12 ms·
Brute-forcing a macOS user’s real name from a browser using mDNS
- leoradovey1993 3y ago[dead]
- joiqj 3y agoAs part of my standard (and pretty lame) OPSEC I always change the default names that apple gives its devices (like "Joiqj's iPhone") to a more generic name (like "iPhone"). Nice to see that it was good practice.
- tentacleuno 3y agoIt might sound a bit silly, but I've had pretty good results just naming my devices after Pokemon. Whenever I have a new device, I open the Pokemon DB[0], choose one at random, and then add it to my .csv file of device names -> what they are and what role they perform. [0]: https://www.pokemon.com/uk/pokedex https://www.pokemon.com/uk/pokedex
- varenc 3y agoI do the same thing but with Star Trek words! I have a somewhat logical naming scheme too. Computers are named after Star Trek ships (Yorktown), phones are named after handheld devices (Phaser), and drives are storage related things (Isolinear). And my printers are just named Replicator and Synthesizer.
- electrondood 3y agoThis is fun.
- nneonneo 3y agoRather than choosing at random, I like to pick names that have some relation to the device in question, e.g. "Pichu" for a tiny mobile device, "Snorlax" for the big slow machine, "Articuno/Zapdos/Moltres" for three successive powerful servers, etc. What's extra fun about Pokemon, if you're familiar with the franchise, is that you can pick names based on generation, with older generations for e.g. older devices, and if you're _really_ familiar with the franchise you could even pick names based on types or other characteristics.
- acer589 3y agoVery similar here. PCs get Pokémon region names (MacBook is Johto), non-PC Ethernet connected devices get Professor names, all other devices are Pokémon.
- tentacleuno 3y agoOh, I do the same! For instance, zygarde is my 14TB NAS, which I consider pretty big. I'm not familiar with the franchise though :)
- dlivingston 3y agoI was so proud of my spec'd out M1 Max MacBook Pro that I named it "Arceus", the god of the Pokemon universe.
- electrondood 3y agoMy company uses codenames like this for our services and it drives me insane every time I have to go look up which is which or mentally convert to the name it should have been given. At work, let's just call things what they are.
- leohonexus 3y agoSounds like that would be a perfect simple application for a go/ link or a Raycast extension, just saying :p
- oktwtf 3y agoMy go-to is either gods from Norse mythology, or Transformers for servers. I set my iPhone to an emoji, and apparently it's one of the emojis that is composed of multiple emojis to render correctly. It's fun to see how every device it connects to draws the emoji or more likely boxes a little different.
- johannes1234321 3y agoIf youlook for a naming scheme: this wiki has you covered https://namingschemes.com/Main_Page https://namingschemes.com/Main_Page
- dunham 3y agoI've been using chili peppers (peri, shishito, ancho, ...) for my devices for the last few years. Many years before that, I was using named swords (notung, glamdring, sting, etc). Back in college my boss named a sun workstation lab with aleutian islands, and another after indonesian islands. (Some of those were fun to remember, there was an umnak and an unimak.) The servers were named after seas and oceans. We tried to name a new lab of windows machines after bugs, but the department nixed that.
- vogon_laureate 3y agoI've historically preferred to use Culture series ship names (eg. GCU Grey Area, GCU Jaundiced Outlook, etc.), but stopped after Elon started naming his SpaceX ships like that. I then went for Scottish Single Malt names (eg. Laphroaig, Jura, etc.). After quitting alcohol, I've now settled on Douglas Adams names (eg. Deep Thought, Grunthos the Flatulent, etc.). Naming machines is the most fun part of the job.
- jabbany 3y agoThis is not silly at all :-) Seems pretty in line with the RFC about this https://www.ietf.org/rfc/rfc1178.txt https://www.ietf.org/rfc/rfc1178.txt I do something similar but with other mobile/gacha game characters since those names are always in abundance. I also try to do some kind of correlation with the fictional settings too (groups of devices will correspond to meaningful in-domain names) For non-mobile devices like workstations or servers, I also tend to directly give FQDN, like (name).(location).(my-personal-domain.tld)
- deleted 3y ago[deleted]
- franga2000 3y agoI do the opposite: one of my laptops is named "Peter's iPhone" (hint: my name is not Peter, nor do I own an iPhone) and I've also set all my Bluetooth to random Bluetooth headset or mouse models.
