That seems somewhat scary if they've compromised domain registrars and are inter...

jrockway · on May 7, 2013

It's more scary if they've compromised a SSL CA. A simple DNS attack won't stop your browser from displaying a broken certificate warning. (Though they can always not redirect from http to https and most users won't notice, sadly.)

blibble · on May 7, 2013

it's very easy to get your own https cert once you control the dns for a domain, you just set up own nameserver that proxies requests to the original NS (except very specific ones, say those from Verisign), request your "domain control validation" https cert, and bam! valid https cert!

jeffasinger · on May 7, 2013

A 'simple' DNS attack would get them access to the mail servers too.

There are plenty of CAs out there who will give out a (non-EV) cert to anyone who can receive emails to webmaster@example.com.

on May 7, 2013

[deleted]

bstpierre · on May 7, 2013

It said "not redirect from http to https" -- meaning that when someone requests http://example.com they would normally be redirected by the site owner to https://example.com, but the attacker could just leave the original request alone. The point is that most people wouldn't notice.

HTTPS Everywhere or similar browser plugin would probably pop up an alert if this did happen.

graue · on May 7, 2013

HTTP Strict Transport Security[1] is designed specifically to prevent that attack. Unfortunately, Linode's manager doesn't seem to use it:

    $ curl -I https://manager.linode.com/
    HTTP/1.1 200 OK
    Server: nginx/0.7.65
    Date: Tue, 07 May 2013 16:23:07 GMT
    Content-Type: text/html;charset=UTF-8
    Connection: keep-alive
    Vary: Accept-Encoding

If they were, there would be a line like this:

    $ curl -sI https://github.com | fgrep Strict
    Strict-Transport-Security: max-age=2592000

Which tells the browser, for the next 2592000 seconds (30 days), only request github.com over HTTPS, never HTTP.

Not sure why Linode isn't using HSTS — lack of awareness? The super-old version of Nginx is also a little scary.

[1] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

TheSwordsman · on May 8, 2013

Nginx 0.7.65 is packaged by Ubuntu for 10.04 LTS. Should still get security updates.