Hacker News Reader

Comment by nikcub | Hacker News Reader

> you can't protect the rest of your infrastructure (mailservers, chat servers, gameservers, and so on)

That leads to my technique in discovering origin servers when pen testing CloudFlare customers: brute force all the DNS names and record types, map out all the blocks, scan them for open ports, ID the web server ports, attempt to find the vhosts on those ports in requests with the hosts header

You'll almost always find the origin web server (sans protection) and also dev/staging instances of apps.

View on HN

There is an easier way, send a DMCA request, Cloudflare been bleeding ips of their customers in that manner for years

Assuming you don't mind committing perjury, I guess.

Yes because hackers who go around DDOSing entities care about perjury

To be fair they were talking about pentesters, for whom port scanning is usually on the table, and breaking the law is not.

Under Computer Fraud and Abuse Act (18 U.S.C. 1030) it is a federal crime to "intentionally access a computer without authorization or exceed authorized access" ...

An eager prosecutor could take that and run a mile

Is there actually a recorded instance of someone getting charged for perjury relating to a DMCA request?

I don't know what happened with this case: https://torrentfreak.com/warner-bros-our-false-dmca-takedown...

The law is pretty clearly broken. I kind of hope Google is collecting all the false take down requests they get.

Submitting a false report, under penalty of perjury, and saying "whoops algorithms lol" shouldn't be something they get away with.

There's this too: https://www.eff.org/press/archives/2004/10/15

Only one part of a DMCA takedown is under penalty of perjury, and it's quite possible to file a knowingly false takedown request without that part being falsified.

But isn't it the part where you assert in good faith you own the copyright? How do you get around that scenario of a malicious takedown request against a random site?

It's the part where you asset that you are the owner of the copyright you alleged is being violated. As long as you own copyright on something that's not a problem. The part where you actually allege that particular content uses your work without permission or privilege is not under penalty of perjury.

Yep, except for the small site that only ever set up A/MX and are using hosted email.

Sometimes in those cases DNS history is enough.

Thanks - forgot to mention dns history, and a domaintools subscription is worth it

Or just http://ViewDNS.info/ for a free alternative :)

Heh, 99$/month, not worth it for me as a lowly scrub.

Cool to see what you're doing though, wish I had a sub myself.

This only works if there are any DNS names that aren't proxied... we don't have any exposed so there would be nothing for you to find.

Of course, but that's his point.

Most of the time people don't go through the effort of putting their mailservers/nameservers/etc. behind a proxy.

I'm pretty comfortable guessing that 95% of CPanel/Plesk users that use cloudflare(or another CDN) _and_ host their own mail/name-servers don't put the latter behind a proxy; and they often are on the same box as the webserver.

Edit: Which is to say that this doesn't effect someone doing it 'right', but almost everyone is sloppy(most people just don't care as they're not actively being DDOS'd).

In reality even using this to find the webserver they will eventually get wise to how you're finding the IP(likely) and swap to a new one(depending on their hosting situation) this time putting all other DNS resources 'behind proxies'.

> Most of the time people don't go through the effort

If people don't put in the effort for the security they need, then they won't have that security. This applies to any concept and I dont see how this has anything to do with a single vendor who just provides the tools and service.

Because the whole selling point of CloudFlare is that the customer supposedly doesn't need to invest effort into security, because CloudFlare will handle it all for them.

Which is obviously not the case, but that's what the marketing says.

They do handle a lot, doesn't mean you're not responsible for the settings you choose. Lack of understanding or effort on your part doesn't mean you get to just blame the vendor.

This is almost literally how they are marketing their product: https://www.cloudflare.com/overview/

Either you invest effort into security anyway and you don't need CloudFlare, or you don't invest effort into security and CloudFlare won't save you either. In neither case is CloudFlare the solution.

Or the logical way to think about this is that CloudFlare is another vendor that you can use (amongst many) to create the security you need with the trade-offs that are acceptable.

Marketing does not absolve you from proper configuration... clearly you have it out for this company for some reason.

Yes, I personally wasn't trying to convey anti-CloudFlare sentiment, I even said "and other CDN providers"

I don't think this is a 'CloudFlare vuln' or the responsibility of CloudFlare to resolve etc...

I maintain that it is sloppy work that leaks the underlying webserver IP, but also that few people care about doing so.

Reply on news.ycombinator.com