Subject: [Acme] dns challenges and dynamic dns services (security considerations for domain holders)

From: Frederik Braun <[email-masked]>
Date: Fri, 29 Jan 2016 14:47:57 +0100

Hi,

I filed a pull request proposing some text around the following issue [1]:

It appears to me that it is not unlikely to get a subdomain from someone
else's domain. Nobody would assume that the subdomain could be used to
compromise or endanger the actual domain. This is how dynamic dns
services operate: Everyone can get foo.dyndns.example

I'm concerned that an attacker might request
_acme-challenge.dyndns.example and get a valid certificate for
dyndns.example.

Comparing the dns challenge scheme with other meaningful TXT records
(e.g., SPF), I would suggest that the dns challenge TXT record should
maybe live on the domains TXT record itself?

e.g., dyndns.example IN TXT "_acme-challenge=value"

As far as I understand, this attack is not as bad because a security
conscious domain holder has their domain registered as a public suffix.

Cheers,
Frederik

[1] https://github.com/ietf-wg-acme/acme/pull/76

---

From: "Patrick Burroughs" <[email-masked]>
Date: Fri, 29 Jan 2016 07:34:30 -0700

On Fri, 29 Jan 2016 14:47:57 +0100
Frederik Braun <[email-masked]> wrote:

> [...] I would suggest that the dns challenge TXT record should
> maybe live

As I understand it, wouldn't this prevent you from setting challenges
for subdomains that are CNAMEs? A TXT record can't coexist with a CNAME
for the same subdomain.

Regards,
~Patrick

---

From: moparisthebest <[email-masked]>
Date: Fri, 29 Jan 2016 10:11:20 -0500

Hello Frederik,

> _acme-challenge.dyndns.example and get a valid certificate for

Does there exist a dynamic DNS service that allows setting TXT records?
 I've never seen one.  Also this can also be easily mitigated by them
just disallowing the _acme-challenge subdomain similar to the way they
probably all disallow www.

Thanks,
moparisthebest

---

From: Frederik Braun <[email-masked]>
Date: Fri, 29 Jan 2016 16:26:13 +0100

> probably all disallow www.

https://freedns.afraid.org/ allows TXT records. They now forbid
_acme-challenge subdomains after I reached out.

I'm concerned that everyone having to update their blacklists[1] will
lead to more trouble.

[1] Of course, security based on black lists is not a great idea. But
that's the reality.

---

From: James Cloos <[email-masked]>
Date: Fri, 29 Jan 2016 11:52:11 -0500

>>>>> "FB" == Frederik Braun <[email-masked]> writes:

FB> I'm concerned that everyone having to update their blacklists[1] will
FB> lead to more trouble.

They really all ought to forbid any label which start with an
underscore.

Wasn't that part of the motivation for using an underscore to initiate
such lables?

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 0x997A9F17ED7DAEA6

---

From: Andrew Ayer <[email-masked]>
Date: Fri, 29 Jan 2016 09:38:06 -0800

On Fri, 29 Jan 2016 11:52:11 -0500
James Cloos <[email-masked]> wrote:

> FB> I'm concerned that everyone having to update their blacklists[1]
> FB> will lead to more trouble.
> 

Agreed.  Underscores are not allowed in hostnames, so dynamic DNS
services should not allow registration of such names (I don't even
understand why they would allow TXT records).  If they do allow
registration of arbitrary TXT records for names starting with
underscores, then they are also allowing attackers to set arbitrary
DKIM and DMARC records for their domain, and probably inflict other
damage.

The dynamic DNS service in question[1] also claims support for SRV
records, so there's a good chance they're also allowing attackers to
hijack various services for their domain.

I consider this similar to (but less likely than) web hosts allowing
user uploads to the /.well-known directory.  Operators ought to know
better, and while there's a risk that some won't, it's a risk that has
to be tolerated if DV is to exist at all.

Andrew

[1] https://freedns.afraid.org/