Hacker News Reader

But if you control the DNS, you can serve a fake LinkedIn from linkedin.com. Can't do https though.

Edit: Ignore it, I forgot he didn't control the DNS at that point. So this is invalid.

But the attacker didn't yet control the DNS when he sent the link to the exploit; he needed the exploit in order to compromise the router and put the DNS hijack in place. So I'm not sure how the hell it worked.

Note that at that point in the attack, he had not yet gained access to the router, so he didn't control DNS yet.

Oh yes, I missed that fact. Sorry.

Reply on news.ycombinator.com