Hacker News new | ask | show | jobs
by icedchai 82 days ago
Once you have control of the destination, you could get a valid SSL certificate with Letsencrypt or whatever.
1 comments
surround 82 days ago
Wow I'm surprised, you're right, and it has happened before:

> the attacker issued and registered a free temporary 3-month certificate for the developers[.]kakao.com domain through SSL certificate issuer called ZeroSSL. Because the routing policy was already manipulated by the BGP Hijacking, the attacker was able to register the certificate.

https://medium.com/s2wblog/post-mortem-of-klayswap-incident-...

link
sureglymop 82 days ago
You could mitigate this by monitoring certificate transparency logs for unwanted certificates issued for your domain.

Currently there are no good monitors though aka the system is a bit broken.

link
pocksuppet 82 days ago
And another one: https://notes.valdikss.org.ru/jabber.ru-mitm/
link
icedchai 81 days ago
It sounds like that one may have been the result of a "lawful intercept", so perhaps not necessarily BGP hijacking. If you have legitimate control of the ASN/network, it's not a hijack.
link