13 ms·

A Recycled IP Address Caused Me to Pirate Books by Accident

260 points by nickjj 9y ago

chatmasta 9y ago
This is known as "subdomain takeover" and is definitely a common problem. It's probably one of the most frequently reported bug types on hackerone. I wonder -- has anyone written code to spin up EC2 instances and check for subdomains pointing to the IP? Not sure how you could do that efficiently (does rdns work after the IP has been recycled?), but a starting point might be gathering as many NXDOMAIN subdomains as possible, filtering the ones at cloud providers, and starting instances until you get a match.
- phlo 9y ago
  > Not sure how you could do that efficiently... You could probably do that quite efficiently with Passive DNS data. There are a bunch of providers (e.g. FarSight, RiskIQ, many others) that collect and aggregate DNS request data and make it searchable over time. RDNS is probably not going to be helpful. I'm not aware of any cloud provider setting a PTR record by default, and I think most won't allow you to do that at all.
  - slrz 9y ago
    GCP as well as Digital Ocean definitely allow for configuring PTR records. AWS does too, I think. At least with GCP, you have to demonstrate ownership of the domain.
- praseodym 9y ago
  Sites like DomainTools have vast amounts of DNS records indexed and allow reverse lookups by IP address (so not actual reverse DNS) which would make your idea pretty doable.
  - petercooper 9y ago
    I believe https://securitytrails.com/ https://securitytrails.com/ is a new player in this space
- Operyl 9y ago
  Bing has been known to be a great search engine for "reverse IP searches." https://www.bing.com/search?q=ip%3A208.109.192.70 https://www.bing.com/search?q=ip%3A208.109.192.70 If you're fast enough, it could still be cached in bing when you search.
  - wpietri 9y ago
    That's surprisingly good. And it turns out that if search Google for my server's IP, I'll find even more things I host, albeit through listings on a bunch of random semi-garbage sites.
  - acangiano 9y ago
    Interesting. I used this to discover that someone is pointing their (pretty decent) domain name towards my server. I won't, but I could theoretically make it display anything of my choosing.
    - styfle 9y ago
      Is it a private server? It might be a shared host so that many domains are pointing to the same IP.
      - acangiano 9y ago
        Yes, private server with dedicated IP.
  - textmode 9y ago
    https://api.hackertarget.com/reverseiplookup/?q=208.109.192.70 https://api.hackertarget.com/reverseiplookup/?q=208.109.192....
    - iforgotpassword 9y ago
      Try passing 1.1.1.1 if you want a no-js version of the infinitely scrolling website.
- mandatory 9y ago
  I actually blogged about this in 2015, it's a problem for basically all cloud providers that allow recycled allocation of IPs: https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-pool-for-dangling-domains/ https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-po...
  - gowld 9y ago
    Is it possible for IPv4 to not recycle IPs? Is IPv6 big enough to not recycle IPs in the modern high-churn deployment world? (It's probably big enough to give every human (or payment card holding customer) a few million blocks of IPs that they can personally control, and recycle IPs within each accountable block that)
    - mirimir 9y ago
      For IPv4, clearly no, at this point. For IPv6, clearly yes, at least so far. It's pretty typical to get at least a /64 aka LAN with a VPS. That's 18 x 10^18 addresses. ISP customers typically get a /56 (256 LANs) or a /48 (65536 LANs).
- dan-c 9y ago
  I wrote a script a few years ago to do the same thing with Digital Ocean floating IPs https://gist.github.com/rxall/5305bcaa008e51685998 https://gist.github.com/rxall/5305bcaa008e51685998
- stephengillie 9y ago
  I suggested something similar while working at an AWS competitor - automated RBL searching. A huge number of our public IPs were used by spammers or phishers on the free tier. They would use a public IP until it was blocked, then release that and get another from the pool. As a cloud host, it's embarrassing to have to explain to your customers that their shiny new IP is on an RBL because it was last used to steal passwords.
  - chatmasta 9y ago
    Did this company have an automated process for dealing with abuse tickets? Usually you’ll get at least one abuse ticket before an IP is added to RBL, right? It shouldn’t come as a surprise when your IP is added to the list after you’ve had X number of abuse complaints about the IP. Seems like a better (or at least, complementary) solution would be more proactive monitoring of the abuse@ email and prompt terminations of clients who generate too many complaints.
