3 ms·

oh, I completely agree that certificate transparency is beneficial for that and we have an alert setup. But, that still leaves me not wanting to leak every sing

oh, I completely agree that certificate transparency is beneficial for that and we have an alert setup. But, that still leaves me not wanting to leak every single subdomain we use internally. Hence using wildcard certificates.

njsubedi 7y ago
Wouldn't it be a better idea to use alternate domains instead of subdomains? You could use something like [any subdomain].atdie8e73bhdbdie93ruhe.[any tld] for obfuscation?
- saagarjha 7y ago
  Those cost money.
tialaramex 7y ago
CT didn't change this for bad guys. If you're a bad guy (or a neutral researcher with a budget for the data) you can buy what's called "Passive DNS". Several suppliers will give you a list of DNS requests and their answers, the identifying information for who made the requests is elided so it's not PII but it has the same effect of making the fact servername.example.com exists in effect public information. Even if you are unusual in actually having machines named cy23hdc9.example.com not exchange2016.example.com then the existence of this service means you need to stop assuming nobody knows these names. Anybody who cares knows them.
- xg15 7y ago
  Yes, which is why you used to be able to have fully internal domains that are served by an internal DNS server and are never seen on the public internet.
  - castillar76 7y ago
    You can still have this: it's called 'split-horizon' or 'split-brain' DNS. It can be tough to set up and maintain for large DNS environments, but not /that/ difficult even at that level. If you do this and you don't want those names in the public CT records, though, you have to implement a private internal PKI for those servers so they're not getting public certs. Or use a wildcard, which carries its own significant security risks.
    - xg15 7y ago
      > you have to implement a private internal PKI for those servers so they're not getting public certs This would also involve setting up a custom CA and distributing your CA cert to all machines that should be able to access the page. Good luck with that! All of this is a ridiculous amount of effort to set up and maintain. It's a lot easier to just make the internal domains accessible to the internet and be done with it. The effect being that networks are being nudged into exposing a lot more surface to the internet - and this somehow in the name of more security.
      - castillar76 7y ago
        It's not terribly painful to do if you have central management (e.g. you can push them out through a GPO or MDM system). For small businesses, however, I totally agree it's a pain in the neck: the school my wife teaches at would have a devil of a time doing it with their current IT staff workload, and they'd still have issues with unmanaged devices. And all that's to say nothing of the ticking time-bomb that occurs when you set up your own PKI--good luck remembering to replace that root CA ten years down the line when it explodes. The cynical part of me says that certain companies might be very interested in the search possibilities gained from exposing internal networks to the Internet, and the increasing lock-in that occurs when you make your systems dependent on their public CA instead of your own private one. But perhaps that's just the tinfoil-hat talking. :)
  - labawi 7y ago
    You could create your own CA, limited to your domain and install it on the respective devices.
- TeMPOraL 7y ago
  I never heard about Passive DNS before. Thanks. That said, shouldn't that be illegal? Where does this data come from anyway? I'm guessing spyware - on the phone, in browsers, and spyware browsers like Chrome.
  - tialaramex 7y ago
    Unless the people answering DNS queries for you have explicitly contracted (with you, or with all users) not to do this you should assume they contribute to one or more passive DNS services because it's free revenue for them. I'd be very surprised if any of the suppliers use spyware, seems like it'd be far less effective and also more expensive to do.

njsubedi 7y ago

Wouldn't it be a better idea to use alternate domains instead of subdomains? You could use something like [any subdomain].atdie8e73bhdbdie93ruhe.[any tld] for obfuscation?

saagarjha 7y ago
Those cost money.

tialaramex 7y ago

CT didn't change this for bad guys. If you're a bad guy (or a neutral researcher with a budget for the data) you can buy what's called "Passive DNS". Several suppliers will give you a list of DNS requests and their answers, the identifying information for who made the requests is elided so it's not PII but it has the same effect of making the fact servername.example.com exists in effect public information. Even if you are unusual in actually having machines named cy23hdc9.example.com not exchange2016.example.com then the existence of this service means you need to stop assuming nobody knows these names. Anybody who cares knows them.

xg15 7y ago
Yes, which is why you used to be able to have fully internal domains that are served by an internal DNS server and are never seen on the public internet.
- castillar76 7y ago
  You can still have this: it's called 'split-horizon' or 'split-brain' DNS. It can be tough to set up and maintain for large DNS environments, but not /that/ difficult even at that level. If you do this and you don't want those names in the public CT records, though, you have to implement a private internal PKI for those servers so they're not getting public certs. Or use a wildcard, which carries its own significant security risks.
  - xg15 7y ago
    > you have to implement a private internal PKI for those servers so they're not getting public certs This would also involve setting up a custom CA and distributing your CA cert to all machines that should be able to access the page. Good luck with that! All of this is a ridiculous amount of effort to set up and maintain. It's a lot easier to just make the internal domains accessible to the internet and be done with it. The effect being that networks are being nudged into exposing a lot more surface to the internet - and this somehow in the name of more security.
    - castillar76 7y ago
      It's not terribly painful to do if you have central management (e.g. you can push them out through a GPO or MDM system). For small businesses, however, I totally agree it's a pain in the neck: the school my wife teaches at would have a devil of a time doing it with their current IT staff workload, and they'd still have issues with unmanaged devices. And all that's to say nothing of the ticking time-bomb that occurs when you set up your own PKI--good luck remembering to replace that root CA ten years down the line when it explodes. The cynical part of me says that certain companies might be very interested in the search possibilities gained from exposing internal networks to the Internet, and the increasing lock-in that occurs when you make your systems dependent on their public CA instead of your own private one. But perhaps that's just the tinfoil-hat talking. :)
- labawi 7y ago
  You could create your own CA, limited to your domain and install it on the respective devices.
TeMPOraL 7y ago
I never heard about Passive DNS before. Thanks. That said, shouldn't that be illegal? Where does this data come from anyway? I'm guessing spyware - on the phone, in browsers, and spyware browsers like Chrome.
- tialaramex 7y ago
  Unless the people answering DNS queries for you have explicitly contracted (with you, or with all users) not to do this you should assume they contribute to one or more passive DNS services because it's free revenue for them. I'd be very surprised if any of the suppliers use spyware, seems like it'd be far less effective and also more expensive to do.