4 ms·

I always wonder how these hackers know which IP range to attack. Is it just like a hit and miss kinda thing? Or do they have insiders who leak those info to the

by vinhboy 11y ago

I always wonder how these hackers know which IP range to attack. Is it just like a hit and miss kinda thing? Or do they have insiders who leak those info to them.

a3n 11y ago
Chicken and egg, but that Romanian guy that broke into Clinton's email (and thereby had a hand in exposing that she was using her own server) probably saw email to and from the White House. Metadata, after all, is the gift that keeps on giving. An innocent IP leads to an interesting IP leads to blackmail, extortion, spying and all kinds of other fun.
iancarroll 11y ago
% dig mx whitehouse.gov ; <<>> DiG 9.8.3-P1 <<>> mx whitehouse.gov ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26690 ;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;whitehouse.gov. IN MX ;; ANSWER SECTION: whitehouse.gov. 9982 IN MX 110 mail6.eop.gov. whitehouse.gov. 9982 IN MX 105 mail2.eop.gov. whitehouse.gov. 9982 IN MX 110 mail5.eop.gov. whitehouse.gov. 9982 IN MX 105 mail1.eop.gov. whitehouse.gov. 9982 IN MX 105 mail4.eop.gov. whitehouse.gov. 9982 IN MX 105 mail3.eop.gov.
out180 11y ago
Actually, it's not that difficult. The v4 blocks assigned to DoD are quite well known, but that's a pretty large swath by itself (/8's), so one would want to tighten the target a little. That's not a hard task at all. If you wanted to figure it out starting with something like whitehouse.gov is a bad place to begin. That's a public facing media engine at best, not really used for "government" per se. In fact, it's likely not even homed on a DoD or GOV network. Many of the media engine type sites in the government are outsourced to third party hosting. You'd want to find something more specific, like perhaps a protected access web system, like a Sharepoint portal or website, or even a mail relay conveniently pointed out by an MX record. Trace that system back and you likely will find either its reverse proxy, a front end system, or an SMTP entry point. This gives you the parameter subnet (DMZ) that you can probe from there. Then, using available DNS records, you could start mapping out the parameter looking for proxies, mail relays, and web servers. If you had access to web traffic logs you could use them as well to look for egress points from networks. If you had e-mail traffic to look at you'd likely see leaked internal subnets as well in the headers. However, this would only work for services they have blessed for access to the public internet. It is absolutely no different than how you'd map any other network.

by vinhboy 11y ago

I always wonder how these hackers know which IP range to attack. Is it just like a hit and miss kinda thing? Or do they have insiders who leak those info to them.

a3n 11y ago

Chicken and egg, but that Romanian guy that broke into Clinton's email (and thereby had a hand in exposing that she was using her own server) probably saw email to and from the White House. Metadata, after all, is the gift that keeps on giving. An innocent IP leads to an interesting IP leads to blackmail, extortion, spying and all kinds of other fun.

iancarroll 11y ago

% dig mx whitehouse.gov ; <<>> DiG 9.8.3-P1 <<>> mx whitehouse.gov ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26690 ;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;whitehouse.gov. IN MX ;; ANSWER SECTION: whitehouse.gov. 9982 IN MX 110 mail6.eop.gov. whitehouse.gov. 9982 IN MX 105 mail2.eop.gov. whitehouse.gov. 9982 IN MX 110 mail5.eop.gov. whitehouse.gov. 9982 IN MX 105 mail1.eop.gov. whitehouse.gov. 9982 IN MX 105 mail4.eop.gov. whitehouse.gov. 9982 IN MX 105 mail3.eop.gov.

out180 11y ago

Actually, it's not that difficult. The v4 blocks assigned to DoD are quite well known, but that's a pretty large swath by itself (/8's), so one would want to tighten the target a little. That's not a hard task at all. If you wanted to figure it out starting with something like whitehouse.gov is a bad place to begin. That's a public facing media engine at best, not really used for "government" per se. In fact, it's likely not even homed on a DoD or GOV network. Many of the media engine type sites in the government are outsourced to third party hosting. You'd want to find something more specific, like perhaps a protected access web system, like a Sharepoint portal or website, or even a mail relay conveniently pointed out by an MX record. Trace that system back and you likely will find either its reverse proxy, a front end system, or an SMTP entry point. This gives you the parameter subnet (DMZ) that you can probe from there. Then, using available DNS records, you could start mapping out the parameter looking for proxies, mail relays, and web servers. If you had access to web traffic logs you could use them as well to look for egress points from networks. If you had e-mail traffic to look at you'd likely see leaked internal subnets as well in the headers. However, this would only work for services they have blessed for access to the public internet. It is absolutely no different than how you'd map any other network.