    - stephengillie 9y ago
      We didn't have an automated process - we manually investigated and shut down accounts. On the supply side, we had poor fraud detection, also manual, almost entirely one person. There was lots of room to automate things like this, but instead we had a robust internal Powershell library and numerous Slack bots. They embraced the "do things that don't scale" mantra a little too literally.
  - wjoe 9y ago
    Sadly, the more common practice seems to be adding the entire IP blocks of known server/cloud providers to blacklists.
    - chatmasta 9y ago
      Definitely true in my experience, which is funny because it renders the whole point of the RBL entirely moot. It’s certainly not a sustainable solution.
- alex_young 9y ago
  Should be simple. Just log 'host' header from http terminations, right?
- julianj 9y ago
  I used to do this. I once ran across a prod HRC VPN subdomain and got myself banned from r/netsec. https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclintoncom_subdomain_is_pointing_to_my/ https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclint...
deleted 9y ago
[deleted]
iMerNibor 9y ago
Just got some new ips and I've been on the other end of this. Some staging domain of a website still points to one of the ips I got and there's a health checker that keeps trying to ping /health on the domain. Nowhere near the scale of this though, just some background noise I'll ignore
- keketi 9y ago
  Same here. Soon after launching a cloud hosted virtual machine I noticed that it was getting a lot of unexpected HTTP traffic on port 80. They were GET requests with parameters that suggested to me that it was coming from some kind of Javascript browser tracker. I rebooted the VM to get a new IP address and the traffic stopped. It's somebody else's problem now.
- imhoguy 9y ago
  Serve them a cheap gzip b0mb (example [0]) - it sould move their ass to clean up things. [0] https://blog.haschek.at/post/f2fda https://blog.haschek.at/post/f2fda
  - dx034 9y ago
    The users are often innocent, they just want to use the old page. Best is to just serve a 403 or refuse the connection.
  - dogma1138 9y ago
    That’s a nice way of getting your ass in a heap of trouble especially if you experience a drive-by by a legitimate service. Essentially don’t do anything you wouldn’t do in a wrong number call or if someone is knocking on your door looking for the previous tenant.
- datenwolf 9y ago
  > Nowhere near the scale of this though, just some background noise I'll ignore Same situation here. However being on the receiving end of a "formerly" Russian camgirl site makes this a little more than just noise. Any good ideas of what one could do with that?
ataturk 9y ago
Well, you're a criminal now, might as well go for broke.
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
rando444 9y ago
The only way someone is going to gain access to my server is if they manage to gain access to my workstation and steal my SSH key pair. If it has happened before, you'd be foolish to think that it's impossible to happen again. https://nvd.nist.gov/vuln/detail/CVE-2016-1247 https://nvd.nist.gov/vuln/detail/CVE-2016-1247
- tinix 9y ago
  What does this have to do with anything even remotely related to this article, other than it being a webserver? Symlink takeover is not a new vulnerability, and if someone has a user account on your server, you're already owned anyway. Escalating to root is trivial almost always.
  - rando444 9y ago
    The author spends the beginning of the article talking about how he takes security very seriously, that his webserver is practically uncompromisable, and that the odds of it being compromised are so remote because he has "the reflexes of a highly trained ninja" and doesn't run nginx as root. I'm pointing out that his server isn't as uncompromisable as he's trying to lead the reader to believe.
    - tinix 9y ago
      If the author is truly a "ninja" they wouldn't be running their web application as the nginx www-data user in the first place, and then a web application exploit wouldn't inherently give anyone access to the nginx user either to exploit the log-rotation mechanism via symlink. One can read more about the CVE you linked here[1]. But basically the gist of it is this: > As the /var/log/nginx directory is owned by www-data, it is possible for local attackers who have gained access to the system through a vulnerability in a web application running on Nginx (or the server itself) to replace the log files with a symlink to an arbitrary file. This assumes the web application is also running as www-data, which wouldn't be that smart. [1] https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-P...
cathhhhji 9y ago
