Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When internal hostnames are leaked to the clown

rachelbythebay.com

Post reply on HN
Print view View original

191–200 of 265 posts

Re: When internal hostnames are leaked to the clown

#191

Post by MisterTea »

Wowfunhappy wrote: post #186
ralferoo wrote: post #150

Earlier quoted context omitted.

Hehe, just reading that. > The poster described how she was able to retrieve her car after service just by giving the attendant her last name. Now any normal car owner would be happy about how easy it was to get her car back, but someone with a security mindset immediately thinks: “Can I really get a car just by knowing the last name of someone whose car is being serviced?” Just a couple of hours ago, I picked my car…

Aren't there easier ways to steal cars? Like, go to an open parking lot, pick the lock, and start the car by connecting the right wires. It's risky, sure. But the garage situation also seems risky.

It's even easier than that. A lot of older ignition locks could be defeated by a screwdriver so you just smash the window, jimmy the ignition lock with the screw driver and off you go! There was a specific model of jeep that was stolen a lot because the rear lock could be popped out easily with pliers, a matching key made, and you return later with the key to steal the car.

Re: When internal hostnames are leaked to the clown

#192

Post by RajT88 »

ralferoo wrote: post #150
leoc wrote: post #34

Earlier quoted context omitted.

Obligatory Bruce Scneier: https://www.schneier.com/blog/archives/2008/03/the_security_...

Hehe, just reading that. > The poster described how she was able to retrieve her car after service just by giving the attendant her last name. Now any normal car owner would be happy about how easy it was to get her car back, but someone with a security mindset immediately thinks: “Can I really get a car just by knowing the last name of someone whose car is being serviced?” Just a couple of hours ago, I picked my car…

The fact that so many things in the world work like this is the reason for the continued appeal of heist movies. Those always contain clever bits of social engineering and confidence scams which move the plot along - and they are as believable today as they always were.

Re: When internal hostnames are leaked to the clown

#193

Post by koverstreet »

Wowfunhappy wrote: post #186
ralferoo wrote: post #150

Earlier quoted context omitted.

Hehe, just reading that. > The poster described how she was able to retrieve her car after service just by giving the attendant her last name. Now any normal car owner would be happy about how easy it was to get her car back, but someone with a security mindset immediately thinks: “Can I really get a car just by knowing the last name of someone whose car is being serviced?” Just a couple of hours ago, I picked my car…

Aren't there easier ways to steal cars? Like, go to an open parking lot, pick the lock, and start the car by connecting the right wires. It's risky, sure. But the garage situation also seems risky.

You'd have to be stupid and desperate to steal from a garage.

The people who work there aren't office workers; you've got blue collar workers who spend all day working together and hanging out using heavy equipment right in the back. And they're going to be well acquainted with the local tow truck drivers and the local police - so unless you're somewhere like Detroit, you better be on your way across state lines the moment you're out of there. And you're not conning a typical corporate drone who sees 100 faces a day; they'll be able to give a good description.

And then what? You're either stuck filing off VINs and faking a bunch of paperwork, or you have to sell it to a chop shop. The only way it'd plausibly have a decent enough payoff is if you're scouting for unique vehicles with some value (say, a mint condition 3000GT), but that's an even worse proposition for social engineering - people working in a garage are car guys, when someone brings in a cool vehicle everyone's talking about it and the guy who brought it in. Good luck with that :)

Dealership? Even worse proposition, they're actual targets so they know how to track down missing vehicles.

If you really want to steal a car via social engineering, hit a car rental place, give them fake documentation, then drive to a different state to unload it - you still have to fake all the paperwork, and strip anything that identifies it as a rental, and you won't be able to sell to anyone reputable so it'll be a slow process, and you'll need to disguise your appearance differently both times so descriptions don't match later. IOW - if you're doing it right so it has a chance in hell of working, that office job starts to sound a whole lot less tedious.

Way easier to just write code :)

Re: When internal hostnames are leaked to the clown

#194

Post by Wowfunhappy »

andix wrote: post #159

Hostnames are not private information. There are too many ways how they get leaked to the outside world. It can be useful to hide a private service behind a URL that isn't easy to guess (less attack surfaces, because a lot of attackers can't find the service). But it needs to be inside the URL path, not the hostname. bad: my-hidden-fileservice-007-abc123.example.com/ good: fileservice.example.com/my-hidden-service-00…

Curious, does this still apply if http is used exclusively?

Re: When internal hostnames are leaked to the clown

#195

Post by b00ty4breakfast »

Wowfunhappy wrote: post #186
ralferoo wrote: post #150

Earlier quoted context omitted.

