121–130 of 206 posts
Earlier quoted context omitted.
What if somebody has a bad DNS resolver and what he qualifies as a valid DNS request, researchers do not. I get the general idea, but having "user-privacy oriented" and "we collect everything and make it available to many researchers" services under the same IP may lead to some issues.
Even a bad DNS resolver will still send to port 53. The privacy policy probably applies to anything on ports 53, 80, and 443.
From a marketing point of view, I think it was a brilliant move from Cloudflare to get the 1.1.1.1 address. Clearly better than 8.8.8.8! But from a user perspective, why couldn't they have just let that address be... So many things are going to break just because Cloudflare wants a pretty IP. Sure, the things that break were using a hack, but in my opinion that doesn't automatically make it okay to break it. Now I'm…
Earlier quoted context omitted.
It was reworded enough times to make their promise vague and not well defined.
I’m Cloudflare’s CEO. What questions do you have? I’ll start: do we ever store 1.1.1.1’s users’ IPs? No. They’re never written to disk. And APNIC never has access to them. What data do you provide to APNIC? We give APNIC reports on non-DNS data that’s hitting 1.1.1.1. It includes information like: what protocols are sending data to the IP, what’s the volume, where it it coming from? For DNS users of 1.1.1.1, we never…
To protect against that, could you commit not to log to disk any queries that come from fewer than N ips in 24 hours, and not to expose rare queries to APNIC or internally? (Not a demand, just brainstorming mitigation.)
It might also be fun to give an internal team access to the data you consider safe, and challenge them to dig up personal data from it.
Earlier quoted context omitted.
Wow I’m surprised. That is such a low barrier to doing your own BGP hijackig.
Any sane bgp neighbor has prefix limit ACLs and prefix filters in place on their edge connections to another peer. As an ISP that announces a lot of space and customer space to 2 upstream transits, every time we take on a new downstream customer that brings their own /24 or bigger, we need to have our upstream transit providers update their prefix-list filters. If our upstreams were clueless or negligent, it would be…
We forgot to create some IRR entries and GTT just accepted our prefixes.
There is essentially no security, it's fairly trivial to hijack whatever space you want. (Doing it undetected is more difficult though!)
Earlier quoted context omitted.
As an ex-Comcast employee. Seeing stuff like that happen really doesn't surprise me When Comcast first rolled out that data cap nation wide, I started prodding at it one night out of morbid curiosity Turned out that it would silently slurp all HTTP traffic! Once you hit some arbitrary measurement (EG: 50%) it'll immediately start hijacking all HTTP websites you visit and inject a ton of Javascript to put a message ov…
And people wonder why https everywhere is such a necessity now. It should not be necessary to treat your last mile ISP as a hostile entity , but sadly, it often is.
Earlier quoted context omitted.
And people wonder why https everywhere is such a necessity now. It should not be necessary to treat your last mile ISP as a hostile entity , but sadly, it often is.
Your last mile ISP is almost certainly a hostile entity, but HTTPS alone isn't going to save you [0]. [0]: www.cs.umd.edu/class/fall2017/cmsc818O/papers/tangled-mass.pdf
Earlier quoted context omitted.
It's even easier to steal a phone number. Lots of phone companies still just approve a port if you send them the required paperwork to initiate a port. That means with zero verification from the account holder a number can vanish from your account.
Worse. Some very large carriers don't even look at the supporting documentation (bill, LOA) submitted with port orders unless there's a rejection from the losing carrier and they want to double check the address entered or something. Hijacking numbers is crazy simple. Same for hijacking the SMS functionality of any number in the US (voice traffic remains untouched). In about 10 minutes you can start receiving SMS dir…
Err. That's pretty much every implementation of 2FA around the world.
Why isn't this more well known ?
A German podcaster who has been working on networks for decades once said that he owns a large chunk of public IP addresses in the 192.68.0.0/16 subnet and it's impossible for him to use it because once he activates it he basically gets a DDOS of misdirected traffic. So many misconfigured networks out there...
I solidly feel it’s a cop out for an ISP to not filter their traffic to block spoofed IPs. In my eyes, there’s zero legitimate reason that this guy should get flooded, but alas, our industry gets lazier and more careless each year.