[Cryptography] Apple's iCloud+ "VPN"

[Ray Dillinger]

On 6/26/21 10:48 AM, Bill Woodcock wrote:
>
> The way this usually plays out: A user configures multiple recursive resolvers operated by different parties. They think this will give them better reliability or resilience or something.  At some level, they’re not wrong, in too many cases.  Someone attacks their bank or whatever, hijacking the server’s domain, and the user does a DNS lookup in order to connect to what they assume will be their bank.  Their recursive resolver looks up the bank’s address, performs DNSSEC validation, discovers that the domain no longer validates, returns a fail to the user.  The user’s stub resolver says “gosh, I’ll try the next one, then.”  It moves on to the next recursive resolver, which happily resolves the MITM address, gives it to the user, the user is compromised and their bank account is emptied.  But they weren’t inconvenienced in their DNS resolution.
Whatever DNS was doing, I believe that it could not have connected
anyone to a scam run by some third party but using the correct key for
HTTPS, because I believe no such site existed.  It might; HTTPS is
horrible and fake certs from some random "authority" far down the list
are easy to get.

But that's not the point, because that's not the attack that was being
made.

DNSSEC does nothing to ensure you get access to correct DNS
information.  It only tries to prevent someone from giving out false DNS
information undetected.  But if the false information is being supplied
by an agency that doesn't give a crap whether you detect it or not, it
doesn't matter; the point is that you don't get the real information.

The guy who picked up that phone and called in a fake malware report
wasn't even attempting to spoof DNS.  He didn't have a site he wanted me
to connect to and a fake HTTPS cert and some cockamamie scheme to
convince me that bogus DNS information was correct.  He absolutely knew
that the machine I'd be connected to would not be the right machine, and
he knew it would be obvious to me that it wasn't the right machine, and
he didn't give a crap whether or not I knew.  His goal wasn't to fool me
into thinking it was correct DNS information or that I'd connected to
the right machine.  His goal was just to prevent me from having access
to the DNS information.

And I think that ought to be harder than picking up the phone and
calling in a fake malware report.

                    Bear