News for hackers. Stuff that matters.

A comment on Hijack of Amazon’s domain service used to reroute web traffic for two hours. Parent comment

Re:Hijack of Amazon’s domain service used to reroute web tra... by tialaramex on Tuesday April 24, 2018 @07:10PM (#16917473)
If you have DNSSEC with CAA, you can use that to choose a CA which has a contractual relationship with you. That contract can say anything you both like, for example it can say:

"All issuances under example.com shall first be approved by telephone call to our security office on 1-234-567-8900, and the certificate issued shall have a notBefore timestamp no earlier than 24 hours after an SCT included in the certificate"

This requires no new technology that I can see. If CAA and DNSSEC work together as intended (which I admit is a big "If" but they can and should) the Bad Guys now need to mess with the phone system for approval, then wait past the MMD and hope you aren't watching for their shenanigans. Or break into a CA and issue for themselves. That's a much higher bar, albeit at great cost.

[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by ryao on Tuesday April 24, 2018 @07:29PM (#16917563)
If the DNS servers providing that message are hijacked due to BGP, the hijacker can simply not serve that notice and the registrar doing the lookup would never see it.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by pfg on Tuesday April 24, 2018 @07:39PM (#16917628)
This is under the assumption that CAs fail closed when they encounter DNSSEC errors (which, by some interpretations, is mandatory according to the Baseline Requirements).

Merely hijacking the authoritative DNS for a domain does not defeat DNSSEC, which chains from the root to TLDs to registered domains. In other words, and assuming all CAs are perfect w.r.t DNSSEC, you cannot spoof a "No CAA record here" response for a DNSSEC-enabled domain merely by hijacking the authoritative DNS or a resolver.

[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by ryao on Tuesday April 24, 2018 @08:37PM (#16917891)
Assuming that all CAs are perfect w.r.t DNSSEC is a big assumption to make. has anyone tried verifying that for every CA?

I also had been referring more to CAA than DNSSEC. It is a premium feature at certain registrars such as GoDaddy, which hinders adoption.

[ Parent | on HN ]