6 ms·

The address exposure vulnerability is really, really bad. Just about anyone was able to impersonate another Comcast customer by sending their home IP address in

The address exposure vulnerability is really, really bad. Just about anyone was able to impersonate another Comcast customer by sending their home IP address in the X-Forwarded-For header to Comcast's device activation page, and easily see a masked version of their address (first number of street number and partial street name; street name is trivial to figure out with IP geolocation, street number would need some trial and error). I wonder how many Comcast customers were doxed with this method before it was fixed.

deleted 8y ago
[deleted]
shawn 8y ago
So, at the risk of getting murdered for this sentiment: Who cares? So what if someone knows your address? I guess it's a bigger problem for celebrities or for those who are targeted. But even then, the police are there. Just call them. I'm trying to understand the other side of this.
- kaishiro 8y ago
  I'm actually with you to a degree - but on the flip side, should we expect repercussions for something like this? Should we just be ok with it? As an industry we tend to play it pretty fast and loose compared to other engineering disciplines.
- vvanders 8y ago
  > But even then, the police are there. Just call them. Uh, isn't that the exact problem? Once someone knows your address you're a voip call away from swatting.
  - shawn 8y ago
    Ah, yeah, I completely forgot about swatting. Good point. The sooner that problem gets solved, the better.
    - AnthonyMouse 8y ago
      > The sooner that problem gets solved, the better. We could just stop having SWAT teams. The events that supposedly justify them are so exceedingly rare that most members of SWAT teams go their entire careers without ever seeing one. But once they exist they get used for all kinds of routine operations that don't actually require them, where all they do is raise tensions and unnecessarily escalate matters. There is a reason there is supposed to be a hard wall between the police and the military. If you really need a military presence, the governor can call in the National Guard. But when does that happen? Even they mostly end up getting called in for hurricane relief and that sort of thing.
      - gm-conspiracy 8y ago
        The National Guard is called in when the local police force kills innocent civilians.
- uxp 8y ago
  Think of it this way: Two people are playing an online game, and one gets mad at the other. He or she then sends a link to an image or something else to the player they are mad at, effectively siphoning off their IP address. By using this flaw, it could make it trivial to find their real address if it was a comcast customer, and send the SWAT team to their house.
  - trocadero 8y ago
    Finding a location by IP address is not always reliable. The first result when googling my IP address yields a city 1,000 miles away (other results have the correct city). Then, knowing the first digit of a street address gets you a range of addresses that can represent anywhere from 1 to hundreds of homes. It's theoretically possible to get a specific address from this method but it's unlikely and not reliable.
    - Firerouge 8y ago
      The point of the article is that you could essentially get the exact address house address from just the IP of a Comcast customer
      - trocadero 8y ago
        Right, and my point is that you essentially can't. For my address the best you could do is narrow it down to ~30 or so homes that share the same first digit as my address. For this to work you have to: (1) Have the IP address return the right location (2) Not have duplicate street names in that location (3) Have a single digit address OR be the only home starting with that number That's going to be a pretty rare combo. Probably less than 1%.
        meowface 8y ago
        They'll be able to narrow it down to 10-30 homes, but from there they can see who owns those homes, research those people on social media etc., and determine who their likely target is.
- arzel 8y ago
  The information you obtain from vulnerabilities like these are used to obtain “original” social media accounts, and are then sold for a lot of money. To define what “original” is, take for instance “@shawn” on Instagram or Twitter. When these people target celebrities, they are mainly looking for a laugh and believe their “method” is about to be patched. For example, T-Mobile and Verizon vulnerabilities are used to SIM swap and get around 2FA on instagram or twitter. Usually, they first try to find an employee who works at the store and has access to the database, before going through all the trouble of finding a vuln. This has been an “underground” space for quite some time, but is slowly coming to light. Source: I use to be in this space and made so much money off original usernames. To give you an idea of what a username goes for, I sold the Instagram @b*ss for $20,000.
  - lawnchair_larry 8y ago
    How did you get that username?
  - komali2 8y ago
    How do users in this space securely transfer money without the FBI kicking down their door the next day?
  - shawn 8y ago
    Wow, this is a fascinating answer. Thanks for sharing.
- phil248 8y ago
  In many jurisdictions, the police will do little or nothing until a crime is committed. It's possible to experience a life-altering amount of harassment before the police will intervene in any meaningful way.
- sampl 8y ago
  I’m close with someone who actively keeps her address from public records to keep an old stalker from finding her. The psychological effect of having someone treat you like an object, repeatedly hunt you down after moves, and gaslight you/landlords/cops into believing it’s not happening is harmful as it is—let alone the not-so-unlikely chance that someone with this high degree of intelligence and mental health issues will physically hurt you if they find you. There’s not much you can do besides a paper restraining order. By the time the cops come it’s too late. This possibility is a very real part of many people’s lives, but maybe less talked about with men like me because statistically female victims are more common.
