Conversation

Colm MacCárthaigh
@colmmacc
Unless I'm mis-reading the domain history, this domain was (and is) DNSSEC signed and that did not prevent the takeover. The attackers move is to hi-jack the HTTP endpoints instead of DNS servers, get the cert through HTTP upload verification, and then MiTM.
Quote Tweet
Michal Špaček
@spazef0rze
Replying to @danielcormier and @campuscodi
Good question. With BGP hijack in progress, seems the hackers were able to obtain a valid TLS cert for developers.kakao.com, see crt.sh/?q=developers. (now revoked).
3
37
Colm MacCárthaigh
@colmmacc
DANE would not prevent this kind of attack. Nor would it materially prevent later re-use of the certificate. If the attacker can control a victim's routing, then they can pivot to the HTTPS IPs anyway. WebPKI revocation is what helps here.
2
9
Colm MacCárthaigh
@colmmacc
I say all this because DNSSEC proponents make claims about DANE being useful against BGP hi-jacks, but that usefulness is very limited and reliant on old attacker tactics that seem to have changed.
2
17
Daniel Micay
@DanielMicay
Replying to
@colmmacc
and
@tqbf
Not clear why you're talking about DANE. They don't use it and the clients don't use it. DNSSEC doesn't imply DANE. DNSSEC by itself is not a substitute for WebPKI and doesn't make WebPKI secure. CAA and accounturi exist and could make it less bad via DNSSEC. That's not DANE.
1
2