The first story is rather interesting. I work in web hosting and our company is not vulnerable. We work off 'domain references' whereby an account has authority over a domain. If someone comes along and tries to use such domain by adding it in their account under a web hosting package, they need to prove who they are usually by removing nameservers or adding a DNS record where necessary. I am surprised that more companies don't have such policies.
@ibrahimdevxАй бұрын
yeah cloudflare etc shopify even has these
@MrTomiCeZet20 күн бұрын
im surprised too
@Chuck8541Ай бұрын
Prisoner exchange is the nicer term of describing dirty politics.
@MoreBollocks-ui2zs28 күн бұрын
Have you ever encountered clean politics?
@Chuck854128 күн бұрын
@@MoreBollocks-ui2zs haha No, not at all. But I do believe there are ‘levels’ of corruption. Like, pocketing a few hundred thousand, or million bucks, is less severe than say, willingly sacrificing lives, which is less severe than intentionally weakening and selling out the country to adversaries.
@WalnutBunАй бұрын
RE: the response to the "sitting duck attack", those companies may have a point that you shouldn't just leave a domain pointing somewhere you don't control, but at the same time they have a responsibility to make sure that their services aren't being used to distribute malware or conduct phishing scams.
@Frech_DachsАй бұрын
I think the point was made by companies acting as DNS registrar and not by those actually hosting any content, which makes it totally valid.
@orc001Ай бұрын
Do they, though?
@megaTiagoNunes1Ай бұрын
@@orc001 Absolutely they have a point. It's web hosts that are ignoring the security concerns in their domain management feature. And it would be very simple for them to solve, by requiring some change to DNS records whenever the users add a domain, such as a unique id, which needs to be added as TXT record.
@voidsp28 күн бұрын
@@megaTiagoNunes1 if a domain is not delegated (or delegated incorrectly, to nowhere), there is no way to add any records (TXT including). Any workflow that would require a TXT record would be a mess. Best that could be done is to require a random security code added to whois info (I think there are comment fields or something), but it's a question whether domain registrars support that. And that's inconvenient too. It seems that asking to keep track of your domains and delegations is the a sane approach.
@megaTiagoNunes128 күн бұрын
@@voidsp If there is an issue with the DNS management delegation, you can remove the NS record on the domain registrar platform, in which case you can add the TXT records all you want. If you check the Github issues, the solutions implemented involve requiring verification via TXT record (e.g. MediaTemple) or a new NS record be added every time (e.g. Cloudflare).
@puporka594120 күн бұрын
Theories something like this could’ve happened with FurAffinity is going on right now. It’s a very popular furry website (one of the only of its kind) that got hacked and compromised. They’ve copied the FA webface to grab user’s personal info, a lot of who are artists and thus often have their bank and other very close info tied to their accounts through email or name. It’s still an ongoing issue but it’s genuinely baffling how stuff like this isn’t caught when first discovered. So many people are gonna be impacted by this. I only hope that it’s only trolls trying to be mean to furries (even tho that’s already bad) rather than some larger and more malicious act :(
@BattyBestАй бұрын
Trust white hats to come up with the cutest nicknames possible in stark contrast to the total edgelords black hats are. Black hats discover an exploit, they name it "SkvllCr4ck3r1337" White hats discover an exploit, they go, "Duck! Duck! Quack! Quack! Perfect name!" Its very clear which community has a larger intersection with the weeb community.
@dhillazАй бұрын
Pompompurin certainly bucked that trend 😂
@ammarash5449Ай бұрын
Well, a bit of mix tho... If we talked about Russia or edgy script kiddies TA, sure their username are edgy... But for "possible" non America enemies originated TA, many of their names or their association are either weebs and furries...
@1308leeАй бұрын
White hat hackers are just the edgey gay furries that have grown up and settled down
@earthling_parth28 күн бұрын
So no one thinks it's because they have to explain the exploit and work with non-IT folks to fix it? It's easier to use simpler plain English terms there.
@ian562ADF52E26 күн бұрын
@1308lee so are black hats, re: siege sec
@grapesurgeonАй бұрын
Wow, the perfectly spoofed emails... Crazy. Need to just go to websites myself from now on instead of clicking on email links.
@Guardiosecurity26 күн бұрын
Great video, thank you for including our recent research on EchoSpoofing!
@Elytrii25 күн бұрын
Hi guardio
@InternetFox_Ай бұрын
this has been in my head for so long i assumed this was fixed(Sitting Duck Vulnerability)
@user-fed-yumАй бұрын
DNS. Imagine you are a domain owner and you don't have full control over your registrar and DNS configuration 😱 Imagine being a hosting provider, knowingly supplying dns results to hosts in your network, that are potentially different from the same queries out on the public internet 😱
@ydupc9 күн бұрын
how am i gonna fall for a phishing email when i dont even read my emails LOL
@ultrastoat329827 күн бұрын
So in the sitting duck attack, how is the attacker generating a SSL certificate?