Hehe, just reading that. > The poster described how she was able to retrieve her car after service just by giving the attendant her last name. Now any normal car owner would be happy about how easy it was to get her car back, but someone with a security mindset immediately thinks: “Can I really get a car just by knowing the last name of someone whose car is being serviced?” Just a couple of hours ago, I picked my car…

Aren't there easier ways to steal cars? Like, go to an open parking lot, pick the lock, and start the car by connecting the right wires. It's risky, sure. But the garage situation also seems risky.

I reckon it is infinitely riskier to be caught attempting to break into a car than it is to just walk in to a service garage and pretending you own the Vdub in the parking lot. There is still a bit of deniability in the 2nd option but good luck explaining to the police why you are using a set of tools specifically for picking vehicle locks (because you can't just use regular pick and tension wrenches) to break into a vehicle that you don't own.

Re: When internal hostnames are leaked to the clown

#196

Post by Nextgrid »

ralferoo wrote: post #150
leoc wrote: post #34

Earlier quoted context omitted.

Obligatory Bruce Scneier: https://www.schneier.com/blog/archives/2008/03/the_security_...

Hehe, just reading that. > The poster described how she was able to retrieve her car after service just by giving the attendant her last name. Now any normal car owner would be happy about how easy it was to get her car back, but someone with a security mindset immediately thinks: “Can I really get a car just by knowing the last name of someone whose car is being serviced?” Just a couple of hours ago, I picked my car…

The difference is that car theft is still prosecuted by police, where as cybercrime is not (unless you embarrass a huge corporation).

So the garage can have lower security because even potential thieves do a risk/reward calculation and the vast majority choose not to proceed with it.

Online, the risk/reward calculation is different (what risk?), so more people will be tempted to try (even for the lolz - not every act of cybercrime is done for monetary purposes).

Re: When internal hostnames are leaked to the clown

#197

Post by Nextgrid »

jeroenhd wrote: post #122
prmoustache wrote: post #117

Earlier quoted context omitted.

I don't even understand what kind of webui one would want. All you really need is a bunch of disk and an operating system with an ssh server. Even the likes of samba and nfs aren't even useful anymore.

A bunch of out-of-the-box NAS manufacturers provide a web-based OS-like shell with file managers, document editors, as well as an "app store" for containers and services. I see the traditional "RAID with a SMB share" NAS devices less and less in stores. If only storage target mode[1] had some form of authentication, it'd make setting up a barebones NAS an absolute breeze. [1]: https://www.freedesktop.org/software/sys…

Storage target mode is block-level, not filesystem-level, meaning it won't support concurrent access and any network hiccup or dropped connection will leave the filesystem in an unclean state.

Re: When internal hostnames are leaked to the clown

#198

Post by JackFr »

senectus1 wrote: post #25
jraph wrote: post #19

Earlier quoted context omitted.

> Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? Clown is Rachel's word for (Big Tech's) cloud.

amusingly its a term used by my co-workers to describe anyone thats not them.

"What clown wrote this ... [ runs git blame ] ...erm...never mind."

Re: When internal hostnames are leaked to the clown

#199

Post by m3047 »

jerf wrote: post #151
dmichulke wrote: post #96

Earlier quoted context omitted.

Or name them after little bobby tables. Is there some sort of injection that's a legal host name?

DNS naming rules for non-Unicode are letters, numbers, and hyphens only, and the hyphens can't start or stop the domain. Unicode is implemented on top of that through punycode. It's possible a series of bugs would allow you to punycode some sort of injection character through into something but it would require a chain of faulty software. Not an impossibly long chain of faulty software by any means, but a chain rathe…

Rules are just rules. You can put things in a domain name which don't work as hostnames. Really the only place this is enforced by policy is at the public registrar level. Only place I've run into it at the code level is in a SCADA platform blocking a CNAME record (which followed "legal" hostname rules) pointing to something which didn't. The platform uses jython / python2 as its scripting layer; it's java; it's a special real-time java: plenty of places to look for what goes wrong, I didn't bother.

People should know that they should treat the contents of their logs as unsanitized data... right? A decade ago I actually looked at this in the context of a (commercial) passive DNS, and it appeared that most of the stuff which wasn't a "valid" hostname was filtered before it went to the customers.

Re: When internal hostnames are leaked to the clown

#200

Post by dh2022 »

fc417fc802 wrote: post #152
leoc wrote: post #34

Earlier quoted context omitted.

Obligatory Bruce Scneier: https://www.schneier.com/blog/archives/2008/03/the_security_...

Good read, but: > This kind of thinking is not natural for most people. It’s not natural for engineers. Good engineering involves ... I have to disagree in the strongest terms. It doesn't matter what it is, the only way to do a good job designing something is to imagine the ways in which things could go wrong. You have to poke holes in your own design and then fix them rather than leaving it to the real world to tear…

I agree. A good engineer would think about all possible corner cases (). Security is another set of corner cases.

() Just yesterday I had to correct a PR because the engineer did not think of some corner cases. All sorts of corner cases happen in real life.

Post reply on HN