Hijack of Amazon’s domain service used to reroute web traffic for two hours

Re:Hijack of Amazon’s domain service used to reroute web tra... by technion on Wednesday April 25, 2018 @01:42AM (#16918868)

I'm going to assume that Lets Encrypt wasn't impacted for the reason that there are several discussions that the hijacked myetherwallet website apparently had a self signed SSL cert running - and people were actually clicking through the warnings before handing over passwords.

Surely they would have realised they could make the whole thing a lot more profitable if any SSL provider was impacted.

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by kchr on Wednesday April 25, 2018 @07:57AM (#16920673)

But if you route all traffic for a specific domain through your own web server, surely you could complete the Letsencrypt verification steps as well. They just check for a specific file on the remote web server, right?

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by technion on Wednesday April 25, 2018 @06:07PM (#16926729)

Yes, but they weren't routing traffic for that web server to their own server. They were routing the IP of the DNS servers to their own server, and then just handing out the DNS address that suited them.

In turn, if your own DNS wasn't configured to use a DNS server with a poisoned fraudulent address, a web server based verification landed on the valid server, not the attackers.

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by kchr on Thursday April 26, 2018 @02:00AM (#16929180)

Okay, thanks for clarifying!

[ Parent | on HN ]