Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When internal hostnames are leaked to the clown

rachelbythebay.com

Post reply on HN
Print view View original

61–70 of 265 posts

Re: When internal hostnames are leaked to the clown

#61

Post by bardsore »

A1kmm wrote: post #41
NitpickLawyer wrote: post #12

Not sure why they made the connection to sentry.io and not with CT logs. My first thought was that "*.some-subdomain." got added to the CT logs and someone is scanning *. with well known hosts, of which "nas" would be one. Curious if they have more insights into sentry.io leaking and where does it leak to...

But she mentioned: 1) it isn't in DNS only /etc/hosts and 2) they are making a connection to it. So they'd need to get the IP address to connect to from somewhere as well.

Unless she hosts her own cert authority or is using a self-signed cert, the wildcard cert she mentions is visible to the public on sites such as https://crt.sh/.

Re: When internal hostnames are leaked to the clown

#63

Post by jeroenhd »

lsofzz wrote: post #59

[flagged]

From the article:

> Around this time, you realize that the web interface for this thing has some stuff that phones home, and part of what it does is to send stack traces back to sentry.io. Yep, your browser is calling back to them, and it's telling them the hostname you use for your internal storage box. Then for some reason, they're making a TLS connection back to it, but they don't ever request anything. Curious, right?

Unless you actively block all potential trackers (good luck with that one lol), you're not going to prevent leaks if the web UI contains code that actively submits details like hostnames over an encrypted channel.

I suppose it's a good thing you only wasted 30 seconds on this.

Re: When internal hostnames are leaked to the clown

#64

Post by jeroenhd »

A1kmm wrote: post #41
NitpickLawyer wrote: post #12

Not sure why they made the connection to sentry.io and not with CT logs. My first thought was that "*.some-subdomain." got added to the CT logs and someone is scanning *. with well known hosts, of which "nas" would be one. Curious if they have more insights into sentry.io leaking and where does it leak to...

But she mentioned: 1) it isn't in DNS only /etc/hosts and 2) they are making a connection to it. So they'd need to get the IP address to connect to from somewhere as well.

From the article:

> You're able to see this because you set up a wildcard DNS entry for the whole ".nothing-special.whatever.example.com" space pointing at a machine you control just in case something leaks. And, well, something did* leak.

They don't need the IP address itself, it sounds like they're not even connecting to the same host.

Re: When internal hostnames are leaked to the clown

#65

Post by PunchyHamster »

atmosx wrote: post #53

I bought a SynologyNAS and I have regretted already 3-4 times. Apart from the software made available from the community, there is very little one can do with this thing. Using LE to apply SSL to services? Complicated. Non standard paths, custom distro, everything hidden (you can’t figure out where to place the ssl cert of how to restart the service, etc). Of course you will figure it out if you spent 50 hours… but w…

You wanted a server and complain NAS is not just a server.

Re: When internal hostnames are leaked to the clown

#66

Post by _gmax1 »

ggm wrote: post #52

Reverse address lookup servers routinely see escaped attempts to resolve ULA and rfc1918. If you can tie the resolver to other valid data, you know inside state. Public services see one way (no TCP return flow possible) from almost any source IP. If you can tie that from other corroborated data, the same: you see packets from "inside" all the time. Darknet collection during final /8 run-down captured audio in UDP. Fi…

"Darknet collection during final /8 run-down captured audio in UDP."

Mind elaborating on this? SIP traffic from which year?

Re: When internal hostnames are leaked to the clown

#67

Post by nomercy400 »

teekert wrote: post #30

Is this a Chrome/Edge thing? Or do privacy respecting browsers also do this? If so, it's unexpected. If Firefox also leaks this, I wonder if this is something mass-surveillance related. (Judging from the down votes I misunderstood something)

From what I understand, sentry.io is like a tracing and logging service, used by many organizations.

This helps you (=NAS developer) to centralize logs and trace a request through all your application layers (client->server->db and back), so you can identify performance bottlenecks and measure usage patterns.

This is what you can find behind the 'anonymized diagnostics' and 'telemetry' settings you are asked to enable/consent.

For a WebUI it is implemented via javascript, which runs on the client's machine and hooks into the clicks, API calls and page content. It then sends statistics and logs back to, in this case, sentry.io. Your browser just sees javascript, so don't blame them. Privacy Badger might block it.

It is as nefarious as the developer of the application wants to use it. Normally you would use it to centralize logging, find performance issues, and get a basic idea on what features users actually use, so you can debug more easily. But you can also use it to track users. And don't forget, sentry.io is a cloud solution. If you post it on machines outside your control, expect it to be public. Sentry has a self-hosted solution, btw.

Re: When internal hostnames are leaked to the clown

#70

Post by LtdJorge »

_gmax1 wrote: post #66
ggm wrote: post #52

Reverse address lookup servers routinely see escaped attempts to resolve ULA and rfc1918. If you can tie the resolver to other valid data, you know inside state. Public services see one way (no TCP return flow possible) from almost any source IP. If you can tie that from other corroborated data, the same: you see packets from "inside" all the time. Darknet collection during final /8 run-down captured audio in UDP. Fi…

"Darknet collection during final /8 run-down captured audio in UDP." Mind elaborating on this? SIP traffic from which year?

RTP I’d say
Post reply on HN