Category Archives: dns spoofing

I just finished reading a Wired article about a DNS hijack where the attackers redirected all bank traffic to servers they hosted on Google Cloud. What I thought was interesting about the story is that they redirected to valid HTTPS websites with certificates for some legitimacy:

But the Brazilian bank attackers exploited their victim’s DNS in a
more focused and profit-driven way. Kaspersky believes the attackers
compromised the bank’s account at Registro.br. That’s the domain
registration service of NIC.br, the registrar for sites ending in the
Brazilian .br top-level domain, which they say also managed the DNS
for the bank. With that access, the researchers believe, the attackers
were able to change the registration simultaneously for all of the
bank’s domains, redirecting them to servers the attackers had set up
on Google’s Cloud Platform.2

With that domain hijacking in place, anyone visiting the bank’s
website URLs were redirected to lookalike sites. And those sites even
had valid HTTPS certificates issued in the name of the bank, so that
visitors’ browsers would show a green lock and the bank’s name, just
as they would with the real sites. Kaspersky found that the
certificates had been issued six months earlier by Let’s Encrypt, the
non-profit certificate authority that’s made obtaining an HTTPS
certificate easier in the hopes of increasing HTTPS adoption.

My question is how did they do that, if you attempt access a website using https then can an attacker who controls the DNS for the hostname redirect your request to another https website without any certificate warning? For example if I type in to my browser https://www.santanderbank.com and an attacker has taken over that DNS, can they redirect that to a valid https://www.santanderb4nk.com without the browser warning me? Assume the attacker has the certificate to www.santanderb4nk.com but does not have the certificate to www.santanderbank.com.

Continue reading DNS hijack redirect from one HTTPS hostname to another?→