- vorticalbox 3y agoMy hotspot on my phone is "FBI van 4"
- eindiran 3y agoI see this joke frequently when looking at available wifi; is this meme a reference to a particular thing (other than the FBI having surveillance vans) or did a bunch of people just converge onto it?
- skissane 3y agoSome years ago there was a lot of stuff on 4Chan about “FBI party van”, “vanned”, v&, etc. I’m guessing that’s part of where it has come from.
- vorticalbox 3y agoI saw it as a meme years a go. I sadly don't know the origin.
- noduerme 3y agoI've never seen it. Maybe it's spreading like a fungus from wifi to wifi in certain regions.
- karim79 3y agoOne of the hotspots in my flat is called "Honeypot1"
- kstrauser 3y agoMy blog is honeypot.net. It’s always fun to watch people trying to decide whether to click that link.
- wil421 3y agoI prefix all my device names with “My”. My iPhone, My AirPods, My MacBook Air, and so on.
- pndy 3y agoThat reminded me that almost 10 years ago ghacks [1] instructed people to add _nomap to their Wifi networks name to avoid these being harvested by Google and Mozilla. I wonder if that ever worked or still does and if companies stopped collecting that information. [1] - https://www.ghacks.net/2014/10/29/add-_nomap-to-your-routers-ssid-to-have-it-ignored-by-google-and-mozilla/ https://www.ghacks.net/2014/10/29/add-_nomap-to-your-routers...
- TheNewsIsHere 3y agoOfficially this is still supported. With that said, there have in past years been data sanitizing failures which get them mapped anyway. Google caught a little flack for that several years ago.
- nocsi 3y agoI do that too. So if we’re on the same network and conflict, it’ll become “iPhone (1)”, etc.
- hot_gril 3y agoThe hostname is derived from the admin user's name, which ought to also be fake. My "full name," unix username, and hostname are all a nice short "me".
- Aachen 3y agoI use a random person's name because anonymous could be me but e.g. Josephine most definitely isn't a bloke. A lesson learned with early feature phones and Bluetooth names in high school At home my wifis are currently Japanese emojis, but anything funny goes
- TechBro8615 3y agoIdeally you'd use the most common name, in order to maximize the size of your anonymity set. So you could go with "John Appleseed" to get a "john" home directory and a "John's MacBook Pro" hostname. But in a small community, to local observers seeing your device on bluetooth screens, you might get weird looks ("there is no John here, why is this sus?") whereas "iPhone" looks like a default. And for non-local observers, your choice of a name like "John" suggests you're a westerner named John. So by just going with "iPhone" or "MacBook" you're in a smaller anonymity set but also not drawing attention to yourself in your local area, and not externally leaking information like your locale (although of course you could always leave a false trail by using a cyrillic hostname). Some other leaky, seemingly private identifiers are SSH pubkeys (I always delete the comment trailer), which are sent to every server you SSH to and also published to places like GitHub, and WiFi SSIDs (which are visible to any application with access to the network stack, and unfortunately aren't entirely within your control - often a list of nearby SSIDs, combined with a mapping of SSID to geolocation, is enough to triangulate your location to within a meter, which is one of many reasons I disable WiFi in favor of ethernet whenever possible).
- oxygen_crisis 3y ago> seemingly private identifiers are SSH pubkeys (I always delete the comment trailer), which are sent to every server you SSH to and also published to places like GitHub I use this in my .ssh/config file: Host * IdentitiesOnly = yes ... then you'll only send keys that are specified per-host in .ssh/config with 'IdentityFile' or with a command-line argument. More discussion: https://news.ycombinator.com/item?id=10004678 https://news.ycombinator.com/item?id=10004678
- 3y ago
- TechBro8615 3y agoI do the same, mostly because I don't like my full name showing up in every subpath of the home directory. Sometimes this leaks far beyond your local computer, too, since many build tools include some path info in the compiled binaries. You can download apps from the app store, run `strings` on them, and find the username of the developer who built the binary.
