4 ms·

I have investigated similar situation on Heroku. Heroku assigns a random subdomain suffix for each new app, so URLs of apps are hard to guess and look like this

I have investigated similar situation on Heroku. Heroku assigns a random subdomain suffix for each new app, so URLs of apps are hard to guess and look like this: test-app-28a8490db018.herokuapp.com. I have noticed that as soon as a new Heroku app is created, without making any requests to the app that could leak the URL via a DNS lookup, the app is hit by requests from automatic vulnerability scanning tools. Heroku confirmed that this is due the new app URL being published in certificate authority logs, which are actively monitored by vulnerability scanners.

nightpool 8mo ago
Really? Is that new? My apps use wildcard domains: https://i.postimg.cc/SQ82S0Dp/image.png https://i.postimg.cc/SQ82S0Dp/image.png
- mixedbit 8mo ago
  This applies only to Heroku Fir and Cedar apps (apps that run in Heroku Private Spaces). Heroku Common Runtime apps still use shared wildcard certificate and their domains are not discoverable like this.
adolph 8mo ago
> certificate authority logs, which are actively monitored by vulnerability scanners That sounds like a large kick-me sign taped to every new service. Reading how certificate transparency (CT) works leads me to think that there was a missed opportunity to publish hashes to the logs instead of the actual certificate data. That way a browser performing a certificate check can verify in CT, but a spammer can't monitor CT for new domains. https://certificate.transparency.dev/howctworks/ https://certificate.transparency.dev/howctworks/
- wlonkly 8mo ago
  I think it was more of an intentional tradeoff, as one of the many goals of CT logs was to allow domain owners to discover certificates issued for their domains, or more generally for any interested party to audit the activity of a certificate authority. What you're describing there is certificate... translucency, I guess?
  - adolph 8mo ago
    Yes, "translucent database" was exactly the concept I thought of when asking the question. The concept is keep access to specific items easy but accessing the entire thing as a whole more costly.

nightpool 8mo ago

Really? Is that new? My apps use wildcard domains: https://i.postimg.cc/SQ82S0Dp/image.png https://i.postimg.cc/SQ82S0Dp/image.png

mixedbit 8mo ago
This applies only to Heroku Fir and Cedar apps (apps that run in Heroku Private Spaces). Heroku Common Runtime apps still use shared wildcard certificate and their domains are not discoverable like this.

adolph 8mo ago

> certificate authority logs, which are actively monitored by vulnerability scanners That sounds like a large kick-me sign taped to every new service. Reading how certificate transparency (CT) works leads me to think that there was a missed opportunity to publish hashes to the logs instead of the actual certificate data. That way a browser performing a certificate check can verify in CT, but a spammer can't monitor CT for new domains. https://certificate.transparency.dev/howctworks/ https://certificate.transparency.dev/howctworks/

wlonkly 8mo ago
I think it was more of an intentional tradeoff, as one of the many goals of CT logs was to allow domain owners to discover certificates issued for their domains, or more generally for any interested party to audit the activity of a certificate authority. What you're describing there is certificate... translucency, I guess?
- adolph 8mo ago
  Yes, "translucent database" was exactly the concept I thought of when asking the question. The concept is keep access to specific items easy but accessing the entire thing as a whole more costly.