Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When internal hostnames are leaked to the clown

rachelbythebay.com

Post reply on HN
Print view View original

241–250 of 265 posts

Re: When internal hostnames are leaked to the clown

#241

Post by DANmode »

superkuh wrote: post #237
DANmode wrote: post #211

Earlier quoted context omitted.

> I cannot access the HTTPS version Curiosity begs: why not?

I opened it on an old computer with an old linux distro with an old browser because old linux distros have reliable and working accessibility features like screen readers and good non-gpu text to speech and advanced keyboard/mouse sharing. Modern linux distros do not. Don't worry, I have javascript execution/etc turned off by default on that machine.

Glad I asked - first time running into a screen reader using Linux user in the wild!

What distro/reader? Thanks

Re: When internal hostnames are leaked to the clown

#242

Post by TZubiri »

simoncion wrote: post #220
TZubiri wrote: post #47

Earlier quoted context omitted.

>This too is not ideal. It gets saved in the browser history, and if the url is sent by message (email or IM), the provider may visit it. Sure. POST for extra security. > Not the subdomain leak part, that's just how Rachel noticed, but the non advertised tracking from an appliance chosen to be connected privately. If this were a completely local product, like say a USB stick. Sure. but this is a Network Attached Stor…

> Sure. but this is a Network Attached Storage product, and the user explicitly chose to use network functions (domains, http), it's not the same category of issue. Is it fair to say that you're saying that it should be considered normal to expect that network-attached devices (designed and sold by reliable, aboveboard companies) connected to (V)LANs with no Internet access will be configured to use computers that us…

Yes, correct.

If you are using a storage device with a Layer 3 interface, you have already signed off that you aren't too concerned with the connection being airgapped. Otherwise you would have used a Layer 1 protocol, or hell, even a layer 2.

You are giving the thing an IP address and IP capabilities? It's like signing one of those lengthy disclaimers that you might die and won't sue anyone for side effects.

Not saying it needs to happen, but you can't be surprised if it does.

Re: When internal hostnames are leaked to the clown

#243

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #218
b1temy wrote: post #15

Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? Seems to me that the problem is the NAS's web interface using sentry for logging/monitoring, and part of what was logged were internal hostnames (which might be named in a way that has sensitive info, e.g, the corp-and-other-corp-merger example they gave. So it wouldn't matter that it's inaccessible in a private netw…

I remember the term "clown computing" to describe "cloud computing" from IRC earlier than 2016 I use a localhost TLS forward proxy for all TCP and HTTP over the LAN There is no access to remote DNS, only local DNS. I use stored DNS data periodically gathered in bulk from various sources. As such, HTTP and other traffic over TCP that use hostnames cannot reach hosts on the internet unless I allow it in local DNS or th…

Or the author gave a browser direct access to the internet

For example, I have seen a freshly installed Firefox Nightly try to connect to sentry.io on startup

For me, these attempts never succeed

Re: When internal hostnames are leaked to the clown

#244

Post by jamesfinlayson »

foldor wrote: post #234
SR2Z wrote: post #229

Earlier quoted context omitted.

Stolen cars are often sold for low amounts of money - like $50 - and then used to commit crimes that are not traceable from their plates. It hasn't really been possible to steal and resell a car in the United States for many years, barring a few carefully watched loopholes (Vermont out-of-state registrations is one example that was recently closed). When Kia and Hyundai were recently selling models without real keys…

In Canada there's been a big problem with stolen cars lately. Mostly trucks, and other high value vehicles though. Selling them locally isn't feasible, but there's a criminal organization that's gotten very good at getting them on container ships and out to countries that don't care if the vehicles are stolen. So even with tracking, there's nothing people can do. Stopping it at the port is the obvious fix, but someho…

Same thing in Australia - some gang was busted recently for stealing mid-range four wheel drives, packing them in shipping containers with partially dismantled cars (I guess so that a cursory inspection would just show "car parts" rather than a single nice looking car) and then shipping them around the world (I guess an overseas buyer isn't checking if a car with this VIN has been stolen on the other side of the world).