  - PhantomGremlin 8y ago
    There’s not much you can do besides a paper restraining order. By the time the cops come it’s too late. The cops don't have a specific obligation to "come" to help you. Nor to enforce a restraining order. https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzales https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzale... Everyone should read those two Wiki entries. The law often isn't what people think it is. OTOH if someone breaks into your house and you smoke 'em, then in most states you're in the clear, even without a restraining order. I know that's not what most people here want to read, but it is "the law of the land" in terms of legal precedent.
- deleted 8y ago
  [deleted]
- threatofrain 8y ago
  The police? That sounds like a very ineffective solution. People aren't safe because of the police, they're safe because of the trustworthiness of their neighbors. The police can't be there to intercept most crimes; instead they show up to write a report post-fact. But at that point, you're calling the police for documentation of a crime for insurance. Police can't be there to intercept the metaphorical brick through your window. The reason why we feel safe walking outside everyday is because of the fabric of trust in our community.
- deftnerd 8y ago
  If you operate any kind of Bitcoin related service where someone discusses their wealth (message board, wallet provider, etc), then being able to turn an IP address into a physical address could have resulted in very lucrative forced-entry events where threat of force was used to leverage private keys.
  - HeyLaughingBoy 8y ago
    How is this different than just breaking into houses in rich neighborhoods?
    - smelendez 8y ago
      Most rich people don't have huge volumes of cash or anything as liquid as Bitcoin lying around.
- matt4077 8y ago
  The "other side" consists of: - a select few with good reasons to avoid their address being widely known. Because stalkers etc. - All those infsec bros with their "attack vectors" and their "threat landscape". They'll scream "security by obscurity" when you're using an unlisted URL to share holiday photos, but get really miffed if someone finds out where they live, or where they go running.
- nextlevelwizard 8y ago
  OK, I bite. Please post your current home address.
  - shawn 8y ago
    I was thinking that exact thing in the name of experimentation. A sort of "Please come harass me, I want to see what people have to deal with."
    - LeftTurnSignal 8y ago
      I think that scenario was what happened with one of the more recent swattings in the news. Person A and Person B are getting hot and bothered about something stupid. Person A says "come at me bro, here's my address." Person A gave Person B Person C's address instead. Person B swatted Person C. Person C had no idea what was going on, went outside, maybe panicked, maybe whatever, but Person C was shot and killed because SWAT had no idea. I believe A and B were arrested, but usually the cops don't get lucky. They couldn't find the idiot who tried swatting me, but they don't exactly have a ton of resources either. Shit's scary, especially since it can happen anytime.
peterwwillis 8y ago
> The address exposure vulnerability is really, really bad I have the President of the United States' address. 1600 Pennsylvania Avenue. Oh no! I done dox'd him! Exposing information about someone that is largely already public is somewhat bad, but it's not "really, really bad". And it's certainly not worse than exposing the last 4 of their SSN. There are many ways to dox people. If you have a specific target, you probably know their name; if not, you can phish it, and any other information you want. If you have their IP, you know their ISP. With their name and their ISP, and maybe some extra info gleaned from various sources like social media, you can get pretty much anything you want. Account access, phone numbers, billing information, socials, etc. With their phone number you can take over their phone, and then all their SMS-linked accounts. Is this scary? Yes. Did I need to slowly extract their home address using a vendor's web form and their IP? No. The last 4 of the social is much worse. It makes all of this incredibly easy and gives access to much more sensitive information, like medical records, payroll, government service information, etc.
- loeg 8y ago
  Yeah. Homeowner in Seattle? http://gismaps.kingcounty.gov/parcelviewer2/ http://gismaps.kingcounty.gov/parcelviewer2/ has your address publically available, unless you made special plans to purchase with an LLC or something. (And you probably need to be sure your LLC's mailing address is a PO box as well.)
  - golem14 8y ago
    That's beside the point. Resolving parcel numbers to owners is also problematic, likewise resolving license plate numbers to owners (used to be possible in Switzerland), but we're talking resolving IP addresses to owners. I wonder how many porn sites could blackmail viewers, or Honeypot mpaa operatos could sue torrent users more easily...
    - loeg 8y ago
      It sounds like you think we disagree, but we don't disagree. Parcel lookup is just an interesting public information database many people are unaware of — so I felt it was worth sharing.
cm2012 8y ago
You know its almost trivial to buy millions of people's full names, addresses, estimated income, etc., from legit data brokers right? It's how credit card start-ups know who to send direct mail to and it's 100% legal.
- kevindqc 8y ago
  This is different though, no? Say you go post on Infowars anonymously (but not through Tor/VPN/Proxy). They can now know where you live. Of course the address is public. The relation between your IP address and your actual address isn't...
  - cm2012 8y ago
    Yeah, that is indeed very differenr and troubling. I misunderstood.
- meowface 8y ago
  This is very different. This is when you want to target a specific individual and are capable of attaining their IP address, but otherwise know none of their personal information. This, for example, greatly empowers SWATers.

