Hijack of Amazon’s domain service used to reroute web traffic for two hours

Re:Hijack of Amazon’s domain service used to reroute web tra... by nodesocket on Tuesday April 24, 2018 @03:17PM (#16915687)

A CAA DNS record won't help much if the attacker can just go to the certificate issuer and request a valid SSL certificate because they own DNS. Plus can't they just change the CAA DNS record?

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by rocqua on Tuesday April 24, 2018 @05:44PM (#16916921)

If you have DNSSEC that protects against CAA spoofing, that should also protect against A-record spoofing. Unless we fail open on A records but closed on CAA records.

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by autocracy on Tuesday April 24, 2018 @03:32PM (#16915817)

If you are using DNSSEC, hopefully the issuers are validating it.

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by move-on-by on Tuesday April 24, 2018 @04:34PM (#16916291)

I'm not able to find any information on Let's Encrypt and DNSSEC validation. Anyone know if they validate it?

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by tialaramex on Tuesday April 24, 2018 @07:21PM (#16917527)

Yes, (last I checked at least) Let's Encrypt validates DNSSEC, this causes problem periodically for users who expected something to work but the DNSSEC setup is wrong and they never noticed before because nothing checked.

[ Parent | on HN ]