Hacker News Reader

Comment by okket | Hacker News Reader

No. Routing attacks divert traffic on the IP address level to another destination. It does not matter if you protect the DNS so it resolves to the correct IP address.

View on HN

If I understand this correctly, does this mean that this is not a weakness in Quad101, but the internet infrastructure itself?

>but the internet infrastructure itself?

Kind of. The Internet is similar to a chain link fence. Every link in the chain needs to perform its role as expected, otherwise shit breaks.

In the case of the Internet, there are many ISPs that are leak links in the chain.

Yes. On the routing level. The attacker literally announces 'This IP address network is mine now' via BGP and gets the traffic. Most such incidents are not real attacks though, but misconfigurations. And there are the MANRS recommendations, which can prevent a lot of problems, including the one described in the article.

It mitigates it in the sense that the attacker presumably wont have the TLS identity required for the client to trust it.

The client won't be able to resolve anything, but it can't be used to send the client to other places, turning it into a denial of service

They can try getting a new DV cert for the domain. It may or may not work depending on how thoroughly the CA checks the domain resolution from multiple places.

Well, it protects against the DNS server itself being redirected. But it doesn’t do anything for IPs that were in the DNS answer being redirected.

Reply on news.ycombinator.com