deleted 8y ago

[deleted]

shawn 8y ago

So, at the risk of getting murdered for this sentiment: Who cares? So what if someone knows your address? I guess it's a bigger problem for celebrities or for those who are targeted. But even then, the police are there. Just call them. I'm trying to understand the other side of this.

kaishiro 8y ago
I'm actually with you to a degree - but on the flip side, should we expect repercussions for something like this? Should we just be ok with it? As an industry we tend to play it pretty fast and loose compared to other engineering disciplines.
vvanders 8y ago
> But even then, the police are there. Just call them. Uh, isn't that the exact problem? Once someone knows your address you're a voip call away from swatting.
- shawn 8y ago
  Ah, yeah, I completely forgot about swatting. Good point. The sooner that problem gets solved, the better.
  - AnthonyMouse 8y ago
    > The sooner that problem gets solved, the better. We could just stop having SWAT teams. The events that supposedly justify them are so exceedingly rare that most members of SWAT teams go their entire careers without ever seeing one. But once they exist they get used for all kinds of routine operations that don't actually require them, where all they do is raise tensions and unnecessarily escalate matters. There is a reason there is supposed to be a hard wall between the police and the military. If you really need a military presence, the governor can call in the National Guard. But when does that happen? Even they mostly end up getting called in for hurricane relief and that sort of thing.
    - gm-conspiracy 8y ago
      The National Guard is called in when the local police force kills innocent civilians.
uxp 8y ago
Think of it this way: Two people are playing an online game, and one gets mad at the other. He or she then sends a link to an image or something else to the player they are mad at, effectively siphoning off their IP address. By using this flaw, it could make it trivial to find their real address if it was a comcast customer, and send the SWAT team to their house.
- trocadero 8y ago
  Finding a location by IP address is not always reliable. The first result when googling my IP address yields a city 1,000 miles away (other results have the correct city). Then, knowing the first digit of a street address gets you a range of addresses that can represent anywhere from 1 to hundreds of homes. It's theoretically possible to get a specific address from this method but it's unlikely and not reliable.
  - Firerouge 8y ago
    The point of the article is that you could essentially get the exact address house address from just the IP of a Comcast customer
    - trocadero 8y ago
      Right, and my point is that you essentially can't. For my address the best you could do is narrow it down to ~30 or so homes that share the same first digit as my address. For this to work you have to: (1) Have the IP address return the right location (2) Not have duplicate street names in that location (3) Have a single digit address OR be the only home starting with that number That's going to be a pretty rare combo. Probably less than 1%.
      - meowface 8y ago
        They'll be able to narrow it down to 10-30 homes, but from there they can see who owns those homes, research those people on social media etc., and determine who their likely target is.
arzel 8y ago
The information you obtain from vulnerabilities like these are used to obtain “original” social media accounts, and are then sold for a lot of money. To define what “original” is, take for instance “@shawn” on Instagram or Twitter. When these people target celebrities, they are mainly looking for a laugh and believe their “method” is about to be patched. For example, T-Mobile and Verizon vulnerabilities are used to SIM swap and get around 2FA on instagram or twitter. Usually, they first try to find an employee who works at the store and has access to the database, before going through all the trouble of finding a vuln. This has been an “underground” space for quite some time, but is slowly coming to light. Source: I use to be in this space and made so much money off original usernames. To give you an idea of what a username goes for, I sold the Instagram @b*ss for $20,000.
- lawnchair_larry 8y ago
  How did you get that username?
- komali2 8y ago
  How do users in this space securely transfer money without the FBI kicking down their door the next day?
- shawn 8y ago
  Wow, this is a fascinating answer. Thanks for sharing.
phil248 8y ago
In many jurisdictions, the police will do little or nothing until a crime is committed. It's possible to experience a life-altering amount of harassment before the police will intervene in any meaningful way.
sampl 8y ago
I’m close with someone who actively keeps her address from public records to keep an old stalker from finding her. The psychological effect of having someone treat you like an object, repeatedly hunt you down after moves, and gaslight you/landlords/cops into believing it’s not happening is harmful as it is—let alone the not-so-unlikely chance that someone with this high degree of intelligence and mental health issues will physically hurt you if they find you. There’s not much you can do besides a paper restraining order. By the time the cops come it’s too late. This possibility is a very real part of many people’s lives, but maybe less talked about with men like me because statistically female victims are more common.
- PhantomGremlin 8y ago
  There’s not much you can do besides a paper restraining order. By the time the cops come it’s too late. The cops don't have a specific obligation to "come" to help you. Nor to enforce a restraining order. https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzales https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzale... Everyone should read those two Wiki entries. The law often isn't what people think it is. OTOH if someone breaks into your house and you smoke 'em, then in most states you're in the clear, even without a restraining order. I know that's not what most people here want to read, but it is "the law of the land" in terms of legal precedent.
deleted 8y ago
[deleted]
threatofrain 8y ago
The police? That sounds like a very ineffective solution. People aren't safe because of the police, they're safe because of the trustworthiness of their neighbors. The police can't be there to intercept most crimes; instead they show up to write a report post-fact. But at that point, you're calling the police for documentation of a crime for insurance. Police can't be there to intercept the metaphorical brick through your window. The reason why we feel safe walking outside everyday is because of the fabric of trust in our community.
deftnerd 8y ago
If you operate any kind of Bitcoin related service where someone discusses their wealth (message board, wallet provider, etc), then being able to turn an IP address into a physical address could have resulted in very lucrative forced-entry events where threat of force was used to leverage private keys.
- HeyLaughingBoy 8y ago
  How is this different than just breaking into houses in rich neighborhoods?
  - smelendez 8y ago
    Most rich people don't have huge volumes of cash or anything as liquid as Bitcoin lying around.
matt4077 8y ago
The "other side" consists of: - a select few with good reasons to avoid their address being widely known. Because stalkers etc. - All those infsec bros with their "attack vectors" and their "threat landscape". They'll scream "security by obscurity" when you're using an unlisted URL to share holiday photos, but get really miffed if someone finds out where they live, or where they go running.
nextlevelwizard 8y ago
OK, I bite. Please post your current home address.
- shawn 8y ago
  I was thinking that exact thing in the name of experimentation. A sort of "Please come harass me, I want to see what people have to deal with."
  - LeftTurnSignal 8y ago
    I think that scenario was what happened with one of the more recent swattings in the news. Person A and Person B are getting hot and bothered about something stupid. Person A says "come at me bro, here's my address." Person A gave Person B Person C's address instead. Person B swatted Person C. Person C had no idea what was going on, went outside, maybe panicked, maybe whatever, but Person C was shot and killed because SWAT had no idea. I believe A and B were arrested, but usually the cops don't get lucky. They couldn't find the idiot who tried swatting me, but they don't exactly have a ton of resources either. Shit's scary, especially since it can happen anytime.

