4 ms·
> you kicked the can down the road at best How so?
by kayson 4y ago
> you kicked the can down the road at best
How so?
- imtringued 4y agoReverse DNS lookup.
- kayson 4y agoYou mean by PTR records? I'm pretty sure most people don't have those set up..
- ggm 4y agoWhich is security by obscurity?
- tialaramex 4y agoYou can actually buy "Passive DNS" records. Big DNS providers collect all the answers they learned while serving, deliberately without recording who asked and the answers are aggregated and available for purchase. So if Sarah in accounts once went to secret-webserver.internal.example.com from her laptop at home before turning on the VPN by mistake, her upstream DNS provider will tell any attackers with some $$$ that secret-webserver.internal.example.com existed, when it existed, what the A or AAAA records said and so on. Targeted attacks will know about secret-webserver.internal.example.com even though only *.internal.example.com is listed in the CT logs.
- naasking 4y agoBecause if a name is not crytopgraphically unguessable, then it's guessable and subject to dictionary, brute force, and other forms of attack.
- kayson 4y agoIf someone is doing that, you're in the realm of targeted attacks instead of scans, which is outside the scope of my original comment. It's similar to someone monitoring your traffic; as I already said, if that's the case you need more anyways.
- naasking 4y agoSecurity is not choose your own buffet where you get to only think about scans but ignore other common attack vectors. Botnets are common enough that targeted attacks like I described are just as common as scans, so you always need more anyway. Configuring your host to return 404 on invalid subdomains is just not a general solution, at best it just buys you some time until attackers find the subdomain, ie. kicking the can down the road, like I originally said.
- kayson 4y agoSo you're saying botnets will dictionary attack subdomains on every IP? Any sources?
- naasking 4y agoNo, I'm saying that's one of many behaviours. They mine domains and URLs scraped from email addresses, email headers and bodies, online content, and more. Your site is not "secure" when that security can be circumvented by someone pasting a URL into an email.