What would be the reason to use someone else's domain that you don't have control over to point to an IP address?
- deleted 9y ago
  [deleted]
- jacquesm 9y ago
  So that they end up being the ones that are blamed for whatever illegal stuff the perp is up to.
  - gruez 9y ago
    What's the advantage of that compared to using a bare IP? You still need a server to host your illicit content, so you're still exposed that way. Also, DMCA requests are sent to service providers, not to whoever owns the domain. The whole arrangement is probably worse than a bare IP because your site can be "taken down" by someone else with no warning.
    - enzanki_ars 9y ago
      At a school I use to attend, their firewall filtered "inappropriate" content (which is a fun story on it's own...). Was a poor system, and in theory, would have a loophole around it...
    - jacquesm 9y ago
      Which is what happened here but not before a few hundred thousand files were copied. The whole point is that these domain/IP combinations are forgotten which means it could take a long time before the issue is discovered.
- nebulous1 9y ago
  They probably didn't even know that it was accessible via that domain. Their webserver responded to any request with the default site, and google decided to crawl ssl.nickjanetakis.com and found all the pdfs.
tinix 9y ago
Ha! One of my old staging subdomains had an old Digital Ocean address left in it for a bit while we migrated some servers, and Google indexed some random ebook pirate site too, here[1] is a snap of the logs for anyone who is curious. Once I updated the DNS, Googlebot started to blow us up. [1] https://node.zeneval.com/snaps/a79fe276b688da7b589ce539c9a4a062.png https://node.zeneval.com/snaps/a79fe276b688da7b589ce539c9a4a... I never would have even noticed, had it not been for Googlebot indexing the crap out of us, and causing 10s of thousands of sessions to be created in a short time which threw our Munin graphs off the charts. The site we were staging ran fine, redis handled it without breaking a sweat, but we're not a public facing service, so I just straight up blocked Google Bot w/ an nginx rule.
hartator 9y ago
> But before deleting it, I copied the IP address so I could open a support ticket on DigitalOcean. I figured they would like to know that someone is illegally distributing content on one of their servers. Now that they know the IP address, they can shut it down. It’s also possible you exposed a web service that wasn’t meant to be public.
- stelonix 9y ago
  This. The article was interesting but the copyright knighthood put me off. What if the person was simply serving those files for himself over the internet (I've done it countless times) and Google caught it because the author was careless with handling DNS entries? Now DO has an IP and an accusation, more power is given to the DMCA-strike-first-ask-later status quo, all for what? It's not child pornography we're talking about, it's books for Christ's sake. There's no harm, it does not affect your life, why go through the effort of bringing trouble to someone else because of your own lack of care with sensitive issues such as DNS entries?
  - nebulous1 9y ago
    Then the webserver admin should work out how to stop google crawling his site and stop his site responding as any DNS name.
    - hartator 9y ago
      Default Nginx and Apache configs serve all IPs. If you don't share your server IP, it's reasonable to think your content won't be indexed by Google.
      - Qwertie 9y ago
        Google seems to be very good at finding new never seen before content. If you don't want it public then put some kind of authentication on it.
        9y ago
itake 9y ago
Just out of curiosity, how do you know this just wasn't an intentional side effect of someone hosting a website on a DO box? Namely, was the box just responding to anything that would connect to it? Google has probably already crawled that domain previously, and when it asked for that IP address, it found some other persons website.
- smileybarry 9y ago
  The screenshot shows the blog author's name attached to all of the search results as a proper, spaced name. (As opposed to a domain substring) It looks like intended impersonation.
hartator 9y ago
> I know I made a stupid mistake by not removing the A record but this could happen to anyone. I would like to see more services only allow for DNS based authentication by adding TXT records. There is plenty of reasons why one will prefer HTML verification over TXT DNS verification. It's usually faster, and more predictable. Plus DNS are far from being completely secure.
- deleted 9y ago
  [deleted]
- icebraining 9y ago
  It's also pretty nice if you're a provider hosting a website for the client (e.g. Github Pages, Shopify, etc). Getting them to point an A record to us is hard enough, but at least it's only once. Then you can use HTML verification for setting up LE certificates, Analytics, etc.