- jamesfinlayson 3y agoAs of iOS 16, apps need special permission to get the device name now (I think it just returns "iOS" instead). Not sure about MacOS.
- darthwalsh 3y agoIs there a way to prevent websites from the broader Internet from making network requests to my local network? I can't imagine why this should be allowed by default. (Not to suggest bringing back IE's Local Intranet Zone permission...)
- capableweb 3y agoThey generally can't, because of CORS. The only reason this "hack" works is because the timing of the rejection is different between non-resolving domain request and resolving-but-rejected request. But if you run something on https://192.168.2.1 https://192.168.2.1 it can't be accessed from a web app running on https://my-own-domain.com https://my-own-domain.com unless the service running at 192.168.2.1 allows the "Origin" my-own-domain.com.
- doakes 3y agoTechnically they can make the request. The server will receive and respond to the request. CORS is applied by the browser which prevents the response from being read. This is why CORS doesn't prevent a request from mutating something on a server. A CSRF token does.
- aidos 3y agoIs that true? There’s a preflight request that checks with the server as to what’s allowed and then the browser issues the original request if it’s ok, right?
- jakear 3y ago"Simple requests" are not preflighted, such as those that do not set any headers (among other qualifications). https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl... (Aside, is MDN's href linking broken for everyone or just me?)
- 3y ago
- valventin 3y agoI'm now thinking how this is related to Wi-Fi sharing. I've always renamed my device to avoid leaking my name when I'm sharing Wi-Fi. Interesting stuff.
- userbinator 3y agoIn the example above, the difference is four milliseconds for a valid address versus five seconds for an invalid one. This is surprising --- I'd expect a DNS lookup failure to be much faster than a default connection timeout which comes after a successful DNS lookup. That said, I've always found the <name>s-mac-xxxx to be a bit of an odd choice, especially considering it's from a company that advertises privacy as a huge selling point; either they don't expect you to use your real name, or this is a case where "user friendliness" took precedence. From the privacy perspective, Windows' randomly generated hostnames would be better.
- rmccue 3y ago> This is surprising --- I'd expect a DNS lookup failure to be much faster than a default connection timeout which comes after a successful DNS lookup. Unlike regular DNS where you're asking a single server at a single IP for a yes/no answer, mDNS is multicast, so no single server can authoritatively say no†. You can only detect that there are no records when the lookup times out because no servers have responded. † Not technically true, a device can say no if it knows it owns that name.
- mlyle 3y ago> default connection timeout which comes after a successful DNS lookup. In addition to the sibling's comment, the other factor is that they received a "connection refused" -- RST, not a connection timeout.
- liminalsunset 3y agoThe reason users' real names are in the hostnames is possibly because of AirDrop. The system appears to use the hostname for things like Personal Hotspot and AirDrop, and other types of names would probably lead to widespread confusion when it came time to share a file.
- vogon_laureate 3y agoThis is interesting, well written up and even has a nice proof of concept. Nicely done! A fun countermeasure would be to change the device hostname to something like atemptingurl.local that entices the attacker to try visiting that website where a webpage is carefully crafted to run the exact same technique on them and return: "Hi [hacker's device name]! Your machine information, IP address, geolocation and other fingerprint information has been captured and reported to [insert scary cyber agency here]." Even if they are seasoned veterans rather than script kiddies, it could at least give them a smile. People need more reasons to smile. :-)
- pyrolistical 3y agoYou would need to be running a http server with CORS allow all. You would then also reduce your own security as you are now exposed to all the bugs in the chosen http server
- vogon_laureate 3y agoNo pain, no gain.
- powera 3y agoIf a web application is making dozens of requests to invalid domain names, shouldn't the web browser do something about it?
- mrbuttons454 3y agoFortunately for me, my device is often named something like "xxxs's MacBook Pro (34)". It's not a bug, it's a feature.
