Brute-forcing a macOS user’s real name from a browser using mDNS • Hacker News Board

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#11

Post by capableweb » Thu, Jul 13, 2023, 7:07 PM UTC

darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

They generally can't, because of CORS. The only reason this "hack" works is because the timing of the rejection is different between non-resolving domain request and resolving-but-rejected request. But if you run something on https://192.168.2.1 it can't be accessed from a web app running on https://my-own-domain.com unless the service running at 192.168.2.1 allows the "Origin" my-own-domain.com.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#12

Post by acer589 » Thu, Jul 13, 2023, 7:08 PM UTC

nneonneo wrote: post #8

tentacleuno wrote: post #3

Earlier quoted context omitted.

It might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex

Rather than choosing at random, I like to pick names that have some relation to the device in question, e.g. "Pichu" for a tiny mobile device, "Snorlax" for the big slow machine, "Articuno/Zapdos/Moltres" for three successive powerful servers, etc. What's extra fun about Pokemon, if you're familiar with the franchise, is that you can pick names based on generation, with older generations for e.g. older devices, and i…

Very similar here. PCs get Pokémon region names (MacBook is Johto), non-PC Ethernet connected devices get Professor names, all other devices are Pokémon.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#13

Post by tentacleuno » Thu, Jul 13, 2023, 7:08 PM UTC

nneonneo wrote: post #8

tentacleuno wrote: post #3

Earlier quoted context omitted.

It might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex

Rather than choosing at random, I like to pick names that have some relation to the device in question, e.g. "Pichu" for a tiny mobile device, "Snorlax" for the big slow machine, "Articuno/Zapdos/Moltres" for three successive powerful servers, etc. What's extra fun about Pokemon, if you're familiar with the franchise, is that you can pick names based on generation, with older generations for e.g. older devices, and i…

Oh, I do the same! For instance, zygarde is my 14TB NAS, which I consider pretty big. I'm not familiar with the franchise though :)

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#14

Post by pilsetnieks » Thu, Jul 13, 2023, 7:08 PM UTC

darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

iOS already has a Local Network Access permission, it's probably only a matter of time until it appears in macOS as well.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#15

Post by bcx » Thu, Jul 13, 2023, 7:09 PM UTC

franga2000 wrote: post #9

joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

I do the opposite: one of my laptops is named "Peter's iPhone" (hint: my name is not Peter, nor do I own an iPhone) and I've also set all my Bluetooth to random Bluetooth headset or mouse models.

I like this idea, but any sophisticated attacker will ignore the Bluetooth names and just pull vendors off the MAC addresses. Though it would be interesting if you can define the Bluetooth MAC addressees in software to match your fake names :)

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#16

Post by vorticalbox » Thu, Jul 13, 2023, 7:13 PM UTC

franga2000 wrote: post #9

joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

I do the opposite: one of my laptops is named "Peter's iPhone" (hint: my name is not Peter, nor do I own an iPhone) and I've also set all my Bluetooth to random Bluetooth headset or mouse models.

My hotspot on my phone is "FBI van 4"

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#17

Post by lagrange77 » Thu, Jul 13, 2023, 7:13 PM UTC

darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

To avoid confusion, this is not about an internet server making requests to your local network, but your local web browser making those requests. Although, the javascript executed in the browser can be loaded from an internet server, of course.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#18

Post by userbinator » Thu, Jul 13, 2023, 7:13 PM UTC

In the example above, the difference is four milliseconds for a valid address versus five seconds for an invalid one.

This is surprising --- I'd expect a DNS lookup failure to be much faster than a default connection timeout which comes after a successful DNS lookup.

That said, I've always found the s-mac-xxxx to be a bit of an odd choice, especially considering it's from a company that advertises privacy as a huge selling point; either they don't expect you to use your real name, or this is a case where "user friendliness" took precedence. From the privacy perspective, Windows' randomly generated hostnames would be better.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#19

Post by accrual » Thu, Jul 13, 2023, 7:14 PM UTC

bcx wrote: post #15

franga2000 wrote: post #9

Earlier quoted context omitted.

I do the opposite: one of my laptops is named "Peter's iPhone" (hint: my name is not Peter, nor do I own an iPhone) and I've also set all my Bluetooth to random Bluetooth headset or mouse models.

I like this idea, but any sophisticated attacker will ignore the Bluetooth names and just pull vendors off the MAC addresses. Though it would be interesting if you can define the Bluetooth MAC addressees in software to match your fake names :)

I used to do something similar with my router. I would run an AP called "Linksys" or something common and give it an OUI belonging to Cisco. It probably had no benefit (maybe even harmful!), but it was fun to "disguise" my OpenBSD router as a common off the shelf router.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#20

Post by ok123456 » Thu, Jul 13, 2023, 7:17 PM UTC

accrual wrote: post #19

bcx wrote: post #15

Earlier quoted context omitted.

I like this idea, but any sophisticated attacker will ignore the Bluetooth names and just pull vendors off the MAC addresses. Though it would be interesting if you can define the Bluetooth MAC addressees in software to match your fake names :)

I used to do something similar with my router. I would run an AP called "Linksys" or something common and give it an OUI belonging to Cisco. It probably had no benefit (maybe even harmful!), but it was fun to "disguise" my OpenBSD router as a common off the shelf router.

I name my computer: 'router'