uptown 9y ago
What's the purpose for spreading PDFs like this? Are there ways to embed malware into PDFs so they attack the host machine of whoever downloads the files?
- tinix 9y ago
  When this happened to me, I jumped to the same conclusion, that the PDFs must be a honeypot or something. But yes, PDFs are exploitable, like any file format. https://www.sans.org/security-resources/malwarefaq/pdf-overview https://www.sans.org/security-resources/malwarefaq/pdf-overv...
- goda90 9y ago
  There are people who feel good about sharing non-free materials with others. Perhaps this approach is for users where torrenting isn't an option.
  - Froyoh 9y ago
    Yep, like me
    - tudelo 9y ago
      I don't disagree with the idea, but it is hard to think of a world where we only optionally pay for things. Do you think it's okay because the cost is prohibitive? Or because if we truly value it we will support it if it is free or not free? I don't necessarily know how to reason this issue out.
throwaway218649 9y ago
> I have Google Alerts set up so I get emailed when people link to my site. A few months ago I started to receive an absurd amount of notifications, but I ignored them. I chalked it up to “Google is probably on drugs”. Between this quote and the bozo-level advice in the "Domain Validation Should Be More Strict" section ("I would like to see more services only allow for DNS based authentication by adding TXT records" is going to solve this problem? permanently decommissioning IPv6 addresses?), the one lesson I can take away from this article is to stay as far away as possible from any of this guy's security related courses.
nebulous1 9y ago
This is a decent reminder to get rid of DNS entries to IP addresses you no longer control. That said ... > A few months ago I started to receive an absurd amount of notifications, but I ignored them. Really? I find it pretty amazing that he chalked it up to “Google is probably on drugs”, without even investigating at all!
- icebraining 9y ago
  I can see myself doing the same thing, particularly if I didn't have much free time when it happened. I wouldn't expect Google Alerts to warn me of a security issue!
  - nickjj 9y ago
    The problem is, when the Google Alert hit my inbox it didn't show the ssl.nickjanetakis.com subdomain in the alert snippet. It just showed "Nick Janetakis". Still, I should have clicked through to see what was up, but then again, the links looked very suspicious. I don't make a habit of clicking a bunch of unknown links sent via email, especially not when running Windows.
- dx034 9y ago
  Second this. I found Google to be the best indicator for any issues with a web page. They have pretty mature systems and crawl actively, anything flagging up there is likely to be an issue. Even if it had been spam you'd want to know who creates spam pages impersonating your domain.
z3t4 9y ago
Google is aggressive when it comes to crawling (which I think is OK) so it's very much possible that the one who hosted these PDF's had no idea that Google had crawled the site, or that it was under that domain.
- smileybarry 9y ago
  It seems like they knew what they were doing, given that the search results have the author's name attached to them. (As a proper name, rather than cutting "nickjanetakis" out of "ssl.nickjanetakis.com")
dec0dedab0de 9y ago
if you're using cookies for sessions on your main domain this can be a very big flaw.
trumped 9y ago
> The odds of that are remote because my workstation never leaves my office and I have the reflexes of a highly trained ninja. Does HE ever leave his office?
heronymus 9y ago
So, where can I download the books now?
incompatible 9y ago
So, if I had a subdomain set up that way, and sci-hub or somebody came along and starting using it, would I have any legal obligation to do anything about it? Could my domain be seized?
- incompatible 9y ago
  I expect the domain registrar terms and conditions would get your domain shut down sooner or later.
WellMeaning 9y ago
https://m.imgur.com/gallery/YYHjrdR https://m.imgur.com/gallery/YYHjrdR
deaps 9y ago
I'm not very security minded. I have old domains and subdomains that I used to use that have long since passed - that lived on server IP's that have also long since passed on from my ownership as well. I just double checked all of my old stuff - and there's not a trace left out there. Apparently, I cleaned up all my old DNS entries as things moved on, even though none of those domains are my 'brand' (as the author states it is his). As a non-security minded person, I find it hard to believe a security-minded person, whose good at his trade, forgets to do this.

