Ask HN: How did the internet discover my subdomain? • Hacker News Board

Re: Ask HN: How did the internet discover my subdomain?

#291

Post by pacificmint » Sat, Mar 08, 2025, 6:07 AM UTC

cryptonector wrote: post #245

yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

> Security by obscurity does not work. You can not rely on "people won't find it". Once it's online, everyone can find it. No matter how you hide it. Especially do not name your domainnames in a way that leaks MNPI! Like, imagine if publicly traded companies A and B were discussing a merger or acquisition, do not name your domainname A-and-B.com, m'kay?

Case in point: When Daimler and Chrysler merged, they had a law firm (with no other ties to either company) register the DaimlerChrysler domains weeks before the merger was made public.

I don’t recall if anybody noticed before they went public, but as this thread shows, today it would be noticed for sure.

Re: Ask HN: How did the internet discover my subdomain?

#292

Post by HeatrayEnjoyer » Sat, Mar 08, 2025, 7:01 AM UTC

ehutch79 wrote: post #231

HeatrayEnjoyer wrote: post #230

Earlier quoted context omitted.

If security through obscurity didn't provide any benefit then governments wouldn't have built entire frameworks for protecting classified information.

So the only thing protecting classified docs is the public not knowing where they are? That's what security through obscurity is.

No, it's not the only thing, but it is one layer of defense in depth.

No one is saying that obfuscation should be the only layer. Your defense should never hinge on any single protection layer.

Re: Ask HN: How did the internet discover my subdomain?

#293

Post by genewitch » Sat, Mar 08, 2025, 8:02 AM UTC

MyOutfitIsVague wrote: post #208

elliotbnvl wrote: post #201

Earlier quoted context omitted.

verb: keep from being seen; conceal. In what way is what he’s describing not obscurity?

Two points: 1. Encrypted data is not hidden. You still know that there is data, it's just in a form that you can't understand. Just as difficult higher-level math isn't "obscured" from a non-mathematician (who knows that it is math, but can't decode it), encrypted data is not obscured. 2. You could make the argument that the data is actually hidden, but the fact that data is there is not hidden. This is pointless ped…

Running your SSH server on port 8822 is security through obscurity.

Port knocking isn't, I don't think.

Re: Ask HN: How did the internet discover my subdomain?

#294

Post by denysvitali » Sat, Mar 08, 2025, 8:03 AM UTC

melevittfl wrote: post #121

p0w3n3d wrote: post #91

Earlier quoted context omitted.

Finding IP does not mean finding the domain. When doing HTTP request to IP you specify the domain you want to connect to. For example you can configure your /etc/hosts to have xxxnakedhamsters.google.com pointing to 8.8.8.8 and make the http request, which will cause Google getting the domain request (i.e. header Host: xxxnakedhamsters.google.com) and it will refuse it or try to redirect to http. Of course it's only…

But there's no evidence in the OP's post that they have, in fact, discovered the domain. The only thing posted is that there is a GET request to a listening web server. The OP and all the people talking about certificates are making the same assumption. Namely that the scanning company discovered the DNS name for the server and tried to connect. When, if fact, they simply iterate through IP address blocks and make ge…

I really doubt CloudFlare gives them an IPv4 and they can see all the logs for said IPv4

Re: Ask HN: How did the internet discover my subdomain?

#295

Post by genewitch » Sat, Mar 08, 2025, 8:07 AM UTC

Diggsey wrote: post #270

TZubiri wrote: post #143

Earlier quoted context omitted.

"Security by obscurity does not work" This is one of those false voyeur OS internet tennets designed to get people to publish their stuff. Obscurity is a fine strategy, if you don't post your source that's good. If you post your source, that's a risk. The fact that you can't rely on that security measure is just a basic security tennet that applies to everything: don't rely on a single security measure, use redundant…

This is the worst take... People consistently misuse the Swiss cheese security metaphor to justify putting multiple ineffective security barriers in place. The holes in the cheese are supposed to represent unknown or very difficult to exploit flaws in your security layers, and that's why you ideally want multiple layers. You can't just stack up multiple known to be broken layers and call something secure. The extra l…

I've heard that Swiss cheese analogy when it comes to the seasoning on a cast iron pan.

Even if you have tons and tons of layers of seasoning, you still don't put tomato sauce or whatever on it.

