Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Gov.uk site dedicated to porn?

thecrow.uk

Post reply on HN
Print view View original

71–80 of 93 posts

Re: A Gov.uk site dedicated to porn?

#71

Post by necovek »

toast0 wrote: post #50
necovek wrote: post #37

Earlier quoted context omitted.

That's what I suggested with >> Scan the entire internet for domains pointing to s3-website, and check AWS API to see if it's available? What I wonder is how do you scan all the DNS records with their subdomains? Unlike IPv4 address space, which is very decidedly finite and not-too-big, the space of all the subdomains is basically infinite. Other than using AXFR (zone-transfer DNS request) which is usually restricted…

There are size and character limits on DNS, so it's not infinite, although it may still be a pretty large space. Charts.(something well known) could have been a dictionary check though. AXFR makes it a lot easier though.

Ah, I totally forgot about the domain name (255) and label (63) length limits: thanks!

Still, we are looking at roughly 38*255 possible options (a-z, 0-9, a hyphen and dot to separate labels; "roughly" because each label between periods can be up to 64 characters, labels must be non-empty, and hyphens can't start a label).

As you said, it's pretty large: compared to 2*32 of IPv4 or even 2*128 of IPv6, this is more than (2*5)*255 = 2*1275 options.

Re: A Gov.uk site dedicated to porn?

#72

Post by ClumsyPilot »

rbanffy wrote: post #47

> Best of British Porn? Not Quite That's not a very fair assessment. The same way as it's difficult to find British dishes better than, say, minced beef and onion pie, it's challenging to find authentically British porn that's better than this govermnent office provides its people. We should commend the Tory government for its dedication.

"authentically British porn"

That's a concept I have not pondered before.

Re: A Gov.uk site dedicated to porn?

#74

Post by tialaramex »

necovek wrote: post #37
mh- wrote: post #26

Earlier quoted context omitted.

What sometimes happens is someone points a CNAME to a non-existent bucket. Either because they were planning ahead, or someone typo'd a bucket (and thus DNS) name. There are bots that scan for this. Then someone creates the bucket on S3 and boom, subdomain hijack.

That's what I suggested with >> Scan the entire internet for domains pointing to s3-website, and check AWS API to see if it's available? What I wonder is how do you scan all the DNS records with their subdomains? Unlike IPv4 address space, which is very decidedly finite and not-too-big, the space of all the subdomains is basically infinite. Other than using AXFR (zone-transfer DNS request) which is usually restricted…

> how do you scan all the DNS records with their subdomains?

You needn't do this for stuff that would work in these "Hijack" situations.

Your target is any link that gets visited, maybe following a bookmark somebody made in 2018, maybe it's linked from some page that was never updated, maybe it's in an email somebody archived. If you're phishing you have one set of preferences, if you're doing SEO you have different preferences (you want crawlers to see it but not too many humans).

When anything follows that link, a DNS lookup happens. Most of the world's DNS queries and answers (not who asked, but what is looked up and the answer) are sold in bulk as "passive DNS". You buy a passive DNS feed from one of a handful of big suppliers, or if you're cheap you hijack somebody with money's feed.

So, you're working from a pile like:

  www.google.com A 142.250.200.4
  www.bigbank.com CNAME www1.bigbank.com
  www1.bigbank.com A 10.20.30.40
  charts.dft.gov.uk CNAME charts.dft.gov.uk.s3-website-eu-west-1.amazonaws.com
Obviously you can grep out all those S3 buckets and then you ask S3, hey, does charts.dft.gov.uk exist? And it says of course not, so you create charts.dft.gov.uk as an S3 bucket and you win.

Re: A Gov.uk site dedicated to porn?

#76

Post by rbanffy »

ClumsyPilot wrote: post #72
rbanffy wrote: post #47

> Best of British Porn? Not Quite That's not a very fair assessment. The same way as it's difficult to find British dishes better than, say, minced beef and onion pie, it's challenging to find authentically British porn that's better than this govermnent office provides its people. We should commend the Tory government for its dedication.