- hn8305823 3y agoSet username to 'user' and hostname to 'hostname' on laptops. The more people who do that the better.
- jstrieb 3y agoA similar type of timing attack can be used to port scan your local machine (and other devices on your local network) from your browser. https://github.com/Flu1dTeam/PortScanner https://github.com/Flu1dTeam/PortScanner A while ago, eBay got caught doing this. https://blog.nem.ec/2020/05/24/ebay-port-scanning/ https://blog.nem.ec/2020/05/24/ebay-port-scanning/
- bmacho 3y agoWTH that's super creepy, how comes I've never heard about it before?
- pyrolistical 3y agoCould browsers mask this by turning connection refused to a 5 second timeout in JavaScript but still show the actual error in the console (which JavaScript cannot read). This should only trigger when when JavaScript is making a request where CORS would kick in AND connection is refused
- watersb 3y agoOn my macOS box, I run Little Snitch, a nice UI that can be set to ask local user for explicit permission before allowing a network request. https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html I’ve occasionally stumbled on it during remote logins, usually when an SSH session wants to download something new, like NPM requesting NodeJS bits. The text terminal SSH download will block; if I figure out it’s the Little Snitch then I have to walk all the way to my desk downstairs, wiggle the mouse to wake up the monitor and unlock the screen saver, and click “Allow” on the Little Snitch dialog box. Works as intended. BUT by default it’s common to set such things to silently allow local network requests, so I don’t know if such shenanigans in the OP would work in my case.
- cyrnel 3y agoIn my case, I couldn't imagine configuring LittleSnitch to only allow certain hostnames from my browser. It has a "allow all traffic to 53/80/443" rule, otherwise most websites would flood me with hundreds of new LittleSnitch popups.
- inferiorhuman 3y agoYou'd think so, but the way I've set it up Little Snitch throws up a dialog box when a browser makes errant requests but otherwise remains silent. Most recently this caught Firefox trying to force DNS over HTTPS despite me having disabled it when it first became generally available. I suppose leaking DNS requests to Cloudflare isn't the worst thing in the world, but it would circumvent the ad blocking I've set up locally.
- krackers 3y agoHow _do_ you have it set up? What does errant request mean in this case? A request to a domain that you haven't allowed before?
- inferiorhuman 3y agoAh so I just dug into the rules. What happened was a plugin made a DNS request to mozilla.cloudflare-dns.com. I've nothing special set up for Firefox, but basically no rules for plugin-container, so when a plugin tries to make a DNS request Little Snitch pops up an alert. Not great I suppose, but better than nothing. Generally what I'll see for Firefox itself are requests for non 80/443 ports.
- Syonyk 3y agoThe more time passes, the more comfortable I feel about mostly interacting with the internet from a Qubes box, in a disposable Whonix/Tor VM, with Javascript disabled... This is just gross. I mean, not surprising. But appalling in so many ways that it's even possible. If you're not familiar with fingerprint.com, they do "deep user profiling" - think "maintaining a constant user ID across computers, browsers, OSes, etc." They have a demo on the main page that's a little bit creepy in how good it is.
- nop_slide 3y agoWow it totally recognizes my same device across different VPN IPs. Creepy indeed
- nier 3y agoIn my tests it only recognizes the same browser. I’m a different person when using different browsers. I noticed that I can still be correctly fingerprinted after resetting the browser or using a private window.
- Ycdr4thfdd 3y agoUsing Firefox (on a Linux laptop) with resistfingerpriting=true or Mull (on an Android) with its default settings, I'm able to get assigned a new fingerprint whenever I clear cookies or use a new Incognito session. I haven't tested it, but presumably they also wouldn't be able to track me between domains, even without clearing cookies.
- Affric 3y agoSo it gets me on MacOS with safari, lynx, and firefox with strict anti-tracking on. Tor works for blocking it. All in all they have created a creepy wee tool.
- jonnycomputer 3y ago
- deleted 3y ago[deleted]
- collsni 3y agoIf only disabling JavaScript didn't disable end user experience lol
- cwales95 3y agoThis is the only thing stopping me from globally disabling JavaScript. I predict in the future through, I’ll have no choice but to have it off by default due to privacy concerns
- deleted 3y ago[deleted]
- fsflover 3y agoI already do this on my phone. Makes it faster, too.
