Does “www.” Mean Better Transport Layer Security?

Re:Does “www.” Mean Better Transport Layer Security? by hannob on Monday August 19, 2019 @04:51AM (#20736064)

This may be surprising to some people, but it's not a new pheonoema and I feel it's kinda known in TLS circles. Everyone who's done scans on TLS vulnerabilities should know this (speaking as one of the authors of the ROBOT attack).

What's often going on is that the www domain is delegated via DNS to a thirdparty service provider, while the apex domain is hosted on some appliance and just does a simple redirect. The reason for that is that you can't do DNS delegation for an apex domain.

During our ROBOT investigations we found a particularly weird example: We found a particularly severe variant of our vulnerability in old versions of Cisco ACE load balancers. Cisco told us that these were out of support, so they're not gonna get fixed. Turns out: they used one of them to redirect cisco.com to www.cisco.com.

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by segfaultbuserr on Monday August 19, 2019 @06:51AM (#20736668)

Another implication of this result is: even if the transport layer security appears to be secure, it's possible that it only indicates the CDN setup, and the actual upstream servers are insecure.

Which means, a latest and greatest TLSv1.3 server you see may be ultimately backed by a vulnerable TLSv1.0 upstream server (or even unencrypted HTTP!).

Great news for the NSA indeed!

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by Jestar342 on Monday August 19, 2019 @10:36AM (#20738101)

Disclaimer: Asking from a place of ignorance/naivity

What does this mean for SSL termination? E.g. SSL terminates at cloudflare, internal (behind firewall) all http-sans-s?

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by psychrometer on Monday August 19, 2019 @11:48AM (#20738796)

That depends on whether that site has Flexible or Full SSL setting enabled.

https://support.cloudflare.com/hc/en-us/articles/200170416-E...

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by jdfellow on Monday August 19, 2019 @11:19AM (#20738514)

My gut says that such a thing is a bad idea and TLS for internal communications is best practice. Hard to implement though.

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by newman314 on Monday August 19, 2019 @07:59PM (#20742789)

Hard to implement but I’m slowly dragging org teama into it.

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by wolf550e on Monday August 19, 2019 @09:45AM (#20737671)

This explains why nvidia.com has terrible TLS [1] config while all their other domains are ok [2] (in particular, the domains hosting the driver downloads as ok [3]).

1 - https://www.ssllabs.com/ssltest/analyze.html?d=nvidia.com

2 - https://www.ssllabs.com/ssltest/analyze.html?d=www.nvidia.co...

3 - https://www.ssllabs.com/ssltest/analyze.html?d=us.download.n...

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by cced on Monday August 19, 2019 @06:43AM (#20736611)

I’m not sure I grasp the situation. Does this mean that third parties can modify DNS entries?

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by hannob on Monday August 19, 2019 @06:47AM (#20736645)

Well, yes, if you let them.

DNS is hierarchical. If your DNS server manages example.com then you can set a delegation for a subdomain - e.g. www.example.com - to someone else. I.e. you could say "for this subdomain the nameservers from google's cloud service are responsible". You can go further and e.g. configure the google cloud service so that abc.www.example.com goes yet to another DNS service.

So a company could say "we manage the DNS for our domain inhouse, but for www. we let some other company do it and pay them for it". This is pretty standard.

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by segfaultbuserr on Monday August 19, 2019 @06:47AM (#20736643)

> Does this mean that third parties can modify DNS entries?

Not only DNS entries, but 3rd-parties can wiretap/modify arbitrary content in all web pages if you use a CDN. That's essentially how CDNs work, you have to trust a 3rd-party if you detegate your request to a 3rd-party. I'm not saying it's necessarily bad, but there is no other way around. And in case of CloudFlare, the DNS is already fully controlled by CloudFlare.

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by zamadatix on Monday August 19, 2019 @08:23AM (#20737094)

If only CNAME flattening was part of the standard.

[ Parent | on HN ]

Re:Does “www.” Mean Better Transport Layer Security? by toast0 on Monday August 19, 2019 @02:14PM (#20740204)

CNAME flattening makes things kind of work, but if your CDN is using DNS to provide different IPs to different clients, doing a host lookup at your normal authoritative isn't going to work as well; ECS can help a bit, and maybe using anycast for apex domains helps; but it's a challenge to do well unless you delegate the whole domain.

[ Parent | on HN ]