"authentically British porn" That's a concept I have not pondered before.

There are things we regret not doing and things we regret doing.

I’m sorry.

Re: A Gov.uk site dedicated to porn?

#77

Post by FiloSottile »

tialaramex wrote: post #29
notatoad wrote: post #3

Wow. I thought this was going to be about some sneaky exploit where they'd manage to get a gov.uk to forward links to porn or something. But no, it's really a whole subdomain just taken over by some sketchy porn site. I'm wondering if the porn site operators even know it's happening? Seems the most likely thing is the DfT had a site at that URL, hosted on AWS. And then they shut it down without removing the DNS recor…

The thing where IP 10.20.30.40‡ is in the DNS for thing.mycorp.example and later nobody cares about thing.mycorp.example and they give up control without removing the DNS entry - is why you can't get Let's Encrypt certificates by just running a HTTPS web server and you need either plain HTTP, a custom TLS server (it can also do HTTPS but it needs to know about ACME as well) or else DNS. Lots of bulk hosts will let yo…

That’s not really what the issue with the tls-sni challenge was.

How that challenge worked was that the CA would give you a certificate for a fictitious name (say, abc123.acme-challenge.invalid) and you had to present it from the host when asked for that name by the client (the CA) though SNI.

Many hosts that share IPs between customers also let those customers upload their own certificates. The attack just involved uploading a challenge certificate for a colocated site, and letting the host serve it as expected. Even if the host _did_ check that the name on the cert was not the name of another customer (which is itself sometimes impossible), and even if the target site was not abandoned, and even if it had correctly functioning HTTPS, these are fictitious made up names, so the attack would still work.

It involved no ignoring the Host header, or really any misconfiguration, that’s why it requires rolling to tls-alpn.

Re: A Gov.uk site dedicated to porn?

#78

Post by bigiain »

qeternity wrote: post #69
Iolaum wrote: post #63

Earlier quoted context omitted.

Why doesn't it make sense? After 6 months your Rpi4 will be costing less than the VPS. Plus you get the fun of actually doing it. P.S. Getting weird RPi errors because of power supply makes you appreciate the value proposition of a good VPS :p

> After 6 months your Rpi4 will be costing less than the VPS. No, $10 per year, not per month. That means the rPi payback is 5-6 years, and for inferior hardware and bandwidth.

You and I clearly have different expectations for "a decent VPS"...

(I have a "One time cost access forever!" VPS, which varies me $9/year "maintenance fees", which I'm happy enough with for the money, but it's definitely "Useful for the price" rather than "decent".)

Re: A Gov.uk site dedicated to porn?

#79

Post by notatoad »

killingtime74 wrote: post #66
Iolaum wrote: post #63

Earlier quoted context omitted.

Why doesn't it make sense? After 6 months your Rpi4 will be costing less than the VPS. Plus you get the fun of actually doing it. P.S. Getting weird RPi errors because of power supply makes you appreciate the value proposition of a good VPS :p

Only if power is free

and bandwidth. and physical space, and the ability to stay isolated from physical conditions like floods (natural or plumbing-related) or power outages caused by somebody trying to plug in a kettle.

running a commercial VPS in a datacenter has a ton of advantages, but i'm guessing that the guy with a footer like this doesn't really care about them. running your website off a raspi in your living room is cool, wheher it's the most practical solution or not doesn't really matter.

Re: A Gov.uk site dedicated to porn?

#80

Post by ackbar03 »

Firefishy wrote: post #62

Sub-domain takeover attack. The sub-domain was CNAME'ed to a S3 bucket and the S3 bucket had likely been deleted. The porn purveyor, re-created a new S3 bucket with pr0n. A scanner that would have caught the vulnerability: https://tech.ovoenergy.com/how-we-prevented-subdomain-takeov... Or a grey hat scanner for finding sub-domains vulnerable to takeover: https://github.com/m4ll0k/takeover

Yes. These are pretty much standard fodder for bugs reported on somewhere like hackerone. I guess someone who knew what he was doing just decided to take advantage of it lol
Post reply on HN