1 Million Domains Could Be Stolen with a Sitting Duck Attack

[@KevinKevin-v8h]

The first story is rather interesting. I work in web hosting and our company is not vulnerable. We work off 'domain references' whereby an account has authority over a domain. If someone comes along and tries to use such domain by adding it in their account under a web hosting package, they need to prove who they are usually by removing nameservers or adding a DNS record where necessary. I am surprised that more companies don't have such policies.

[@ibrahimdevx]

yeah cloudflare etc shopify even has these

[@MrTomiCeZet]

im surprised too

[@Chuck8541]

Prisoner exchange is the nicer term of describing dirty politics.

[@MoreBollocks-ui2zs]

Have you ever encountered clean politics?

[@Chuck8541]

@@MoreBollocks-ui2zs haha No, not at all. But I do believe there are ‘levels’ of corruption. Like, pocketing a few hundred thousand, or million bucks, is less severe than say, willingly sacrificing lives, which is less severe than intentionally weakening and selling out the country to adversaries.

[@WalnutBun]

RE: the response to the "sitting duck attack", those companies may have a point that you shouldn't just leave a domain pointing somewhere you don't control, but at the same time they have a responsibility to make sure that their services aren't being used to distribute malware or conduct phishing scams.

[@Frech_Dachs]

I think the point was made by companies acting as DNS registrar and not by those actually hosting any content, which makes it totally valid.

[@orc001]

Do they, though?

[@megaTiagoNunes1]

​​@@orc001 Absolutely they have a point. It's web hosts that are ignoring the security concerns in their domain management feature. And it would be very simple for them to solve, by requiring some change to DNS records whenever the users add a domain, such as a unique id, which needs to be added as TXT record.

[@voidsp]

@@megaTiagoNunes1 if a domain is not delegated (or delegated incorrectly, to nowhere), there is no way to add any records (TXT including). Any workflow that would require a TXT record would be a mess. Best that could be done is to require a random security code added to whois info (I think there are comment fields or something), but it's a question whether domain registrars support that. And that's inconvenient too. It seems that asking to keep track of your domains and delegations is the a sane approach.

[@megaTiagoNunes1]

@@voidsp If there is an issue with the DNS management delegation, you can remove the NS record on the domain registrar platform, in which case you can add the TXT records all you want. If you check the Github issues, the solutions implemented involve requiring verification via TXT record (e.g. MediaTemple) or a new NS record be added every time (e.g. Cloudflare).

[@puporka5941]

Theories something like this could’ve happened with FurAffinity is going on right now. It’s a very popular furry website (one of the only of its kind) that got hacked and compromised. They’ve copied the FA webface to grab user’s personal info, a lot of who are artists and thus often have their bank and other very close info tied to their accounts through email or name. It’s still an ongoing issue but it’s genuinely baffling how stuff like this isn’t caught when first discovered. So many people are gonna be impacted by this. I only hope that it’s only trolls trying to be mean to furries (even tho that’s already bad) rather than some larger and more malicious act :(

[@BattyBest]

Trust white hats to come up with the cutest nicknames possible in stark contrast to the total edgelords black hats are. Black hats discover an exploit, they name it "SkvllCr4ck3r1337" White hats discover an exploit, they go, "Duck! Duck! Quack! Quack! Perfect name!" Its very clear which community has a larger intersection with the weeb community.

[@dhillaz]

Pompompurin certainly bucked that trend 😂

[@ammarash5449]

Well, a bit of mix tho... If we talked about Russia or edgy script kiddies TA, sure their username are edgy... But for "possible" non America enemies originated TA, many of their names or their association are either weebs and furries...

[@1308lee]

White hat hackers are just the edgey gay furries that have grown up and settled down

[@earthling_parth]

So no one thinks it's because they have to explain the exploit and work with non-IT folks to fix it? It's easier to use simpler plain English terms there.

[@ian562ADF52E]

​@1308lee so are black hats, re: siege sec

[@grapesurgeon]

Wow, the perfectly spoofed emails... Crazy. Need to just go to websites myself from now on instead of clicking on email links.

[@Guardiosecurity]

Great video, thank you for including our recent research on EchoSpoofing!

