Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Network Security

6/20/2019
12:30 PM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Defense Discovered for Defending Against BGP Hijacking & Off-Path DNS Attacks

Certificate Authorities are continually getting requests from threat actors who want certificates that they aren't entitled to so that their criminal schemes may be furthered.

Certificate Authorities (CAs) are continually getting requests from threat actors who want certificates that they aren't entitled to so that their criminal schemes may be furthered.

Researchers from Princeton outlined last year how one specific kind of attack on the CA using Border Gateway Protocol can be performed. They found that such an attack would fool the Let's Encrypt, Comodo, Symantec, GoDaddy and GlobalSign CAs.

When a CA is asked to sign a certificate, the CA must establish that the client requesting the certificate is the legitimate owner of the domain name in question. The domain control validation (DCV) process is how it makes that call.

The usual DCV process may include a specific DNS resource record, uploading a specific tagged document to the server linked to the domain, or by proving ownership of the domain's administrative email account.

The previous research showed that by rerouting the DCV messages, threat actors could fool the CA into granting a certificate that never should have been issued.

Cloudflare thinks it has a solution. They announced that, "We're excited to announce that Cloudflare provides CAs a free API to leverage our global network to perform DCV from multiple vantage points around the world. This API bolsters the DCV process against BGP hijacking and off-path DNS attacks."

They went on to say, "Given that Cloudflare runs 175+ datacenters around the world, we are in a unique position to perform DCV from multiple vantage points. Each datacenter has a unique path to DNS nameservers or HTTP endpoints, which means that successful hijacking of a BGP route can only affect a subset of DCV requests, further hampering BGP hijacks. And since we use RPKI, we actually sign and verify BGP routes."

The multipath DCV checker consists of two services. First are DCV agents that are responsible for performing DCV out of a specific datacenter, and a DCV orchestrator that handles multipath DCV requests from CAs and dispatches them to a subset of DCV agents. Prateek Mittal, coauthor of the "Bamboozling Certificate Authorities with BGP" paper, wrote to Cloudflare that:

"Our analysis shows that domain validation from multiple vantage points significantly mitigates the impact of localized BGP attacks. We recommend that all certificate authorities adopt this approach to enhance web security."

Probably the best recommendation that Cloudflare has for this approach is that they dog food ("eat their own dog food") with it. They are using the DCV agents for their own internal activities. Cloudflare has set up an address for DCV queries from those who may want to use it, and those interested are urged to email [email protected]

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15058
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
CVE-2020-15059
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
CVE-2020-15060
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15061
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
CVE-2020-15062
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.