A Deep Dive on the Recent Widespread DNS Hijacking

Tue Feb 26 21:34:26 UTC 2019

On Feb 25, 2019, at 1:16 PM, Hank Nussbacher <hank at efes.iucc.ac.il> wrote:
> Yes if an attacker pwned the DNS then game over no matter what. I go 
> under the assumption that the attacker was not able to take over the DNS 
> system but rather other things along the way, in which case CAA should 
> be of some assistance.

I’m excited about a proposed CAA extension (https://tools.ietf.org/html/draft-ietf-acme-caa-06) that would allow domain owners to restrict issuance to a particular ACME account and a particular validation method. This could provide stronger protection against most attacks short of a registry or registrar hijack. It’s implemented in Let’s Encrypt's staging environment, and I hope it’s able to move forward.

-- 
James Renken (pronouns: he/him)
Internet Security Research Group
Let's Encrypt: A Free, Automated, and Open CA