The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability

Re:The Orphaned Internet – Taking Over 120K Domains via a DN... by jlgaddis on Tuesday December 06, 2016 @06:16PM (#13119117)

Imagine Foo, Inc., a hot new startup disrupting $industry. DNS for foo.com (which was paid up for several more years) is hosted on Route 53.

One day, they run out of money and close up shop. Their Amazon AWS accounts get shut down. The domain gets wiped from Route 53.

You come along and add foo.com as a hosted zone in Route 53. You point MX RRs towards a machine you control and begin reading the mail sent to [email protected] that will continue to arrive for the next several years. Perhaps you even use your new access to all @foo.com addresses to do some password resets on long forgotten accounts.

[ Parent | on HN ]

Re:The Orphaned Internet – Taking Over 120K Domains via a DN... by icedchai on Tuesday December 06, 2016 @07:19PM (#13119455)

The same thing can happen if the domain expires and you re-register it, right?

[ Parent | on HN ]

Re:The Orphaned Internet – Taking Over 120K Domains via a DN... by duskwuff on Tuesday December 06, 2016 @08:55PM (#13119900)

Correct. The only difference is that the behavior is expected when you register the domain yourself.

[ Parent | on HN ]

Re:The Orphaned Internet – Taking Over 120K Domains via a DN... by BillinghamJ on Tuesday December 06, 2016 @06:21PM (#13119142)

The combination of this being fairly unlikely to be attempted, along with Foo Inc no longer existing, I really don't think this is a significant issue.

[ Parent | on HN ]

Re:The Orphaned Internet – Taking Over 120K Domains via a DN... by jlgaddis on Tuesday December 06, 2016 @11:21PM (#13120435)

I manage some mail servers for an ISP. There have been times when I've came across domains that we still have control over but the companies are long gone. Many times I'll "recycle" domains (old ones of mine, "donated" domains, or some of these "forgotten" domains) and use them for spam traps.

Typically, I wait until a domain hasn't been used legitimately for e-mail for at least one year (i.e. I'll set "null" MX records or point them to a non-existent host) before I repurpose them. You might be surprised at the types of e-mails that start flowing right back in after pointing the MX RR back to a real host: lots of it is crap (spam), but I've received travel itineraries, notifications from AmEx, appointment reminders from medical facilities, and all kinds of good stuff.

[ Parent | on HN ]

Re:The Orphaned Internet – Taking Over 120K Domains via a DN... by voltagex_ on Tuesday December 06, 2016 @07:27PM (#13119492)

This would be valid for bug bounties on things like HackerOne. I wonder if this attack is in any writeups.

[ Parent | on HN ]