[@Elytrii]

Hi guardio

[@InternetFox_]

this has been in my head for so long i assumed this was fixed(Sitting Duck Vulnerability)

[@user-fed-yum]

DNS. Imagine you are a domain owner and you don't have full control over your registrar and DNS configuration 😱 Imagine being a hosting provider, knowingly supplying dns results to hosts in your network, that are potentially different from the same queries out on the public internet 😱

[@ydupc]

how am i gonna fall for a phishing email when i dont even read my emails LOL

[@ultrastoat3298]

So in the sitting duck attack, how is the attacker generating a SSL certificate?

[@orange8175]

basically if you are a cyber-criminal Do not go on a holiday

[@nojuanatall3281]

Gotta stay in Russia. Can't blame them for needing to get away though.

[@orange8175]

@@nojuanatall3281 that's also true

[@slowdownex]

Really bro. They released Sereznov, you've got to be kidding. What the fuck are they thinking? That he's not going to turn around and start being active again?

[@ThisFinalHandle]

Yeah, a spy can't be put back into service easily but cybercriminal could be off and running as soon as you give them a phone.

[@eightbo]

I think you misunderstand the situation. Nobody is claiming he won't get up to nefarious activities again. US govt. must've simply deemed the upside to received prisoners worth it based on their own criteria, which is going to be rather complex to evaluate with so many prisoners involved. They likely would have gone back and forth with other names who won ultimately exchanged before arriving at this particular deal.

[@tacokoneko]

You need to think about it this way, this is warm war/cold war 2, and it's impressive negotiation to get, from the US perspective, 16 innocent people freed from torture camps, in exchange for Russia being given jurisdiction over some white collar _nonviolent_ criminals who were Russian nationals so from the perspective of Russian government, they should have been extradited to Russia and not the US

[@tacokoneko]

i read up on the 16 people Russia freed and they were almost all convicted of espionage in Russia for things like taking photos of tanks and sending them to NATO authorities, this makes them traitors/spies from the perspective of Russian loyalists but innocent from the USA perspective, you just have to understand that is how the world is and has been for about 80 years

[@Brurgh]

@@tacokoneko "some white collar nonviolent criminals who were Russian nationals" with friends in high places.

[@peq42_]

3:02 yet again, everyone using the SAME service causing issues

[@9hoot789]

And said issues being some of the most basic easily avoidable things possible. It's amazing how sloppy enormous security tech firms are. They should be held liable.

[@peq42_]

@@9hoot789 agreed

[@Official_Baba_yaga]

That duck attack is basically subdomain takeover 😂😂😂

[@InJulyWeTrust]

yep

[@Seytonic]

Similar outcome, totally different method.

[@InJulyWeTrust]

@@Seytonicahhh this is domain takeover not subdomain

[@trueriver1950]

Except that it works on the main domain as well as it's sub domains: you might call it sub domain takeover on steroids

[@neiltsakatsa]

@@SeytonicThe concept is the same

[@MuhammadKhizerJaved]

The first one is similar to the Subdomain Takeover attack! Unlike Subdomain Takeover This is something not many services are vulnerable to

[@kenmack]

I’ve never understood how services that have you point your domain to their name-servers aren’t required by law to have some sort of verification process. I’ve considered this kind of attack before - but I figured there had to be some sort of safeguard I hadn’t considered, apparently not.

[@jb5631]

Why would you bother? In my opinion it's fully the responsibility of the domain owner. They manage which nameservers it points to. The same could happen if they forget to renew it and someone takes it over or if they point to a nameserver domain that got into other hands.

[@user-pr6uk6pm6i]

I remember when NetworkChuck did a video about this.

[@badopsec]

they free’d roman 😮

[@somthinwrong]

For duck sake

[@Legitti]

CloudFlare DNS

[@𠀖]

krebson security, huh? haven't heard that name in a while

[@ElonTusk..]

the last guy is a legend

[@arijanrahimic3210]

Same works with github pages when dns isnt changed

[@bluesquare23]

That sitting duck attack is interesting. 🤔 I guess you’d have to win the luck of the draw and get assigned the same two name servers when adding the domain. But you probably add and remove it a few times to get there. Yeah then even if you didn’t register the domain you could have full control over it. Is kind of a problem for domain owners. But I can see why hosts might want to work in some sort of auth system before allowing people to add domains hrmmm…

[@megaTiagoNunes1]

In Digital Ocean the name servers you're assigned are always the same for everyone: ns1, ns2 and ns3

[@marens101]

Assuming you're talking about how Cloudflare assigns a random 2 nameservers from a pool? Those are actually assigned to the account, not the domain (so multiple new domains will get the same nameservers). However, if the domain is already using your account's assigned nameservers when you go to add it to your cloudflare account it generates a new pair just for that domain. You can't just reroll until you get the ones already in use, because that pair will specifically not be chosen

[@kuukeli]

thank you for posting

[@M3PH11]

5:14 notice how all the domains are for US based companies?

