Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brute-forcing a macOS user’s real name from a browser using mDNS

fingerprint.com

Post reply on HN
Print view View original

31–40 of 168 posts

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#31

Post by vogon_laureate »

tentacleuno wrote: post #3
joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

It might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex

I've historically preferred to use Culture series ship names (eg. GCU Grey Area, GCU Jaundiced Outlook, etc.), but stopped after Elon started naming his SpaceX ships like that.

I then went for Scottish Single Malt names (eg. Laphroaig, Jura, etc.).

After quitting alcohol, I've now settled on Douglas Adams names (eg. Deep Thought, Grunthos the Flatulent, etc.).

Naming machines is the most fun part of the job.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#32

Post by karim79 »

vorticalbox wrote: post #16
franga2000 wrote: post #9

Earlier quoted context omitted.

I do the opposite: one of my laptops is named "Peter's iPhone" (hint: my name is not Peter, nor do I own an iPhone) and I've also set all my Bluetooth to random Bluetooth headset or mouse models.

My hotspot on my phone is "FBI van 4"

One of the hotspots in my flat is called "Honeypot1"

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#33

Post by jakear »

aidos wrote: post #25
doakes wrote: post #21

Earlier quoted context omitted.

Technically they can make the request. The server will receive and respond to the request. CORS is applied by the browser which prevents the response from being read. This is why CORS doesn't prevent a request from mutating something on a server. A CSRF token does.

Is that true? There’s a preflight request that checks with the server as to what’s allowed and then the browser issues the original request if it’s ok, right?

"Simple requests" are not preflighted, such as those that do not set any headers (among other qualifications).

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...

(Aside, is MDN's href linking broken for everyone or just me?)

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#34

Post by pndy »

joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

That reminded me that almost 10 years ago ghacks [1] instructed people to add _nomap to their Wifi networks name to avoid these being harvested by Google and Mozilla. I wonder if that ever worked or still does and if companies stopped collecting that information.

[1] - https://www.ghacks.net/2014/10/29/add-_nomap-to-your-routers...

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#35

Post by zaroth »

aidos wrote: post #25
doakes wrote: post #21

Earlier quoted context omitted.

Technically they can make the request. The server will receive and respond to the request. CORS is applied by the browser which prevents the response from being read. This is why CORS doesn't prevent a request from mutating something on a server. A CSRF token does.

Is that true? There’s a preflight request that checks with the server as to what’s allowed and then the browser issues the original request if it’s ok, right?

"Simple" requests are sent without a OPTIONS preflight check. It's because old style forms could always do a cross-origin request, so you have to protect against it anyway.

For the full definition of what is a "simple" request: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...

EDIT: Lol @ jakear making an almost identical response with the same Mozilla link.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#36

Post by vogon_laureate »

This is interesting, well written up and even has a nice proof of concept. Nicely done!

A fun countermeasure would be to change the device hostname to something like atemptingurl.local that entices the attacker to try visiting that website where a webpage is carefully crafted to run the exact same technique on them and return:

"Hi [hacker's device name]! Your machine information, IP address, geolocation and other fingerprint information has been captured and reported to [insert scary cyber agency here]." Even if they are seasoned veterans rather than script kiddies, it could at least give them a smile.

People need more reasons to smile. :-)

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#37

Post by vorticalbox »

eindiran wrote: post #30
vorticalbox wrote: post #16

Earlier quoted context omitted.

My hotspot on my phone is "FBI van 4"

I see this joke frequently when looking at available wifi; is this meme a reference to a particular thing (other than the FBI having surveillance vans) or did a bunch of people just converge onto it?

I saw it as a meme years a go. I sadly don't know the origin.

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#38

Post by jabbany »

tentacleuno wrote: post #3
joiqj wrote: post #2

As part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.

It might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex

This is not silly at all :-)

Seems pretty in line with the RFC about this https://www.ietf.org/rfc/rfc1178.txt

I do something similar but with other mobile/gacha game characters since those names are always in abundance. I also try to do some kind of correlation with the fictional settings too (groups of devices will correspond to meaningful in-domain names)

For non-mobile devices like workstations or servers, I also tend to directly give FQDN, like (name).(location).(my-personal-domain.tld)

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#39

Post by Arnavion »

darthwalsh wrote: post #4

Is there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)

uBlock Origin static filter:

    ||local^$all
This will block all requests to .local, even from .local itself. If you want to allow foo.local to talk to itself, say because you run a webserver on it, you'll have to add additional overrides for each such domain:

    @@||foo.local^$domain=foo.local,all
... or if you trust your .local entirely to allow any foo.local to talk to any bar.local, you can add one override for all of .local:

    @@||local^$domain=local,all

Re: Brute-forcing a macOS user’s real name from a browser using mDNS

#40

Post by thakoppno »

aidos wrote: post #25
doakes wrote: post #21

Earlier quoted context omitted.

Technically they can make the request. The server will receive and respond to the request. CORS is applied by the browser which prevents the response from being read. This is why CORS doesn't prevent a request from mutating something on a server. A CSRF token does.

Is that true? There’s a preflight request that checks with the server as to what’s allowed and then the browser issues the original request if it’s ok, right?

There are plenty of browser implementations in things like SmartTVs that don’t implement CORS and other security related features correctly.
Post reply on HN