Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hijack of Amazon’s domain service used to reroute web traffic for two hours

doublepulsar.com

Post reply on HN
Print view View original

81–90 of 291 posts

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#81

Post by cft »

laken wrote: post #66
bklyn11201 wrote: post #38

Getting a basic certificate issued is incredibly easy these days. If you own the DNS resolution, you can get a cert. Here a few ways I can think of to make this harder for an attacker: * Add a Strict-Transport-Security to all HTTPS requests. This means the attacker will need to get a valid cert (still easy if you can hijack BGP). * Pick a preferred SSL issuer and stick with them. Add a CAA DNS record only allowing th…

MyEtherWallet (which was the target) has an EV SSL certificate. That could be why they couldn't get it as easily.

Sorry, why couldn't they just replace the EV certificate with a regular "valid" certificate that they purchased from a valid CA if they controlled DNS and thus email?

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#82

Post by chatmasta »

vasilipupkin wrote: post #61

can someone ELI5 how this works? like, how do they physically do this ?

I’m not an expert, but I think it goes something like this —

You register an AS and get a dedicated server [0] at at an internet exchange point (IXP) and install a BGP router on it. Your router advertises a route to the original route53 IP, with a shorter AS path to the target IP than the route advertised by the “real” Amazon router. You peer your router with at least one provider who peers with the real route53 servers (they accept your route advertisements).

Then you redirect incoming traffic on port 53 to a mitm dns proxy, where you either do nothing or return an IP address you control, which could be anywhere.

At the IP address you control, you run a transparent HTTP proxy that signs HTTPS responses with the valid DNS cert you obtained by spoofing MX replies in the dns proxy. You then either do nothing, or modify the page to return arbitrary content (like rewriting bitcoin addresses).

[0] or you get a VPS at a provider willing to advertise BGP routes on your behalf without validating them

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#83

Post by autocracy »

nodesocket wrote: post #67
bklyn11201 wrote: post #38

Getting a basic certificate issued is incredibly easy these days. If you own the DNS resolution, you can get a cert. Here a few ways I can think of to make this harder for an attacker: * Add a Strict-Transport-Security to all HTTPS requests. This means the attacker will need to get a valid cert (still easy if you can hijack BGP). * Pick a preferred SSL issuer and stick with them. Add a CAA DNS record only allowing th…

A CAA DNS record won't help much if the attacker can just go to the certificate issuer and request a valid SSL certificate because they own DNS. Plus can't they just change the CAA DNS record?

If you are using DNSSEC, hopefully the issuers are validating it.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#84

Post by codetrotter »

nodesocket wrote: post #78

If BGP is open and anybody can modify routes, why don't these attacks happen constantly? What prevents these sort of attacks and how are they fixed?

Just guessing here but it’s only open to the companies and countries that are peering with one another isn’t it?

If so then companies that intentionally advertise routes that are not theirs to advertise would lose their peering agreements with others because other companies would no longer want to peer with them.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#86

Post by lossolo »

vasilipupkin wrote: post #61

can someone ELI5 how this works? like, how do they physically do this ?

You need to have access to BGP router (hack it for example), then using the router you announce your target IP class as yours and your BGP neighbors update theirs BGP tables. Now when someone that is near those router wants to connect to certain IP it connects to you because shortest path to that IP in BGP tables is you.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#87

Post by noselasd »

nodesocket wrote: post #78

If BGP is open and anybody can modify routes, why don't these attacks happen constantly? What prevents these sort of attacks and how are they fixed?

There's an informal trust chain. You only set up BGP peering with companies you trust, and you implement filtering of it's traffic and advertised routes that you know can be trusted.

You know that if you do something nefarious, or if someone at your downstream does something nefarious, your upstream will identify it and block your traffic, or the part of it that they identify to be the issue.

Thus as long as you need to appear on the internet, you do your best to play nice, otherwise your traffic gets blocked, and you also do your part to identify and block traffic when something goes bad.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#88

Post by autocracy »

knome wrote: post #57
omarforgotpwd wrote: post #43

Wow. Just wow. These BGP vulnerabilities are ridculous. Imagine, someone taking over DNS for even a small subset of people and being able to basically just rewrite the internet as they see fit, completely taking control of anything. Even without being able to get a valid SSL certificate you could do a lot of damage. For example, let's say I rewrote requests for SomeNationalBank.com to my proxy server. I make a reques…

DNSSEC adoption would prevent a hijacker from manipulating responses.

Buuuuut.... not if you hijack the destination route. It helps if the DNS servers are hijacked, but if you also snag the destination route's IP then you can still get the certificate and serve traffic. Sneaky sneaky.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#89

Post by nodesocket »

noselasd wrote: post #87
nodesocket wrote: post #78

If BGP is open and anybody can modify routes, why don't these attacks happen constantly? What prevents these sort of attacks and how are they fixed?

There's an informal trust chain. You only set up BGP peering with companies you trust, and you implement filtering of it's traffic and advertised routes that you know can be trusted. You know that if you do something nefarious, or if someone at your downstream does something nefarious, your upstream will identify it and block your traffic, or the part of it that they identify to be the issue. Thus as long as you need…

So if BGP is trust based and hard to compromise then how were these Russians able to?

> They re-routed DNS traffic using a man in the middle attack using a server at Equinix in Chicago.

Re: Hijack of Amazon’s domain service used to reroute web traffic for two hours

#90

Post by makomk »

dice wrote: post #5

It was certainly noticed in under 2 hours. The Outages list thread about the issue started at 11:54 UTC: https://puck.nether.net/pipermail/outages/2018-April/011257.... I'm sure that there were ops teams working on it before then. The people involved in actually fixing the problem wouldn't have been posting to public mailing lists.

Looks like it was about an hour and a half before anyone in that thread figured out there'd been a BGP hijacking.
Post reply on HN