Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When internal hostnames are leaked to the clown

rachelbythebay.com

Post reply on HN
Print view View original

151–160 of 265 posts

Re: When internal hostnames are leaked to the clown

#151

Post by jerf »

dmichulke wrote: post #96
reddalo wrote: post #84

Earlier quoted context omitted.

In other words: never put sensitive information in names and metadata.

Or name them after little bobby tables. Is there some sort of injection that's a legal host name?

DNS naming rules for non-Unicode are letters, numbers, and hyphens only, and the hyphens can't start or stop the domain. Unicode is implemented on top of that through punycode. It's possible a series of bugs would allow you to punycode some sort of injection character through into something but it would require a chain of faulty software. Not an impossibly long chain of faulty software by any means, but a chain rather than just a single vulnerability. Punycode encoders are supposed leave ASCII characters as ASCII characters, which means ASCII characters illegal in DNS can't be made legal by punycoding them legally. I checked the spec and I don't see anything for a decoder rejecting something that jams one in, but I also can't tell if it's even possible to encode a normal ASCII character; it's a very complicated spec. Things that receive that domain ought to reject it, if it is possible to encode it. And then it still has to end up somewhere vulnerable after that.

Re: When internal hostnames are leaked to the clown

#152

Post by fc417fc802 »

leoc wrote: post #34
hsbauauvhabzb wrote: post #27

Earlier quoted context omitted.

Sounds like a great way to get sentry to fire off arbitrary requests to IPs you don’t own. sure hope nobody does that targeting ips (like that blacklist in masscan) that will auto report you to your isp/ans/whatever for your abusive traffic. Repeatedly.

Obligatory Bruce Scneier: https://www.schneier.com/blog/archives/2008/03/the_security_...

Good read, but:

> This kind of thinking is not natural for most people. It’s not natural for engineers. Good engineering involves ...

I have to disagree in the strongest terms. It doesn't matter what it is, the only way to do a good job designing something is to imagine the ways in which things could go wrong. You have to poke holes in your own design and then fix them rather than leaving it to the real world to tear your project to shreds after the fact.

The same thing applies to science. Any even half decent scientist is constantly attempting to tear his own theories apart.

I think Schneier is correct about that sort of thinking not being natural for your typical person. But it _is_ natural (or rather a prerequisite) for truly competent engineers and scientists.

Re: When internal hostnames are leaked to the clown

#153

Post by duxup »

ralferoo wrote: post #150
leoc wrote: post #34

Earlier quoted context omitted.

Obligatory Bruce Scneier: https://www.schneier.com/blog/archives/2008/03/the_security_...

Hehe, just reading that. > The poster described how she was able to retrieve her car after service just by giving the attendant her last name. Now any normal car owner would be happy about how easy it was to get her car back, but someone with a security mindset immediately thinks: “Can I really get a car just by knowing the last name of someone whose car is being serviced?” Just a couple of hours ago, I picked my car…

I feel like that car security situation also is sort of setup to tell us about how folks with a security mindset can go overboard?

Some car dealership who never had a car stolen hires a consultant and they identify this pickup situation as a problem. Then they implement some wild security and now customers who just dropped off their car, just talked to the same customer service person about the weather ... have to go through some extra security to impersonally prove who they are, because someone imagined a problem that has never occurred (or nearly never). But here we go doing the security dance because someone imagined a problem that really has nothing to do with how people actually steal cars...

Computers and the internet are different of course, the volume of possibilities / bad actors you could be exposed to are seemingly endless. Yet even there security mindset can go overboard.

I'm currently trying to recover/move some developer accounts for some services because we had someone leave the company less than gracefully. Often I have my own account, it's part of an organization ... but moving ownership is an arduous and bizarrely different process for each company. I get it, you wouldn't want someone to take over our no name organization, but the process all seem to involve extra steps piled on "for security". The fact that I'm already a customer, have an account in good standing, part of the organization, the organization account holder has been inactive ... doesn't seem to matter at all, I may as well be a stranger from the outside, presumably because of "security".

