS servers getting compromised.

Re: Malaysia Airlines Defaced - 404 Plane Not Found

#32

Post by Dylan16807 »

ryanlol wrote: post #27
Dylan16807 wrote: post #23

Earlier quoted context omitted.

Not if the other comment by... you... about it being served by an external CDN is correct. HSTS could easily stop a CDN from picking up a bad version during a DNS hijack.

MAS's CDN that is. The same CDN they were using before the hack even happened.

But it being an external CDN means that there is no indication that the actual servers they have control of were tampered with. The possibility that HSTS could have saved the day is just as valid. There is no indication that the CDN got these incorrect files with any kind of encryption or signing.

Re: Malaysia Airlines Defaced - 404 Plane Not Found

#35

Post by ryanlol »

Dylan16807 wrote: post #32
ryanlol wrote: post #27

Earlier quoted context omitted.

MAS's CDN that is. The same CDN they were using before the hack even happened.

But it being an external CDN means that there is no indication that the actual servers they have control of were tampered with. The possibility that HSTS could have saved the day is just as valid. There is no indication that the CDN got these incorrect files with any kind of encryption or signing.

So CDN just works without having the SSL certs?

Re: Malaysia Airlines Defaced - 404 Plane Not Found

#36

Post by Tiksi »

ryanlol wrote: post #31
Tiksi wrote: post #30

Earlier quoted context omitted.

I may be missing something, but this: >It added that its domain name system was compromised. sounds like their DNS server was compromised. Also, I've never worked with Akamai, but every cdn I have worked with just follows the ns records and resolves against that, which could be changed with access to the domain/registrar. Does Akamai not do that?

Their domains DNS servers were switched to cloudflare, I'd imagine that's the DNS compromise they're referring to. Not _their_ DNS servers getting compromised.

Hmm, I figured it was just the records being pointed to cloudflare, since everything I could find makes it sound like that, but you may be correct that the nameservers were changed, as cloudflare's nameservers look like they have a record for the domain, but are returning different records: http://paste.click/s/qKkejf [0]

Which appears to be down now anyways: http://paste.click/s/UlxsWA [1]

However I suspect cloudflare's nameservers might just return A records pointing to cloudflare if they don't exist, I'm not sure.

Though that still doesn't answer the second part. Would Akamai not use the authoritative nameservers to resolve the origin? Cdn providers I've worked with (Level3, edgecast, Highwinds, and others) just resolve based on the authoritative nameservers, and I'm genuinely curious if Akamai doesn't do that.

Edit: forgot that my keybinding throws the js/syntax highlighted url into my clipboard, which is pointless for this, here are the plaintext links to the same thing:

[0] http://paste.click/qKkejf

[1] http://paste.click/UlxsWA

Re: Malaysia Airlines Defaced - 404 Plane Not Found

#38

Post by tombrossman »

anon1385 wrote: post #6
jrockway wrote: post #4

"Hey everyone, go visit this website that's probably serving malware!"

Google ads regularly serve malware[1], are you going to tell people not to visit Google? [1] https://news.ycombinator.com/item?id=8879229

This isn't the best way to describe the problem or solution.

Users can be advised to install an ad-blocking plugin for their web browser to protect themselves. Since Google serves adverts from domains other than google.com, users can continue to use the google.com domain for search while at the same time blocking the malware coming from ad networks.

Re: Malaysia Airlines Defaced - 404 Plane Not Found

#39

Post by ryanlol »

Tiksi wrote: post #36
ryanlol wrote: post #31

Earlier quoted context omitted.

Their domains DNS servers were switched to cloudflare, I'd imagine that's the DNS compromise they're referring to. Not _their_ DNS servers getting compromised.

Hmm, I figured it was just the records being pointed to cloudflare, since everything I could find makes it sound like that, but you may be correct that the nameservers were changed, as cloudflare's nameservers look like they have a record for the domain, but are returning different records: http://paste.click/s/qKkejf [0] Which appears to be down now anyways: http://paste.click/s/UlxsWA [1] However I suspect cloudfla…

You specify the nameserver for akamai to pull the zone from on the config site. Their "CDN" is quite a bit smarter than what L3 & co. run.

Re: Malaysia Airlines Defaced - 404 Plane Not Found

#40

Post by ryanlol »

jrockway wrote: post #37
tyho wrote: post #11

Earlier quoted context omitted.

So could attaching decent transponders to their aeroplanes.

How much more per flight would you pay for this? Satellites aren't cheap.

At their scale, yeah they are. (Especially considering you wouldn't need new sats)
Post reply on HN