Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Network Security

6/20/2019
12:30 PM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Defense Discovered for Defending Against BGP Hijacking & Off-Path DNS Attacks

Certificate Authorities are continually getting requests from threat actors who want certificates that they aren't entitled to so that their criminal schemes may be furthered.

Certificate Authorities (CAs) are continually getting requests from threat actors who want certificates that they aren't entitled to so that their criminal schemes may be furthered.

Researchers from Princeton outlined last year how one specific kind of attack on the CA using Border Gateway Protocol can be performed. They found that such an attack would fool the Let's Encrypt, Comodo, Symantec, GoDaddy and GlobalSign CAs.

When a CA is asked to sign a certificate, the CA must establish that the client requesting the certificate is the legitimate owner of the domain name in question. The domain control validation (DCV) process is how it makes that call.

The usual DCV process may include a specific DNS resource record, uploading a specific tagged document to the server linked to the domain, or by proving ownership of the domain's administrative email account.

The previous research showed that by rerouting the DCV messages, threat actors could fool the CA into granting a certificate that never should have been issued.

Cloudflare thinks it has a solution. They announced that, "We're excited to announce that Cloudflare provides CAs a free API to leverage our global network to perform DCV from multiple vantage points around the world. This API bolsters the DCV process against BGP hijacking and off-path DNS attacks."

They went on to say, "Given that Cloudflare runs 175+ datacenters around the world, we are in a unique position to perform DCV from multiple vantage points. Each datacenter has a unique path to DNS nameservers or HTTP endpoints, which means that successful hijacking of a BGP route can only affect a subset of DCV requests, further hampering BGP hijacks. And since we use RPKI, we actually sign and verify BGP routes."

The multipath DCV checker consists of two services. First are DCV agents that are responsible for performing DCV out of a specific datacenter, and a DCV orchestrator that handles multipath DCV requests from CAs and dispatches them to a subset of DCV agents. Prateek Mittal, coauthor of the "Bamboozling Certificate Authorities with BGP" paper, wrote to Cloudflare that:

"Our analysis shows that domain validation from multiple vantage points significantly mitigates the impact of localized BGP attacks. We recommend that all certificate authorities adopt this approach to enhance web security."

Probably the best recommendation that Cloudflare has for this approach is that they dog food ("eat their own dog food") with it. They are using the DCV agents for their own internal activities. Cloudflare has set up an address for DCV queries from those who may want to use it, and those interested are urged to email [email protected]

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
Edge-DRsplash-10-edge-articles
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34682
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
CVE-2021-31811
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-31812
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-32552
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.
CVE-2021-32553
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.