Re: When internal hostnames are leaked to the clown

#154

Post by tbyehl »

atmosx wrote: post #53

I bought a SynologyNAS and I have regretted already 3-4 times. Apart from the software made available from the community, there is very little one can do with this thing. Using LE to apply SSL to services? Complicated. Non standard paths, custom distro, everything hidden (you can’t figure out where to place the ssl cert of how to restart the service, etc). Of course you will figure it out if you spent 50 hours… but w…

> Using LE to apply SSL to services? Complicated.

https://github.com/JessThrysoee/synology-letsencrypt

> there is very little one can do with this thing.

It has a VMM and Docker. Entware / opkg exist for it. There's very little that can't be done, but expecting to use an appliance that happens to be Linux-based as a generic Linux server is going to lead to challenges. Be it Synology, TrueNAS, or anything else.

Re: When internal hostnames are leaked to the clown

#155

Post by criddell »

atmosx wrote: post #141
PunchyHamster wrote: post #65

Earlier quoted context omitted.

You wanted a server and complain NAS is not just a server.

NAS is the primary function. But yes, I want full linux server that I can decide what to install and which protocol to use to upload and/or download files.

Why not just leave the NAS to be a NAS and get a separate server? You're probably better off not trying to overload the NAS to be everything.

Re: When internal hostnames are leaked to the clown

#156

Post by RcouF1uZ4gsC »

duxup wrote: post #153
ralferoo wrote: post #150

Earlier quoted context omitted.

Hehe, just reading that. > The poster described how she was able to retrieve her car after service just by giving the attendant her last name. Now any normal car owner would be happy about how easy it was to get her car back, but someone with a security mindset immediately thinks: “Can I really get a car just by knowing the last name of someone whose car is being serviced?” Just a couple of hours ago, I picked my car…

I feel like that car security situation also is sort of setup to tell us about how folks with a security mindset can go overboard? Some car dealership who never had a car stolen hires a consultant and they identify this pickup situation as a problem. Then they implement some wild security and now customers who just dropped off their car, just talked to the same customer service person about the weather ... have to go…

And then some person realizes that government ids can be faked, so they set up a system of doing a retinal scan of the person dropping off the car and then comparing it to the retinal scan of the person picking it up.

Then they realize that one person may be bribed so they require at least two people to verify at pickup and drop off.

Meanwhile, a car has never ever been stolen this way.

Re: When internal hostnames are leaked to the clown

#158

Post by duxup »

RcouF1uZ4gsC wrote: post #156
duxup wrote: post #153

Earlier quoted context omitted.

I feel like that car security situation also is sort of setup to tell us about how folks with a security mindset can go overboard? Some car dealership who never had a car stolen hires a consultant and they identify this pickup situation as a problem. Then they implement some wild security and now customers who just dropped off their car, just talked to the same customer service person about the weather ... have to go…

And then some person realizes that government ids can be faked, so they set up a system of doing a retinal scan of the person dropping off the car and then comparing it to the retinal scan of the person picking it up. Then they realize that one person may be bribed so they require at least two people to verify at pickup and drop off. Meanwhile, a car has never ever been stolen this way.

Yup, it's taking me probably 10x longer gathering legitimate documents to send to these companies.

Meanwhile I could fake them all in a fairly short amount of time...

Re: When internal hostnames are leaked to the clown

#159

Post by andix »

Hostnames are not private information. There are too many ways how they get leaked to the outside world.

It can be useful to hide a private service behind a URL that isn't easy to guess (less attack surfaces, because a lot of attackers can't find the service). But it needs to be inside the URL path, not the hostname.

  bad: my-hidden-fileservice-007-abc123.example.com/
  good: fileservice.example.com/my-hidden-service-007-abc123/
In the first example the name is leaked with DNS queries, TLS certificates and many other possibilities. In the second example the secret path is only transmitted via HTTPS and doesn't leak as easy.
Post reply on HN