Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Gov.uk site dedicated to porn?

thecrow.uk

Post reply on HN
Print view View original

31–40 of 93 posts

Re: A Gov.uk site dedicated to porn?

#31

Post by notatoad »

notatoad wrote: post #3

Wow. I thought this was going to be about some sneaky exploit where they'd manage to get a gov.uk to forward links to porn or something. But no, it's really a whole subdomain just taken over by some sketchy porn site. I'm wondering if the porn site operators even know it's happening? Seems the most likely thing is the DfT had a site at that URL, hosted on AWS. And then they shut it down without removing the DNS recor…

(as per the other comment, my guess is incorrect. I didn't actually look at the DNS. No porn site operator is going to accidentally pick the s3 bucket name 'charts.dft.gov.uk')

Re: A Gov.uk site dedicated to porn?

#32

Post by Datagenerator »

mh- wrote: post #26
necovek wrote: post #23

December 2018 snapshot refers to Department of Transport: https://web.archive.org/web/20181227091013/http://charts.dft... . The CNAME of charts.dft.gov.uk.s3-website-eu-west-1.amazonaws.com still works, but the reverse DNS of that IP is simply s3-website-eu-west-1.amazonaws.com: I am not sure how does one gain control of an s3-website subdomain when "abandoned" (bucket name only?), but someone did. So the scenario so…

What sometimes happens is someone points a CNAME to a non-existent bucket. Either because they were planning ahead, or someone typo'd a bucket (and thus DNS) name. There are bots that scan for this. Then someone creates the bucket on S3 and boom, subdomain hijack.

The most logical to me is, they registered some AWS IPv4 address for one project. Bill didn't get payed and now another customer has been appointed to the same address but now with totally different content. DNS admins at the government forgot about it and here we are.

Re: A Gov.uk site dedicated to porn?

#33

Post by q3k »

tialaramex wrote: post #29
notatoad wrote: post #3

Wow. I thought this was going to be about some sneaky exploit where they'd manage to get a gov.uk to forward links to porn or something. But no, it's really a whole subdomain just taken over by some sketchy porn site. I'm wondering if the porn site operators even know it's happening? Seems the most likely thing is the DfT had a site at that URL, hosted on AWS. And then they shut it down without removing the DNS recor…

The thing where IP 10.20.30.40‡ is in the DNS for thing.mycorp.example and later nobody cares about thing.mycorp.example and they give up control without removing the DNS entry - is why you can't get Let's Encrypt certificates by just running a HTTPS web server and you need either plain HTTP, a custom TLS server (it can also do HTTPS but it needs to know about ACME as well) or else DNS. Lots of bulk hosts will let yo…

> ‡ 10.20.30.40 isn't a real public address it's just for example purposes here

There’s an RFC for that :)

https://datatracker.ietf.org/doc/html/rfc5737

Re: A Gov.uk site dedicated to porn?

#35

Post by baobabKoodaa »

qeternity wrote: post #6

> This site is hosted on a Raspberry Pi 4B in the author's living room (behind the couch). Holding up quite well despite HN frontpage. I love what a bit of caching can do. EDIT: appears I jinxed it. I get the allure of hosting something in your home, but these days when you can get a decent VPS for $10/yr it doesn’t really make sense.

> I get the allure of hosting something in your home, but these days when you can get a decent VPS for $10/yr it doesn’t really make sense

When you're hosting static content (like presumably this content is; it's down so I can't say for sure), you should distribute it on a CDN for $0/year. A single VPS can be overwhelmed by traffic just as your Raspberry Pi can.

Re: A Gov.uk site dedicated to porn?

#36

Post by osrec »

Looks like someone forgot to delete a DNS entry after decommissioning a server. Bad on behalf of gov.uk, however you'd think AWS would at least auto-delete the CNAME (charts.dft.gov.uk.s3-website-eu-west-1.amazonaws.com) after the server was released, so that it points to nothing...

Re: A Gov.uk site dedicated to porn?

#37

Post by necovek »

mh- wrote: post #26
necovek wrote: post #23

December 2018 snapshot refers to Department of Transport: https://web.archive.org/web/20181227091013/http://charts.dft... . The CNAME of charts.dft.gov.uk.s3-website-eu-west-1.amazonaws.com still works, but the reverse DNS of that IP is simply s3-website-eu-west-1.amazonaws.com: I am not sure how does one gain control of an s3-website subdomain when "abandoned" (bucket name only?), but someone did. So the scenario so…

What sometimes happens is someone points a CNAME to a non-existent bucket. Either because they were planning ahead, or someone typo'd a bucket (and thus DNS) name. There are bots that scan for this. Then someone creates the bucket on S3 and boom, subdomain hijack.

That's what I suggested with

>> Scan the entire internet for domains pointing to s3-website, and check AWS API to see if it's available?

What I wonder is how do you scan all the DNS records with their subdomains? Unlike IPv4 address space, which is very decidedly finite and not-too-big, the space of all the subdomains is basically infinite.

Other than using AXFR (zone-transfer DNS request) which is usually restricted, you are searching an unbounded space.

I guess you don't need an AWS API calls since hitting a non-existing bucket with HTTP will let you know: http://something.that.does.not.exist.s3-website-eu-west-1.am...

IOW, how would you write such a bot? :D

Re: A Gov.uk site dedicated to porn?

#38

Post by necovek »

Datagenerator wrote: post #32
mh- wrote: post #26

Earlier quoted context omitted.

What sometimes happens is someone points a CNAME to a non-existent bucket. Either because they were planning ahead, or someone typo'd a bucket (and thus DNS) name. There are bots that scan for this. Then someone creates the bucket on S3 and boom, subdomain hijack.

The most logical to me is, they registered some AWS IPv4 address for one project. Bill didn't get payed and now another customer has been appointed to the same address but now with totally different content. DNS admins at the government forgot about it and here we are.

This is very obviously just an S3 bucket-name takeover, so no IP address was hijacked (the IP is the same for all S3 eu-west-1 buckets, I am guessing).

Re: A Gov.uk site dedicated to porn?

#39

Post by Sephiroth87 »

qeternity wrote: post #6

> This site is hosted on a Raspberry Pi 4B in the author's living room (behind the couch). Holding up quite well despite HN frontpage. I love what a bit of caching can do. EDIT: appears I jinxed it. I get the allure of hosting something in your home, but these days when you can get a decent VPS for $10/yr it doesn’t really make sense.

Sorry for the ot, but do you have any recommendation for $10 vps?

Re: A Gov.uk site dedicated to porn?

#40

Post by londons_explore »

pxeger1 wrote: post #18
tentacleuno wrote: post #7

> Visit [redacted], and you’ll be redirected to a subdomain for EU exit hauliers - except the site isn’t there. Instead it’s a WordPress login page. There’s no username field and we feel confident that a brute force attack would be super effective! > Elsewhere we have the Department for Transport careers page, which sort of does what it says. Clicking on the ‘see all vacancies’ button will redirect you to the civil s…

In fact, it's a t.co link that redirects to a bit.ly link that redirects to the actual site!

This is probably just someone who copied the link from twitter straight into the governments content management system.

The content on this page isn't written by tech people - it's written by policy experts and other civil servants whose expertise isn't exactly how URL's work...

Post reply on HN