260 points by nickjj 9y ago

This is known as "subdomain takeover" and is definitely a common problem. It's probably one of the most frequently reported bug types on hackerone. I wonder -- has anyone written code to spin up EC2 instances and check for subdomains pointing to the IP? Not sure how you could do that efficiently (does rdns work after the IP has been recycled?), but a starting point might be gathering as many NXDOMAIN subdomains as possible, filtering the ones at cloud providers, and starting instances until you get a match.

phlo 9y ago
> Not sure how you could do that efficiently... You could probably do that quite efficiently with Passive DNS data. There are a bunch of providers (e.g. FarSight, RiskIQ, many others) that collect and aggregate DNS request data and make it searchable over time. RDNS is probably not going to be helpful. I'm not aware of any cloud provider setting a PTR record by default, and I think most won't allow you to do that at all.
- slrz 9y ago
  GCP as well as Digital Ocean definitely allow for configuring PTR records. AWS does too, I think. At least with GCP, you have to demonstrate ownership of the domain.
praseodym 9y ago
Sites like DomainTools have vast amounts of DNS records indexed and allow reverse lookups by IP address (so not actual reverse DNS) which would make your idea pretty doable.
- petercooper 9y ago
  I believe https://securitytrails.com/ https://securitytrails.com/ is a new player in this space
Operyl 9y ago
Bing has been known to be a great search engine for "reverse IP searches." https://www.bing.com/search?q=ip%3A208.109.192.70 https://www.bing.com/search?q=ip%3A208.109.192.70 If you're fast enough, it could still be cached in bing when you search.
- wpietri 9y ago
  That's surprisingly good. And it turns out that if search Google for my server's IP, I'll find even more things I host, albeit through listings on a bunch of random semi-garbage sites.
- acangiano 9y ago
  Interesting. I used this to discover that someone is pointing their (pretty decent) domain name towards my server. I won't, but I could theoretically make it display anything of my choosing.
  - styfle 9y ago
    Is it a private server? It might be a shared host so that many domains are pointing to the same IP.
    - acangiano 9y ago
      Yes, private server with dedicated IP.
- textmode 9y ago
  https://api.hackertarget.com/reverseiplookup/?q=208.109.192.70 https://api.hackertarget.com/reverseiplookup/?q=208.109.192....
  - iforgotpassword 9y ago
    Try passing 1.1.1.1 if you want a no-js version of the infinitely scrolling website.
mandatory 9y ago
I actually blogged about this in 2015, it's a problem for basically all cloud providers that allow recycled allocation of IPs: https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-pool-for-dangling-domains/ https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-po...
- gowld 9y ago
  Is it possible for IPv4 to not recycle IPs? Is IPv6 big enough to not recycle IPs in the modern high-churn deployment world? (It's probably big enough to give every human (or payment card holding customer) a few million blocks of IPs that they can personally control, and recycle IPs within each accountable block that)
  - mirimir 9y ago
    For IPv4, clearly no, at this point. For IPv6, clearly yes, at least so far. It's pretty typical to get at least a /64 aka LAN with a VPS. That's 18 x 10^18 addresses. ISP customers typically get a /56 (256 LANs) or a /48 (65536 LANs).
dan-c 9y ago
I wrote a script a few years ago to do the same thing with Digital Ocean floating IPs https://gist.github.com/rxall/5305bcaa008e51685998 https://gist.github.com/rxall/5305bcaa008e51685998
stephengillie 9y ago
I suggested something similar while working at an AWS competitor - automated RBL searching. A huge number of our public IPs were used by spammers or phishers on the free tier. They would use a public IP until it was blocked, then release that and get another from the pool. As a cloud host, it's embarrassing to have to explain to your customers that their shiny new IP is on an RBL because it was last used to steal passwords.
- chatmasta 9y ago
  Did this company have an automated process for dealing with abuse tickets? Usually you’ll get at least one abuse ticket before an IP is added to RBL, right? It shouldn’t come as a surprise when your IP is added to the list after you’ve had X number of abuse complaints about the IP. Seems like a better (or at least, complementary) solution would be more proactive monitoring of the abuse@ email and prompt terminations of clients who generate too many complaints.
  - stephengillie 9y ago
    We didn't have an automated process - we manually investigated and shut down accounts. On the supply side, we had poor fraud detection, also manual, almost entirely one person. There was lots of room to automate things like this, but instead we had a robust internal Powershell library and numerous Slack bots. They embraced the "do things that don't scale" mantra a little too literally.
- wjoe 9y ago
  Sadly, the more common practice seems to be adding the entire IP blocks of known server/cloud providers to blacklists.
  - chatmasta 9y ago
    Definitely true in my experience, which is funny because it renders the whole point of the RBL entirely moot. It’s certainly not a sustainable solution.
alex_young 9y ago
Should be simple. Just log 'host' header from http terminations, right?
julianj 9y ago
I used to do this. I once ran across a prod HRC VPN subdomain and got myself banned from r/netsec. https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclintoncom_subdomain_is_pointing_to_my/ https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclint...