Re: Ask HN: How did the internet discover my subdomain?

#296

Post by genewitch » Sat, Mar 08, 2025, 8:09 AM UTC

TZubiri wrote: post #269

wolrah wrote: post #255

Earlier quoted context omitted.

> "Security by obscurity does not work" The saying is "security by obscurity is not security" which is absolutely true. If your security relies on the attacker not finding it or not knowing how it works, it's not actually secure. Obscurity has its own value of course, I strongly recommend running any service that's likely to be scanned for regularly on non-standard ports wherever practical simply to reduce the number…

>"If your security relies on " Again, if your security relies on any one thing, it's a problem. A secure system needs redundant mechanisms. Can you think of a single mechanism that if implemented would make a system secure? I think not.

Sure, a 12 gauge slug right through the processor.

Re: Ask HN: How did the internet discover my subdomain?

#297

Post by genewitch » Sat, Mar 08, 2025, 8:12 AM UTC

bob1029 wrote: post #214

TZubiri wrote: post #143

Earlier quoted context omitted.

"Security by obscurity does not work" This is one of those false voyeur OS internet tennets designed to get people to publish their stuff. Obscurity is a fine strategy, if you don't post your source that's good. If you post your source, that's a risk. The fact that you can't rely on that security measure is just a basic security tennet that applies to everything: don't rely on a single security measure, use redundant…

Obscurity can be fantastic. One of my favorite patterns for sending large files around is to drop them in a public blob storage bucket with a type 4 guid as the name. No consumer needs to authenticate or sign in. They just need to know the resource name. After a period of time the files can be automatically expired to minimize the impact of URL sharing/stealing.

Wouldn't the blob storage host be able to see your obscure file?

I suppose if it's encrypted, no. Like the pastebin service I run, it's encrypted at rest. It doesn't even touch disks, so I mean, that's a decent answer to mine own question.

Re: Ask HN: How did the internet discover my subdomain?

#298

Post by MacGyver101 » Sat, Mar 08, 2025, 8:35 AM UTC

Let me list some of the ways that precious subdomain could have been leaked

1) CZDS/DNS record sharing program

2) CT Logs

3) Browser SCT audit

4) Browser telemetry

5) DNS logs

6) DPI

7) Antivirus/OS telemetry

8) Virus/Malware/Tracker

9) Brute forcing DNS records

10) DNSSEC

11) Server softwares with AutoTLS

12) Servers screaming their hostnames over any protocol/banner thing

13) Typing anything on the browser search bar

14) Posting it anywhere

And many other novel ways I can't think of right now. I have successfully hidden some of my subdomains in the past but it definitely requires dedication. Simple silly mistakes can make all your efforts go waste. Ask any red/blue teamer.

Want to hide something? Roll everything on your own.

Re: Ask HN: How did the internet discover my subdomain?

#299

Post by Saris » Sat, Mar 08, 2025, 12:49 PM UTC

>I am using CloudFlare for my DNS.

Could have been discovered from the SSL cert request for the subdomain.

Re: Ask HN: How did the internet discover my subdomain?

#300

Post by TZubiri » Sat, Mar 08, 2025, 1:47 PM UTC

yatralalala wrote: post #177

TZubiri wrote: post #143

Earlier quoted context omitted.

"Security by obscurity does not work" This is one of those false voyeur OS internet tennets designed to get people to publish their stuff. Obscurity is a fine strategy, if you don't post your source that's good. If you post your source, that's a risk. The fact that you can't rely on that security measure is just a basic security tennet that applies to everything: don't rely on a single security measure, use redundant…

So many thoughts on that, but from my perspective - obscurity is ok, but you can not depend on it at all. Great example is port knocking - it hides your open port from random nmap, but would you leave it as the only mechanism preventing people getting to your server? No. So does it make sense to have it? Well maybe, it's a layer. Kerckhoffs' principle comes to my mind as well here. So while I agree with you on that's…

>obscurity is fine strategy, you can never depend on it ever.

Right, I'm arguing that this is a property of all security mechanisms. You can never depend on a single security mechanism. Obscurity is no different. You cannot depend only on encryption, you cannot depend only on air gaps, you cannot depend only on obscurity, you cannot depend only on firewalls, you cannot depend only on user permissions, you cannot depend only on legal deterrents, you cannot depend only on legal threats, etc..