@orange8175Ай бұрын
basically if you are a cyber-criminal Do not go on a holiday
@nojuanatall3281Ай бұрын
Gotta stay in Russia. Can't blame them for needing to get away though.
@orange8175Ай бұрын
@@nojuanatall3281 that's also true
@slowdownexАй бұрын
Really bro. They released Sereznov, you've got to be kidding. What the fuck are they thinking? That he's not going to turn around and start being active again?
@ThisFinalHandleАй бұрын
Yeah, a spy can't be put back into service easily but cybercriminal could be off and running as soon as you give them a phone.
@eightboАй бұрын
I think you misunderstand the situation. Nobody is claiming he won't get up to nefarious activities again. US govt. must've simply deemed the upside to received prisoners worth it based on their own criteria, which is going to be rather complex to evaluate with so many prisoners involved. They likely would have gone back and forth with other names who won ultimately exchanged before arriving at this particular deal.
@tacokonekoАй бұрын
You need to think about it this way, this is warm war/cold war 2, and it's impressive negotiation to get, from the US perspective, 16 innocent people freed from torture camps, in exchange for Russia being given jurisdiction over some white collar _nonviolent_ criminals who were Russian nationals so from the perspective of Russian government, they should have been extradited to Russia and not the US
@tacokonekoАй бұрын
i read up on the 16 people Russia freed and they were almost all convicted of espionage in Russia for things like taking photos of tanks and sending them to NATO authorities, this makes them traitors/spies from the perspective of Russian loyalists but innocent from the USA perspective, you just have to understand that is how the world is and has been for about 80 years
@Brurgh27 күн бұрын
@@tacokoneko "some white collar nonviolent criminals who were Russian nationals" with friends in high places.
@peq42_Ай бұрын
3:02 yet again, everyone using the SAME service causing issues
@9hoot789Ай бұрын
And said issues being some of the most basic easily avoidable things possible. It's amazing how sloppy enormous security tech firms are. They should be held liable.
@peq42_Ай бұрын
@@9hoot789 agreed
@Official_Baba_yagaАй бұрын
That duck attack is basically subdomain takeover 😂😂😂
@InJulyWeTrustАй бұрын
yep
@SeytonicАй бұрын
Similar outcome, totally different method.
@InJulyWeTrustАй бұрын
@@Seytonicahhh this is domain takeover not subdomain
@trueriver1950Ай бұрын
Except that it works on the main domain as well as it's sub domains: you might call it sub domain takeover on steroids
@neiltsakatsaАй бұрын
@@SeytonicThe concept is the same
@MuhammadKhizerJaved19 күн бұрын
The first one is similar to the Subdomain Takeover attack! Unlike Subdomain Takeover This is something not many services are vulnerable to
@kenmack29 күн бұрын
I’ve never understood how services that have you point your domain to their name-servers aren’t required by law to have some sort of verification process. I’ve considered this kind of attack before - but I figured there had to be some sort of safeguard I hadn’t considered, apparently not.
@jb563128 күн бұрын
Why would you bother? In my opinion it's fully the responsibility of the domain owner. They manage which nameservers it points to. The same could happen if they forget to renew it and someone takes it over or if they point to a nameserver domain that got into other hands.
@user-pr6uk6pm6i27 күн бұрын
I remember when NetworkChuck did a video about this.
@badopsecАй бұрын
they free’d roman 😮
@somthinwrong19 күн бұрын
For duck sake
@LegittiАй бұрын
CloudFlare DNS
@𠀖Ай бұрын
krebson security, huh? haven't heard that name in a while
@ElonTusk..Ай бұрын
the last guy is a legend
@arijanrahimic3210Ай бұрын
Same works with github pages when dns isnt changed
@bluesquare23Ай бұрын
That sitting duck attack is interesting. 🤔 I guess you’d have to win the luck of the draw and get assigned the same two name servers when adding the domain. But you probably add and remove it a few times to get there. Yeah then even if you didn’t register the domain you could have full control over it. Is kind of a problem for domain owners. But I can see why hosts might want to work in some sort of auth system before allowing people to add domains hrmmm…
@megaTiagoNunes1Ай бұрын
In Digital Ocean the name servers you're assigned are always the same for everyone: ns1, ns2 and ns3
@marens101Ай бұрын
Assuming you're talking about how Cloudflare assigns a random 2 nameservers from a pool? Those are actually assigned to the account, not the domain (so multiple new domains will get the same nameservers). However, if the domain is already using your account's assigned nameservers when you go to add it to your cloudflare account it generates a new pair just for that domain. You can't just reroll until you get the ones already in use, because that pair will specifically not be chosen
@kuukeliАй бұрын
thank you for posting
@M3PH1129 күн бұрын
5:14 notice how all the domains are for US based companies?
