Re: [dane] domain hijacking

["Ken O'Driscoll" <[e-mail]>]

On Wed, 2017-04-12 at 23:04 -0700, Alice Wonder wrote:
> To compromise a zone protected by this second x.509 a bad actor would 
> need to both obtain a fraudulently signed x.509 from a trusted authority 
> *and* get fraudulent DS records into the zone's parent zone.

Or, an attacker could (as in the case we're discussing) just gain access to
the domain registry and re-assign NS records, disabling any DNSSEC type
security in the process. Resolvers have no expectation to be dealing with
DNSSEC signed zones so removing the protection would not be challenged.

Any mechanism that relies on anything that the registrant controls which
they (or an imposter with their credentials) can disable does not address
this risk.

As John already pointed out, organisations can mitigate against these
attacks by choosing registries (and registrars) who offer robust
authentication options along with employing monitoring solutions.

I'm not seeing how any type of protocol can do away with normal operational
level security.

Ken.