Hijack of Amazon’s domain service used to reroute web traffic for two hours

Re:Hijack of Amazon’s domain service used to reroute web tra... by ryao on Tuesday April 24, 2018 @07:29PM (#16917563)

If the DNS servers providing that message are hijacked due to BGP, the hijacker can simply not serve that notice and the registrar doing the lookup would never see it.

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by pfg on Tuesday April 24, 2018 @07:39PM (#16917628)

This is under the assumption that CAs fail closed when they encounter DNSSEC errors (which, by some interpretations, is mandatory according to the Baseline Requirements).

Merely hijacking the authoritative DNS for a domain does not defeat DNSSEC, which chains from the root to TLDs to registered domains. In other words, and assuming all CAs are perfect w.r.t DNSSEC, you cannot spoof a "No CAA record here" response for a DNSSEC-enabled domain merely by hijacking the authoritative DNS or a resolver.

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by ryao on Tuesday April 24, 2018 @08:37PM (#16917891)

Assuming that all CAs are perfect w.r.t DNSSEC is a big assumption to make. has anyone tried verifying that for every CA?

I also had been referring more to CAA than DNSSEC. It is a premium feature at certain registrars such as GoDaddy, which hinders adoption.

[ Parent | on HN ]