5 ms·

It's refused for security reasons. This was how Valve was hacked in 2003, leading to Half Life 2's leak. > "I was scanning Valve's network to check for accessi

It's refused for security reasons. This was how Valve was hacked in 2003, leading to Half Life 2's leak. > "I was scanning Valve's network to check for accessible web servers where I thought information about the game might have been held. Valve's network was reasonably secure from the outside, but the weakness was that their name server allowed anonymous AXFRs, which gave me quite a bit of information." AXFR stands for Asynchronous Full Zone Transfer, a tool used to synchronise backup DNS servers with the same data as the primary server. But it's also a protocol used by hackers to sneak a peek at a website's data. By transferring this data, Gembe was able to discover the names of all the subdomains of ValveSoftware.com. "In the port scan logs, I found an interesting server which was in Valve's network range from another corporation named Tangis that specialised in wearable computing devices," he says. "This server had a publically writable web root where I could upload ASP scripts and execute them via the web server. Valve didn't firewall this server from its internal network." https://www.eurogamer.net/articles/2011-02-21-the-boy-who-stole-half-life-2-article https://www.eurogamer.net/articles/2011-02-21-the-boy-who-st...

fulafel 8y ago
I agree it's often motivated by security reasons, but it's of rather questionable effectiveness. Don't put confidential information in the DNS, ever. Re the Valve case: this could have been also found with a simple ip range port scan, or a bunch of other ways. In the end it was just a server in the network with no access control configured and they happened to spot it in the DNS records first. "In the port scan logs, I found an interesting server which was in Valve's network range from another corporation named Tangis that specialised in wearable computing devices," he says." Also, in the modern world, you can see the web servers in a domain in the public cert transparency logs.

fulafel 8y ago

I agree it's often motivated by security reasons, but it's of rather questionable effectiveness. Don't put confidential information in the DNS, ever. Re the Valve case: this could have been also found with a simple ip range port scan, or a bunch of other ways. In the end it was just a server in the network with no access control configured and they happened to spot it in the DNS records first. "In the port scan logs, I found an interesting server which was in Valve's network range from another corporation named Tangis that specialised in wearable computing devices," he says." Also, in the modern world, you can see the web servers in a domain in the public cert transparency logs.