[@iTzStick]

Why wouldn't you just delete the domain or remove the nameserver when you stop using it?

[@trueriver1950]

You might think that as it costs nothing to keep it till it expires, you might as well keep it in case you want to use it again after all, or on case you get a juicy offer to buy the rights to the name. The flaw in that thinking is that there is a cost invoked in leaving it insecure: a relationship cost if it's actually repurposed by a third party...

[@iTzStick]

@@trueriver1950 What? No im saying you SHOULD remove the nameservers or delete the domain when you are done using it as it CAN be at risk. If you wanna keep the domain just remove the nameservers. Read my comment again bro.. im agreeing with you.

[@therealdatenshi]

have you heard anything about the not socradar databreach

[@boreal3255]

is the joke "Nutsack Radar?"

[@therealdatenshi]

@@boreal3255 would like for that to be the case however one of my email addresses, and one of my friends’ has appeared in a breach labelled this on HIBP, unsure of how big it is

[@jeanlasalle2351]

What is a databreach?

[@㘭]

The duck attack is actually very easy. I setup a program to auto steal netlify domains, and I tested it and it worked perfectly. :/

[@LeonEdwinsHeart]

Awwww snap!

[@kcnl2522]

I dont understand the second one, anyone bother to give me a simpler explanation?

[@1.4142]

goop in the url

[@archytype.mp3]

lol

[@taureon_]

27 gopos

[@stickinthemud23]

Mediur? I think you meant media.

[@JonMurray]

Thanks man, great update as always.

[@Seytonic]

Thanks my dude : )

[@neiltsakatsa]

Sitting Duck Attack 😂😂😂 LMAO Originally called a domain or subdomain takeover. This has been a known issue in the Cyber Space for quite a while now 😂😂😂

[@moonkairiki1177]

yeah i was thinking that exact thing

[@Seytonic]

Not really, subdomain takeovers usually happen because of a forgotten about CNAME record (which is essentially a domain alias). A sitting duck attack is a total domain takeover which allows you to send emails from the domain, etc, (not possible with subdomain takeover)

[@neiltsakatsa]

@@Seytonic From your explanation, the vulnerability stems from dangling DNS Records that point to an instance that no longer exists allowing an attacker to register an instance with the same domain or subdomain. Other providers such as Google and AWS fixed this issue by requiring domain or subdomain verification i.e you now have to add a .TXT DNS Record with certain metadata to your domain hosting provider to prove that you own the domain.

[@jb5631]

​@@Seytonicyes there is a difference but simplified they are the same: Someone who messed up by not removing old records...

[@corners1733]

bruh

[@George-George-George]

I actually saw that proof point issue at my job. Only assumed it was a misconfiguration done by my organization not that it was a global issue.

[@angrydachshund]

Ditto

[@macjonte]

In the video there is a list of web hotels and if they’re vulnerable or not. Care to share the address?

[@Seytonic]

Should be in the description, the GitHub link

[@macjonte]

Oh 😅 first link Anyways, thanks for always great reports. Amazing job you do.

[@dfs-comedy]

Both the Sitting Duck attack and the phishing campaign have one thing in common: They rely on lots of people using centralized services (like Digital Ocean for DNS or Microsoft for email) so that bad actors can also use those services. People are no longer running their own DNS and email infrastructure, and here we see one of the downsides. (I run both my own DNS and email servers, FWIW.)

[@ComputerGoat]

I laugh at your silly duck attacks

[@perryplatypus937]

gotta store domains with a rubber duck now huh

[@monkaSisLife]

if you dont change your dns its your own fault.

[@ggsap]

yes but the import service could easily be made in such a way that bad actors cant take over them

[@jb5631]

​@@ggsapyes but why would they? As domain owner you have a responsibility. If you can't even take care of your own domain for smthg as simple as that, then better stay away from it.

[@ggsap]

@@jb5631 why would they not if its such an easy fix and prevents their services from being used as malware hosts? it only tarnishes their reputation

[@joostvhts]

guys how many of us recently watched a long video about Klyushin?

