Given the scenario that:
- Victim rents
VM1from a cloud provider, and points his/her DNS record to that
VM1's IP address
- Victim deletes
VM1and switches to a different cloud provider, and creates
VM2there, but forgets to modify the DNS record (before deleting the old VM, but after creating the new VM)
- The Victim's DNS record is now pointing to an uncontrolled IP, which could be claimed by Attacker
- A few days later, Victim realizes that the DNS record was not modified, and points the record
VM2, thus fixing the issue
- Victim issues a new certificate for the domain on
VM2, using e.g. Let's Encrypt
In the few days between
Step 3 and
Step 4, Attacker could have taken control over the IP the DNS record was pointed to.
Attacker could have issued a new certificate with e.g. Let's Encrypt, using which, Attacker could have obtained a private key & certificate for the domain, valid for at least 3 months. Attacker could use this obtained (and still valid) certificate in the future to perform MITM attacks between Victim and
VM2 since the certificate would be valid, even after Victim modifies the DNS record.
Is it possible for Victim to verify that no malicious certificates were issued in the few days between
Step 3 and
- Is searching for new entries in Certificate Transparency logs sufficient? What if an authority doesn't log the new certificate publicly?
- If it is not possible to verify that no certificate was issued, should Victim stop using that domain (and its subdomains) completely? How long should Victim wait before using the domain name again (to make sure any malicious certificates previously issued expire)?