Taking control of all .io domains with a targeted registration

Re:Taking control of all .io domains with a targeted registr... by vbernat on Monday July 10, 2017 @05:03PM (#14739644)

There is a more detailed followup today: https://news.gandi.net/en/2017/07/detailed-incident-report/

[ Parent | on HN ]

Re:Taking control of all .io domains with a targeted registr... by vertex-four on Monday July 10, 2017 @07:58PM (#14740630)

> These credentials were likewise not obtained by a breach of our systems and we strongly suspect they were obtained from an insecure connection to our technical partner’s web portal (the web platform in question allows access via http).

This makes no sense - how did the attacker get between gandi.net and their technical partner in order to MITM them? MITMs aren't magic - simply sending an unencrypted password somewhere doesn't result in it becoming public knowledge unless a router or switch in the path is malicious.

[ Parent | on HN ]

Re:Taking control of all .io domains with a targeted registr... by musicnarcoman on Tuesday July 11, 2017 @04:13AM (#14742403)

> This makes no sense - how did the attacker get between gandi.net and their technical partner in order to MITM them?

On the top of my head, bgp hijacking perhaps?

> MITMs aren't magic

No. But do not trust the network. Ever.

[ Parent | on HN ]

Re:Taking control of all .io domains with a targeted registr... by vertex-four on Tuesday July 11, 2017 @07:54AM (#14743360)

If it's BGP hijacking, there'll be evidence somewhere.

And no, don't trust the network, but "the network isn't trustworthy" is not a diagnosis, only a potential risk factor. "X entity used BGP hijacking to situate their router between me and Y" is a diagnosis.

[ Parent | on HN ]