deleted 9y ago

[deleted]

iMerNibor 9y ago

Just got some new ips and I've been on the other end of this. Some staging domain of a website still points to one of the ips I got and there's a health checker that keeps trying to ping /health on the domain. Nowhere near the scale of this though, just some background noise I'll ignore

keketi 9y ago
Same here. Soon after launching a cloud hosted virtual machine I noticed that it was getting a lot of unexpected HTTP traffic on port 80. They were GET requests with parameters that suggested to me that it was coming from some kind of Javascript browser tracker. I rebooted the VM to get a new IP address and the traffic stopped. It's somebody else's problem now.
imhoguy 9y ago
Serve them a cheap gzip b0mb (example [0]) - it sould move their ass to clean up things. [0] https://blog.haschek.at/post/f2fda https://blog.haschek.at/post/f2fda
- dx034 9y ago
  The users are often innocent, they just want to use the old page. Best is to just serve a 403 or refuse the connection.
- dogma1138 9y ago
  That’s a nice way of getting your ass in a heap of trouble especially if you experience a drive-by by a legitimate service. Essentially don’t do anything you wouldn’t do in a wrong number call or if someone is knocking on your door looking for the previous tenant.
datenwolf 9y ago
> Nowhere near the scale of this though, just some background noise I'll ignore Same situation here. However being on the receiving end of a "formerly" Russian camgirl site makes this a little more than just noise. Any good ideas of what one could do with that?

ataturk 9y ago

Well, you're a criminal now, might as well go for broke.

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

rando444 9y ago

The only way someone is going to gain access to my server is if they manage to gain access to my workstation and steal my SSH key pair. If it has happened before, you'd be foolish to think that it's impossible to happen again. https://nvd.nist.gov/vuln/detail/CVE-2016-1247 https://nvd.nist.gov/vuln/detail/CVE-2016-1247

tinix 9y ago
What does this have to do with anything even remotely related to this article, other than it being a webserver? Symlink takeover is not a new vulnerability, and if someone has a user account on your server, you're already owned anyway. Escalating to root is trivial almost always.
- rando444 9y ago
  The author spends the beginning of the article talking about how he takes security very seriously, that his webserver is practically uncompromisable, and that the odds of it being compromised are so remote because he has "the reflexes of a highly trained ninja" and doesn't run nginx as root. I'm pointing out that his server isn't as uncompromisable as he's trying to lead the reader to believe.
  - tinix 9y ago
    If the author is truly a "ninja" they wouldn't be running their web application as the nginx www-data user in the first place, and then a web application exploit wouldn't inherently give anyone access to the nginx user either to exploit the log-rotation mechanism via symlink. One can read more about the CVE you linked here[1]. But basically the gist of it is this: > As the /var/log/nginx directory is owned by www-data, it is possible for local attackers who have gained access to the system through a vulnerability in a web application running on Nginx (or the server itself) to replace the log files with a symlink to an arbitrary file. This assumes the web application is also running as www-data, which wouldn't be that smart. [1] https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-P...