- KingLancelot 3y ago[dead]
- Alifatisk 3y agoIsn’t there a way to heavily limit what the js engine can do?
- ezeki08 3y ago[flagged]
- est 3y agoofftopic, does the browser offer some kind of Network Service Discovery? If so we can establish WebRTC sessions without any signaling servers, like opening two different browsers on different devices in a LAN, they discover each other without any outbounding connections.
- Sean-Der 3y agoYes that is (almost) possible! https://github.com/pion/offline-browser-communication https://github.com/pion/offline-browser-communication If the W3C accepted this as a valid use case it could be available quickly.
- ShadowBanThis01 3y agoGood thing I always change the name of my devices. Apple's default naming is a privacy error. One time I was on a first date with someone in law enforcement. Being a woman alone and obviously interested in protecting herself, she'd done a background check on me and had informed several fellow community members of our whereabouts. I, on the other hand, didn't know her last name. We joked about that. When we got in her car after dinner, the intrigue was up when her dashboard display showed that it auto-paired with her iPhone... which was named with her first and last name. I didn't point this out, and challenged her to figure out how I knew her name by the time the drive was over.
- zoomablemind 3y ago>...dashboard display showed that it auto-paired with her iPhone... which was named with her first and last name. So many times a rental car comes with a dozen of profiles from previously paired phones along with their phone books, saved map locations, history. Not much use, of course, still, it leaks out without much thought to it. Guess what, the hardest thing is to remind myself to clear my profile before returning the car...
- jms703 3y agoWhy should anyone care about this?
- neop1x 3y agoBecause attackers can now know your super-private first name and you are losing your privacy. But no one cares about the requirement to have an apple account with bank info to use the device normally or about the requirement to have iMessage setup in order to receive SMS on iPad, about cameras with face recognition on the streets and the list can go on and on.
- menzoic 3y agoI don't get why they resorted to the timing approach when they could just check the error message.
- leokennis 3y agoI’m not well versed in DNS nor in JavaScript, but this article was so well written even I could understand.
- planb 3y agoThis is a well-written, interesting article. I especially like the non-alarmist tone to it ("Considering the inherent weaknesses and numerous limitations, this attack isn't practical.")
- danielbln 3y agoIn another universe, this would be "FINGERBleed", along with a snazzy website and logo.
- nicce 3y agoReminds me of https://www.hertzbleed.com/ https://www.hertzbleed.com/ There still hasn’t been any known reported case where this would be possible or used. Very impractical.
- pjerem 3y agoI’m not sure. This allows to test wether hostnames exists on your network. It’s maybe not an issue for a unique hostname but what about fixed hostnames or default hostnames that are common in the IoT world. This allows a website to secretly guess if you own a given device. It’s even worse used in a targeted attack : if you know some devices of the network, you can guess that the connected user is on the targeted network.
- TazeTSchnitzel 3y agoWindows will also be using mDNS in future.
- lopkeny12ko 3y ago> Both errors will be mapped into the same Failed to fetch JavaScript error, so we can’t rely on the error type, but we can perform a timing attack. Local networks are fast, so the valid mDNS hostname registered in the network will be resolved in a reasonable time frame, which is significantly faster than the default connection timeout. In the example above, the difference is four milliseconds for a valid address versus five seconds for an invalid one. This isn't really a "timing attack." A timing attack implies exploitation of an unintended behavior by executing something at some specific time. This just sounds like a workaround for the fact that the Javascript API doesn't expose a way to detect a hostname resolution error, which really should exist.
- cormacrelf 3y agoNo, this is a timing attack. https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack. See also https://en.wikipedia.org/wiki/Side-channel_attack https://en.wikipedia.org/wiki/Side-channel_attack for more general usage of "timing attack" beyond cryptography.
- cmsj 3y agoChange your hostnames people, then you won't be "XXX's MacBook Pro.local"