Re: When internal hostnames are leaked to the clown

#245

Post by jamesfinlayson »

Wowfunhappy wrote: post #186
ralferoo wrote: post #150

Earlier quoted context omitted.

Hehe, just reading that. > The poster described how she was able to retrieve her car after service just by giving the attendant her last name. Now any normal car owner would be happy about how easy it was to get her car back, but someone with a security mindset immediately thinks: “Can I really get a car just by knowing the last name of someone whose car is being serviced?” Just a couple of hours ago, I picked my car…

Aren't there easier ways to steal cars? Like, go to an open parking lot, pick the lock, and start the car by connecting the right wires. It's risky, sure. But the garage situation also seems risky.

> start the car by connecting the right wires

I might be misinformed but I've been told that for a while now (maybe 20 years or so), new cars have been built to be exceptionally difficult to hot-wire.

A South African friend told me that some brand of four wheel drive could be hot-wired but it involved getting behind one of the front head-lamp bulbs - doable, but a damaging process if you're in a rush.

Re: When internal hostnames are leaked to the clown

#246

Post by jamesfinlayson »

Kwpolska wrote: post #205
andix wrote: post #183

Earlier quoted context omitted.

Just try it. The first example gets attacked by bots nearly immediately after issuing a TLS cert. The second one usually doesn't get detected at all.

What if you have a wildcard cert for *.example.com?

I worked at a company where the security team disliked wildcard certificates because it exposed us to the risk of someone, somehow, hosting something malicious on a subdomain.

Re: When internal hostnames are leaked to the clown

#247

Post by Wowfunhappy »

contravariant wrote: post #240
Wowfunhappy wrote: post #194

Earlier quoted context omitted.

Curious, does this still apply if http is used exclusively?

Well no, in that case all traffic is exposed anyway.

I meant will people be able to find that the hostname exists.

Re: When internal hostnames are leaked to the clown

#248

Post by wlonkly »

user_of_the_wek wrote: post #149
b1temy wrote: post #15

Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? Seems to me that the problem is the NAS's web interface using sentry for logging/monitoring, and part of what was logged were internal hostnames (which might be named in a way that has sensitive info, e.g, the corp-and-other-corp-merger example they gave. So it wouldn't matter that it's inaccessible in a private netw…

The circus left town, but the clowns are still here.

But whose monkeys are these?

Re: When internal hostnames are leaked to the clown

#249

Post by wlonkly »

adolph wrote: post #212
mixedbit wrote: post #95

I have investigated similar situation on Heroku. Heroku assigns a random subdomain suffix for each new app, so URLs of apps are hard to guess and look like this: test-app-28a8490db018.herokuapp.com. I have noticed that as soon as a new Heroku app is created, without making any requests to the app that could leak the URL via a DNS lookup, the app is hit by requests from automatic vulnerability scanning tools. Heroku c…

> certificate authority logs, which are actively monitored by vulnerability scanners That sounds like a large kick-me sign taped to every new service. Reading how certificate transparency (CT) works leads me to think that there was a missed opportunity to publish hashes to the logs instead of the actual certificate data. That way a browser performing a certificate check can verify in CT, but a spammer can't monitor C…

I think it was more of an intentional tradeoff, as one of the many goals of CT logs was to allow domain owners to discover certificates issued for their domains, or more generally for any interested party to audit the activity of a certificate authority.

What you're describing there is certificate... translucency, I guess?

Re: When internal hostnames are leaked to the clown

#250

Post by direwolf20 »

ralferoo wrote: post #150
leoc wrote: post #34

Earlier quoted context omitted.

Obligatory Bruce Scneier: https://www.schneier.com/blog/archives/2008/03/the_security_...

Hehe, just reading that. > The poster described how she was able to retrieve her car after service just by giving the attendant her last name. Now any normal car owner would be happy about how easy it was to get her car back, but someone with a security mindset immediately thinks: “Can I really get a car just by knowing the last name of someone whose car is being serviced?” Just a couple of hours ago, I picked my car…

Besides thinking about how to steal a car, we can think about how the dealership stops you stealing a car. Your face is plastered all over several cameras, and they know the license plate.
Post reply on HN