cathhhhji 9y ago

What would be the reason to use someone else's domain that you don't have control over to point to an IP address?

deleted 9y ago
[deleted]
jacquesm 9y ago
So that they end up being the ones that are blamed for whatever illegal stuff the perp is up to.
- gruez 9y ago
  What's the advantage of that compared to using a bare IP? You still need a server to host your illicit content, so you're still exposed that way. Also, DMCA requests are sent to service providers, not to whoever owns the domain. The whole arrangement is probably worse than a bare IP because your site can be "taken down" by someone else with no warning.
  - enzanki_ars 9y ago
    At a school I use to attend, their firewall filtered "inappropriate" content (which is a fun story on it's own...). Was a poor system, and in theory, would have a loophole around it...
  - jacquesm 9y ago
    Which is what happened here but not before a few hundred thousand files were copied. The whole point is that these domain/IP combinations are forgotten which means it could take a long time before the issue is discovered.
nebulous1 9y ago
They probably didn't even know that it was accessible via that domain. Their webserver responded to any request with the default site, and google decided to crawl ssl.nickjanetakis.com and found all the pdfs.

tinix 9y ago

Ha! One of my old staging subdomains had an old Digital Ocean address left in it for a bit while we migrated some servers, and Google indexed some random ebook pirate site too, here[1] is a snap of the logs for anyone who is curious. Once I updated the DNS, Googlebot started to blow us up. [1] https://node.zeneval.com/snaps/a79fe276b688da7b589ce539c9a4a062.png https://node.zeneval.com/snaps/a79fe276b688da7b589ce539c9a4a... I never would have even noticed, had it not been for Googlebot indexing the crap out of us, and causing 10s of thousands of sessions to be created in a short time which threw our Munin graphs off the charts. The site we were staging ran fine, redis handled it without breaking a sweat, but we're not a public facing service, so I just straight up blocked Google Bot w/ an nginx rule.

hartator 9y ago

> But before deleting it, I copied the IP address so I could open a support ticket on DigitalOcean. I figured they would like to know that someone is illegally distributing content on one of their servers. Now that they know the IP address, they can shut it down. It’s also possible you exposed a web service that wasn’t meant to be public.

stelonix 9y ago
This. The article was interesting but the copyright knighthood put me off. What if the person was simply serving those files for himself over the internet (I've done it countless times) and Google caught it because the author was careless with handling DNS entries? Now DO has an IP and an accusation, more power is given to the DMCA-strike-first-ask-later status quo, all for what? It's not child pornography we're talking about, it's books for Christ's sake. There's no harm, it does not affect your life, why go through the effort of bringing trouble to someone else because of your own lack of care with sensitive issues such as DNS entries?
- nebulous1 9y ago
  Then the webserver admin should work out how to stop google crawling his site and stop his site responding as any DNS name.
  - hartator 9y ago
    Default Nginx and Apache configs serve all IPs. If you don't share your server IP, it's reasonable to think your content won't be indexed by Google.
    - Qwertie 9y ago
      Google seems to be very good at finding new never seen before content. If you don't want it public then put some kind of authentication on it.
      - 9y ago

itake 9y ago

Just out of curiosity, how do you know this just wasn't an intentional side effect of someone hosting a website on a DO box? Namely, was the box just responding to anything that would connect to it? Google has probably already crawled that domain previously, and when it asked for that IP address, it found some other persons website.

smileybarry 9y ago
The screenshot shows the blog author's name attached to all of the search results as a proper, spaced name. (As opposed to a domain substring) It looks like intended impersonation.

hartator 9y ago

> I know I made a stupid mistake by not removing the A record but this could happen to anyone. I would like to see more services only allow for DNS based authentication by adding TXT records. There is plenty of reasons why one will prefer HTML verification over TXT DNS verification. It's usually faster, and more predictable. Plus DNS are far from being completely secure.

deleted 9y ago
[deleted]
icebraining 9y ago
It's also pretty nice if you're a provider hosting a website for the client (e.g. Github Pages, Shopify, etc). Getting them to point an A record to us is hard enough, but at least it's only once. Then you can use HTML verification for setting up LE certificates, Analytics, etc.