@iTzStickАй бұрын
Why wouldn't you just delete the domain or remove the nameserver when you stop using it?
@trueriver1950Ай бұрын
You might think that as it costs nothing to keep it till it expires, you might as well keep it in case you want to use it again after all, or on case you get a juicy offer to buy the rights to the name. The flaw in that thinking is that there is a cost invoked in leaving it insecure: a relationship cost if it's actually repurposed by a third party...
@iTzStickАй бұрын
@@trueriver1950 What? No im saying you SHOULD remove the nameservers or delete the domain when you are done using it as it CAN be at risk. If you wanna keep the domain just remove the nameservers. Read my comment again bro.. im agreeing with you.
@therealdatenshiАй бұрын
have you heard anything about the not socradar databreach
@boreal3255Ай бұрын
is the joke "Nutsack Radar?"
@therealdatenshiАй бұрын
@@boreal3255 would like for that to be the case however one of my email addresses, and one of my friends’ has appeared in a breach labelled this on HIBP, unsure of how big it is
@jeanlasalle2351Ай бұрын
What is a databreach?
@㘭Ай бұрын
The duck attack is actually very easy. I setup a program to auto steal netlify domains, and I tested it and it worked perfectly. :/
@LeonEdwinsHeartАй бұрын
Awwww snap!
@kcnl2522Ай бұрын
I dont understand the second one, anyone bother to give me a simpler explanation?
@1.4142Ай бұрын
goop in the url
@archytype.mp3Ай бұрын
lol
@taureon_Ай бұрын
27 gopos
@stickinthemud2313 күн бұрын
Mediur? I think you meant media.
@JonMurrayАй бұрын
Thanks man, great update as always.
@SeytonicАй бұрын
Thanks my dude : )
@neiltsakatsaАй бұрын
Sitting Duck Attack 😂😂😂 LMAO Originally called a domain or subdomain takeover. This has been a known issue in the Cyber Space for quite a while now 😂😂😂
@moonkairiki1177Ай бұрын
yeah i was thinking that exact thing
@SeytonicАй бұрын
Not really, subdomain takeovers usually happen because of a forgotten about CNAME record (which is essentially a domain alias). A sitting duck attack is a total domain takeover which allows you to send emails from the domain, etc, (not possible with subdomain takeover)
@neiltsakatsaАй бұрын
@@Seytonic From your explanation, the vulnerability stems from dangling DNS Records that point to an instance that no longer exists allowing an attacker to register an instance with the same domain or subdomain. Other providers such as Google and AWS fixed this issue by requiring domain or subdomain verification i.e you now have to add a .TXT DNS Record with certain metadata to your domain hosting provider to prove that you own the domain.
@jb563128 күн бұрын
@@Seytonicyes there is a difference but simplified they are the same: Someone who messed up by not removing old records...
@corners1733Ай бұрын
bruh
@George-George-GeorgeАй бұрын
I actually saw that proof point issue at my job. Only assumed it was a misconfiguration done by my organization not that it was a global issue.
@angrydachshundАй бұрын
Ditto
@macjonteАй бұрын
In the video there is a list of web hotels and if they’re vulnerable or not. Care to share the address?
@SeytonicАй бұрын
Should be in the description, the GitHub link
@macjonteАй бұрын
Oh 😅 first link Anyways, thanks for always great reports. Amazing job you do.
@dfs-comedyАй бұрын
Both the Sitting Duck attack and the phishing campaign have one thing in common: They rely on lots of people using centralized services (like Digital Ocean for DNS or Microsoft for email) so that bad actors can also use those services. People are no longer running their own DNS and email infrastructure, and here we see one of the downsides. (I run both my own DNS and email servers, FWIW.)
@ComputerGoatАй бұрын
I laugh at your silly duck attacks
@perryplatypus937Ай бұрын
gotta store domains with a rubber duck now huh
@monkaSisLifeАй бұрын
if you dont change your dns its your own fault.
@ggsapАй бұрын
yes but the import service could easily be made in such a way that bad actors cant take over them
@jb563128 күн бұрын
@@ggsapyes but why would they? As domain owner you have a responsibility. If you can't even take care of your own domain for smthg as simple as that, then better stay away from it.
@ggsap27 күн бұрын
@@jb5631 why would they not if its such an easy fix and prevents their services from being used as malware hosts? it only tarnishes their reputation
@joostvhtsАй бұрын
guys how many of us recently watched a long video about Klyushin?