[@SASTSimon]

What

[@lanecolvin95]

O man the fact they are all using the same company I see that and I'll pick a smaller opinion with less companies

[@weshuiz1325]

Wait... russian released 16 people and the us 18, that doesn't seem fair

[@KimYoungUn69]

Usa released murderers etc and russians released journalists

[@Seytonic]

Actually the Russians released 16 and only got 8 in return. But one of their guys was a convicted assassin, so a big bargaining chip for the US

[@adrianTNT]

Russia released 16 and got 8, is it fair now ? 🤣 Double standards.

[@iyeetsecurity922]

*_HACK THE PLANET!!!_*

[@huddunlap3999]

Biden strikes again.

[@te-tra]

Oof

[@R_C420]

YOUR COCA-COLA SUBSCRIPTION HAS EXPIRED! Click here to take immediate action so you don't experience service interruptions.

[@xenostim]

shut up and take my -money- gift cards!

[@clar1016]

How would you defend against a sitting duck attack if you're digital ocean, as this is at the DNS level?

[@alexandrebaux4042]

You could ask users to add a txt record with an unique id, proving that they are in fact the owner of the domain

[@clar1016]

@@alexandrebaux4042 But you're adding the domain as DNS on DO, that means the bad actor just adds the txt record as the NS is already pointing to DO for the domain.

[@megaTiagoNunes1]

​@@clar1016 No, this way you would need to add the TXT record on the DNS service provider before you could even add the domain on your DO project. This would work, and it was the solution applied on MediaTemple.

[@jalpaca]

All 3rd party NS providers are not vulnerable. There are already techniques in use to make sure you don't enable domain hijacking. One way you can make sure that a person claiming a domain name actually owns it is to ask them to make changes at the registrar level. For example, here is what Google is asking you to do if you want to set up your domain name for Google Workspace: "Verify your domain: [...] 1: You'll copy a verification code from the Google Workspace setup tool. 2: You'll sign in to your domain registrar and paste the verification code in to the DNS [TXT] records for your domain. After your domain registrar publishes your verification code, we'll know you are the owner of your domain." Digital Ocean could implement something similar. Alternatively, some 3rd party NS service providers ask you to assign a random set of specific subdomains as name servers, and they make sure that these don't match the ones you've already set up on the registrar side. This way, they can force you to make changes at the registrar level, which proves you own the domain.

[@Rerbun]

As you could see in the video a lot of companies don't have the vulnerability, so it is possible. I think Cloudflare generates a random string that you need to add to your TXT records that you need to re-do whenever you re-add it to another account

[@Appleloucious]

3:15 "[...]No real clue[...]" while showing the senders mail? If one is not looking at the sender one should not be using mail.

[@anteshell]

Exactly, no real clue. In email, only the domain name really matters because you cannot possibly know all of the local-parts the company uses. "Local-part" being the text before the @. Thus, if the domain is legitimate, you have no ways to validate the local-part, if that is too.

[@darkcrox]

sheesh, and here I thought something happened to duckdns phew

[@Jack-yz5ws]

huh

[@saddy4420]

hurb

[@bretwebber7484]

Wtfomgnotlol 🎉

[@Raecrisos]

This so inconvenience no wonder my hosting provider refused us to use their DNS without having domain or service associate with the domain under them

[@𠀖]

hiyah

[@long-to-short]

please dont stop making videos no matter what, your content is sooooo good. so thanks a lot 🤍

[@trueriver1950]

Microsoft is are fault with this spam hack

[@NotFamousWasHere]

I think he's dead

[@vigoworkchannel1681]

Stop talking to people anyhow. In the beginning of your video, what does idea suck? Yall need to put some respect in your copy and stop talking to people like everyone is a loser

[@Seytonic]

Is this rage bait?

[@vigoworkchannel1681]

@@Seytonic stop talking to people anyhow in your copy. Stop running from the point lazy ass

[@mikescholz6429]

I just got my domains back a couple days ago from someone in china holding them hostage for 3 years.

[@jb5631]

Hostage like how?

[@adamfrank2566]

Meh

[@immameme]

Duck 🦆 Attack and HackerNewsImma1st Don't take my comments seriously. It's only a meme

[@tvojejbabkydedko]

Was expecting another western propaganda = bad russian hackers lmao, should also mention good ukraine hackers