Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Server.casino – Random Servers Across the Internet

server.casino

Post reply on HN
Print view View original

31–40 of 40 posts

Re: Server.casino – Random Servers Across the Internet

#31

Post by 35fbe7d3d5b9 »

celesian wrote: post #29
dannyw wrote: post #24

DO NOT DO THIS. I have a few servers exposed on IP addresses, but they are not meant for public access. You have no authorization for 'messing' with this site: what you deem playing around, might be hacking. You may also hit a government or military IP address, known or unknown. If you mess around with them, you may receive some unfriendly visits from men in black.

I mean, your IP is being crawled by random bots dozens of time per day, what's the difference between that website and the traffic your IP gets already?

Seriously, this is a laughable concern – if you have a "public facing server" you're already listed in Google, Shodan, being probed by dozens of IPs across the world...

Re: Server.casino – Random Servers Across the Internet

#32

Post by nonbirithm »

35fbe7d3d5b9 wrote: post #31
celesian wrote: post #29

Earlier quoted context omitted.

I mean, your IP is being crawled by random bots dozens of time per day, what's the difference between that website and the traffic your IP gets already?

Seriously, this is a laughable concern – if you have a "public facing server" you're already listed in Google, Shodan, being probed by dozens of IPs across the world...

I found this showing up in my logs recently.

     [21/Jun/2021:19:07:19 +0000] "GET / HTTP/1.1" 301 169 "-" "Expanse, a Palo Alto Networks company, searches across
 the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com"
I remember thinking that ads in server logs was a new one to me.

Re: Server.casino – Random Servers Across the Internet

#33

Post by mike_d »

dannyw wrote: post #24

DO NOT DO THIS. I have a few servers exposed on IP addresses, but they are not meant for public access. You have no authorization for 'messing' with this site: what you deem playing around, might be hacking. You may also hit a government or military IP address, known or unknown. If you mess around with them, you may receive some unfriendly visits from men in black.

I specifically purchased my internet connection with the intention of browsing the available content of all other connected hosts.

You DO NOT have my authorization to block or restrict my ability to mess with other hosts. Doing so may be a violation of my terms of service, and interference in interstate commerce.

Re: Server.casino – Random Servers Across the Internet

#34

Post by dannyw »

35fbe7d3d5b9 wrote: post #31
celesian wrote: post #29

Earlier quoted context omitted.

I mean, your IP is being crawled by random bots dozens of time per day, what's the difference between that website and the traffic your IP gets already?

Seriously, this is a laughable concern – if you have a "public facing server" you're already listed in Google, Shodan, being probed by dozens of IPs across the world...

Let me explain, I am not running any services on standard ports. You'd have to do a port scan and find one of the ports running a web service. But they're HTTPs (with unsigned personal certificate keys, mind you) and are password protected.

I still get so. many. random people entering passwords and trying to break in. They don't look like a wordlist or automated bots, they're literally people guessing.

Just because you see a username and password screen after you nmap this public IP, doesn't give you the right to start trying to hack it.

Re: Server.casino – Random Servers Across the Internet

#35

Post by 35fbe7d3d5b9 »

dannyw wrote: post #34
35fbe7d3d5b9 wrote: post #31

Earlier quoted context omitted.

Seriously, this is a laughable concern – if you have a "public facing server" you're already listed in Google, Shodan, being probed by dozens of IPs across the world...

Let me explain, I am not running any services on standard ports. You'd have to do a port scan and find one of the ports running a web service. But they're HTTPs (with unsigned personal certificate keys, mind you) and are password protected. I still get so. many. random people entering passwords and trying to break in. They don't look like a wordlist or automated bots, they're literally people guessing. Just because y…

You're making a normative argument; I'm making a positive one.

You ought not try random usernames/passwords on someone's public server, I agree. But if you expose a public server that lets someone type a username/password, you had best be ready for someone to guess values.

Re: Server.casino – Random Servers Across the Internet

#37

Post by Craighead »

mike_d wrote: post #33
dannyw wrote: post #24

DO NOT DO THIS. I have a few servers exposed on IP addresses, but they are not meant for public access. You have no authorization for 'messing' with this site: what you deem playing around, might be hacking. You may also hit a government or military IP address, known or unknown. If you mess around with them, you may receive some unfriendly visits from men in black.

I specifically purchased my internet connection with the intention of browsing the available content of all other connected hosts. You DO NOT have my authorization to block or restrict my ability to mess with other hosts. Doing so may be a violation of my terms of service, and interference in interstate commerce.

USC 1030

Re: Server.casino – Random Servers Across the Internet

#38

Post by Craighead »

35fbe7d3d5b9 wrote: post #35
dannyw wrote: post #34

Earlier quoted context omitted.

Let me explain, I am not running any services on standard ports. You'd have to do a port scan and find one of the ports running a web service. But they're HTTPs (with unsigned personal certificate keys, mind you) and are password protected. I still get so. many. random people entering passwords and trying to break in. They don't look like a wordlist or automated bots, they're literally people guessing. Just because y…

You're making a normative argument; I'm making a positive one. You ought not try random usernames/passwords on someone's public server, I agree. But if you expose a public server that lets someone type a username/password, you had best be ready for someone to guess values.

The legal argument, is that this is an illegal activity in certain jurisdictions, like the US, with USC 1030

Re: Server.casino – Random Servers Across the Internet

#40

Post by Arafen »

syoc wrote: post #28
Miner49er wrote: post #21

Earlier quoted context omitted.

How? The odds of hitting a site with a browser 0-day has to be extremely low, certainly not "more likely than not". Sure you might hit sites that try to get you to download malware, but just don't download anything.

Half the struggle in exploiting someone behind NAT/FW is getting them to engage with your infrastructure. Your attack surface is massively increased once you visit a website with your browser for instance. I see other comments mentioning logging into random IPs over ssh. Now i trust the ssh client implementation more than most software, but it's easy to slip up and enable ssh agent forwarding for instance.

It was not for nothing that I realised in time that stock exchanges and quotations were not for me. I could not make any money on the ups and downs of exchange rates. But I managed to make an online betting application with the help of Nuxgame with their engine https://nuxgame.com/products/sport-engine . I was able to set everything up very quickly and even made my first money.
Post reply on HN