uptown 9y ago

What's the purpose for spreading PDFs like this? Are there ways to embed malware into PDFs so they attack the host machine of whoever downloads the files?

tinix 9y ago
When this happened to me, I jumped to the same conclusion, that the PDFs must be a honeypot or something. But yes, PDFs are exploitable, like any file format. https://www.sans.org/security-resources/malwarefaq/pdf-overview https://www.sans.org/security-resources/malwarefaq/pdf-overv...
goda90 9y ago
There are people who feel good about sharing non-free materials with others. Perhaps this approach is for users where torrenting isn't an option.
- Froyoh 9y ago
  Yep, like me
  - tudelo 9y ago
    I don't disagree with the idea, but it is hard to think of a world where we only optionally pay for things. Do you think it's okay because the cost is prohibitive? Or because if we truly value it we will support it if it is free or not free? I don't necessarily know how to reason this issue out.

throwaway218649 9y ago

> I have Google Alerts set up so I get emailed when people link to my site. A few months ago I started to receive an absurd amount of notifications, but I ignored them. I chalked it up to “Google is probably on drugs”. Between this quote and the bozo-level advice in the "Domain Validation Should Be More Strict" section ("I would like to see more services only allow for DNS based authentication by adding TXT records" is going to solve this problem? permanently decommissioning IPv6 addresses?), the one lesson I can take away from this article is to stay as far away as possible from any of this guy's security related courses.

nebulous1 9y ago

This is a decent reminder to get rid of DNS entries to IP addresses you no longer control. That said ... > A few months ago I started to receive an absurd amount of notifications, but I ignored them. Really? I find it pretty amazing that he chalked it up to “Google is probably on drugs”, without even investigating at all!

icebraining 9y ago
I can see myself doing the same thing, particularly if I didn't have much free time when it happened. I wouldn't expect Google Alerts to warn me of a security issue!
- nickjj 9y ago
  The problem is, when the Google Alert hit my inbox it didn't show the ssl.nickjanetakis.com subdomain in the alert snippet. It just showed "Nick Janetakis". Still, I should have clicked through to see what was up, but then again, the links looked very suspicious. I don't make a habit of clicking a bunch of unknown links sent via email, especially not when running Windows.
dx034 9y ago
Second this. I found Google to be the best indicator for any issues with a web page. They have pretty mature systems and crawl actively, anything flagging up there is likely to be an issue. Even if it had been spam you'd want to know who creates spam pages impersonating your domain.

z3t4 9y ago

Google is aggressive when it comes to crawling (which I think is OK) so it's very much possible that the one who hosted these PDF's had no idea that Google had crawled the site, or that it was under that domain.

smileybarry 9y ago
It seems like they knew what they were doing, given that the search results have the author's name attached to them. (As a proper name, rather than cutting "nickjanetakis" out of "ssl.nickjanetakis.com")

dec0dedab0de 9y ago

if you're using cookies for sessions on your main domain this can be a very big flaw.

trumped 9y ago

> The odds of that are remote because my workstation never leaves my office and I have the reflexes of a highly trained ninja. Does HE ever leave his office?

heronymus 9y ago

So, where can I download the books now?

incompatible 9y ago

So, if I had a subdomain set up that way, and sci-hub or somebody came along and starting using it, would I have any legal obligation to do anything about it? Could my domain be seized?

incompatible 9y ago
I expect the domain registrar terms and conditions would get your domain shut down sooner or later.

WellMeaning 9y ago

https://m.imgur.com/gallery/YYHjrdR https://m.imgur.com/gallery/YYHjrdR

deaps 9y ago

I'm not very security minded. I have old domains and subdomains that I used to use that have long since passed - that lived on server IP's that have also long since passed on from my ownership as well. I just double checked all of my old stuff - and there's not a trace left out there. Apparently, I cleaned up all my old DNS entries as things moved on, even though none of those domains are my 'brand' (as the author states it is his). As a non-security minded person, I find it hard to believe a security-minded person, whose good at his trade, forgets to do this.