@SASTSimonАй бұрын
What
@lanecolvin95Ай бұрын
O man the fact they are all using the same company I see that and I'll pick a smaller opinion with less companies
@weshuiz1325Ай бұрын
Wait... russian released 16 people and the us 18, that doesn't seem fair
@KimYoungUn69Ай бұрын
Usa released murderers etc and russians released journalists
@SeytonicАй бұрын
Actually the Russians released 16 and only got 8 in return. But one of their guys was a convicted assassin, so a big bargaining chip for the US
@adrianTNTАй бұрын
Russia released 16 and got 8, is it fair now ? 🤣 Double standards.
@iyeetsecurity922Ай бұрын
*_HACK THE PLANET!!!_*
@huddunlap3999Ай бұрын
Biden strikes again.
@te-traАй бұрын
Oof
@R_C420Ай бұрын
YOUR COCA-COLA SUBSCRIPTION HAS EXPIRED! Click here to take immediate action so you don't experience service interruptions.
@xenostim28 күн бұрын
shut up and take my -money- gift cards!
@clar1016Ай бұрын
How would you defend against a sitting duck attack if you're digital ocean, as this is at the DNS level?
@alexandrebaux4042Ай бұрын
You could ask users to add a txt record with an unique id, proving that they are in fact the owner of the domain
@clar1016Ай бұрын
@@alexandrebaux4042 But you're adding the domain as DNS on DO, that means the bad actor just adds the txt record as the NS is already pointing to DO for the domain.
@megaTiagoNunes1Ай бұрын
@@clar1016 No, this way you would need to add the TXT record on the DNS service provider before you could even add the domain on your DO project. This would work, and it was the solution applied on MediaTemple.
@jalpacaАй бұрын
All 3rd party NS providers are not vulnerable. There are already techniques in use to make sure you don't enable domain hijacking. One way you can make sure that a person claiming a domain name actually owns it is to ask them to make changes at the registrar level. For example, here is what Google is asking you to do if you want to set up your domain name for Google Workspace: "Verify your domain: [...] 1: You'll copy a verification code from the Google Workspace setup tool. 2: You'll sign in to your domain registrar and paste the verification code in to the DNS [TXT] records for your domain. After your domain registrar publishes your verification code, we'll know you are the owner of your domain." Digital Ocean could implement something similar. Alternatively, some 3rd party NS service providers ask you to assign a random set of specific subdomains as name servers, and they make sure that these don't match the ones you've already set up on the registrar side. This way, they can force you to make changes at the registrar level, which proves you own the domain.
@RerbunАй бұрын
As you could see in the video a lot of companies don't have the vulnerability, so it is possible. I think Cloudflare generates a random string that you need to add to your TXT records that you need to re-do whenever you re-add it to another account
@ApplelouciousАй бұрын
3:15 "[...]No real clue[...]" while showing the senders mail? If one is not looking at the sender one should not be using mail.
@anteshellАй бұрын
Exactly, no real clue. In email, only the domain name really matters because you cannot possibly know all of the local-parts the company uses. "Local-part" being the text before the @. Thus, if the domain is legitimate, you have no ways to validate the local-part, if that is too.
@darkcroxАй бұрын
sheesh, and here I thought something happened to duckdns phew
@Jack-yz5wsАй бұрын
huh
@saddy4420Ай бұрын
hurb
@bretwebber7484Ай бұрын
Wtfomgnotlol 🎉
@RaecrisosАй бұрын
This so inconvenience no wonder my hosting provider refused us to use their DNS without having domain or service associate with the domain under them
@𠀖Ай бұрын
hiyah
@long-to-shortАй бұрын
please dont stop making videos no matter what, your content is sooooo good. so thanks a lot 🤍
@trueriver1950Ай бұрын
Microsoft is are fault with this spam hack
@NotFamousWasHere22 күн бұрын
I think he's dead
@vigoworkchannel1681Ай бұрын
Stop talking to people anyhow. In the beginning of your video, what does idea suck? Yall need to put some respect in your copy and stop talking to people like everyone is a loser
@SeytonicАй бұрын
Is this rage bait?
@vigoworkchannel1681Ай бұрын
@@Seytonic stop talking to people anyhow in your copy. Stop running from the point lazy ass
@mikescholz6429Ай бұрын
I just got my domains back a couple days ago from someone in china holding them hostage for 3 years.
@jb563128 күн бұрын
Hostage like how?
@adamfrank2566Ай бұрын
Meh
@immamemeАй бұрын
Duck 🦆 Attack and HackerNewsImma1st Don't take my comments seriously. It's only a meme
@tvojejbabkydedko29 күн бұрын
Was expecting another western propaganda = bad russian hackers lmao, should also mention good ukraine hackers