peterwwillis 8y ago

> The address exposure vulnerability is really, really bad I have the President of the United States' address. 1600 Pennsylvania Avenue. Oh no! I done dox'd him! Exposing information about someone that is largely already public is somewhat bad, but it's not "really, really bad". And it's certainly not worse than exposing the last 4 of their SSN. There are many ways to dox people. If you have a specific target, you probably know their name; if not, you can phish it, and any other information you want. If you have their IP, you know their ISP. With their name and their ISP, and maybe some extra info gleaned from various sources like social media, you can get pretty much anything you want. Account access, phone numbers, billing information, socials, etc. With their phone number you can take over their phone, and then all their SMS-linked accounts. Is this scary? Yes. Did I need to slowly extract their home address using a vendor's web form and their IP? No. The last 4 of the social is much worse. It makes all of this incredibly easy and gives access to much more sensitive information, like medical records, payroll, government service information, etc.

loeg 8y ago
Yeah. Homeowner in Seattle? http://gismaps.kingcounty.gov/parcelviewer2/ http://gismaps.kingcounty.gov/parcelviewer2/ has your address publically available, unless you made special plans to purchase with an LLC or something. (And you probably need to be sure your LLC's mailing address is a PO box as well.)
- golem14 8y ago
  That's beside the point. Resolving parcel numbers to owners is also problematic, likewise resolving license plate numbers to owners (used to be possible in Switzerland), but we're talking resolving IP addresses to owners. I wonder how many porn sites could blackmail viewers, or Honeypot mpaa operatos could sue torrent users more easily...
  - loeg 8y ago
    It sounds like you think we disagree, but we don't disagree. Parcel lookup is just an interesting public information database many people are unaware of — so I felt it was worth sharing.

cm2012 8y ago

You know its almost trivial to buy millions of people's full names, addresses, estimated income, etc., from legit data brokers right? It's how credit card start-ups know who to send direct mail to and it's 100% legal.

kevindqc 8y ago
This is different though, no? Say you go post on Infowars anonymously (but not through Tor/VPN/Proxy). They can now know where you live. Of course the address is public. The relation between your IP address and your actual address isn't...
- cm2012 8y ago
  Yeah, that is indeed very differenr and troubling. I misunderstood.
meowface 8y ago
This is very different. This is when you want to target a specific individual and are capable of attaining their IP address, but otherwise know none of their personal information. This, for example, greatly empowers SWATers.