Hacker News Reader

Comment by ryanlol | Hacker News Reader

None of these domain hijacking attempts would’ve been prevented by DNSSEC, right?

(Also kinda curious as to why pointing this out seems to be somewhat controversial? :)

As I understand the attacks being against the login admin accounts for managing the domain itself, no DNSSEC would not have prevented changing the records in the zone. In addition, if the DNS provider hosting that domain automatically resigned the zone for the hacked account, then the hosting company would even have resigned the zone, thus making valid DNSSEC entries anyway.

What would be better is to require 2FA for all zone hosting companies.

> What would be better is to require 2FA for all zone hosting companies.

Even with this, many registrars and DNS hosts are too fast and loose with disabling 2FA when you call them up and tell them you lost your second factor. Alternatively, requesting changes over the phone without going through web authentication. My confidence in 2FA dipped quite a bit after going through the experience myself.

Pretty sure you're right. The US-CERT advisory for this campaign implies the attackers were logging into the targets accounts at registrars or DNS providers directly.

https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS...

Not really. In theory the zone signing could be done as a separate process from zone updates, but I don't think any DNS provider implements this - they hold the keys, not you. The other attacks used compromised domain registrar accounts, where the attacker could just disable DNSSEC or switch the nameservers to whatever.

Perhaps so, given that for most DNS provider, the ability to modify DNS records automatically gives you the ability to sign those record. This shows the importance of having a dedicated system for signing information, completely separate (and potentially offline) from the deployment system.

There's an astonishing amount of fishy downvoting across this entire thread. That's weird.

This comment breaks at least two of the HN guidelines. Would you please review and follow them?

https://news.ycombinator.com/newsguidelines.html

If you think you're seeing abuse, please email us with links (hn@ycombinator.com). That's in the rules too.

Reply on news.ycombinator.com