Captcha.nsa.gov | Hacker News Reader

Captcha.nsa.gov

captcha.nsa.gov

435 pointsscblzn144 comments

Oh wow, they just disabled it while I was reading some comments. It's no longer working, I'm now getting redirected to nsa.gov

Edit: This seems to have been online since 2018, see https://web.archive.org/web/20181206224407/http://captcha.ns....

As someone very confused as to what people are commenting about, thank you. I'm clearly just seeing the post-patch version

Before they fixed it, it redirected to Googles homepage in Portuguese.

It wasn't a redirect. They served a Google homepage, but it was still an nsa.gov url

Here: https://web.archive.org/web/20200203154312/https://captcha.n...

I still see a Google homepage

That's what it was. The NSA was reverse proxying Google.

The legit explanation (given the domain name) is probably they wanted to use reCAPTCHA, but block all non-NSA hosts with a firewall or something.

This is not great, because the NSA expanded its attack surface to all of google.com.

The more conspiracy explanation is that this is actually a phishing page set up, and due to a misconfiguration it's exposed under captcha.nsa.gov, but Occam's Razor should apply here.

I think you meant “Hanlon's razor”[1].

[1]: https://en.m.wikipedia.org/wiki/Hanlon%27s_razor

As far as I can tell, it's what you'd see hitting https://www.google.com.br/ from Brasil, but in English.

Hahaha, I don't think they were expecting all that traffic from this being posted on HN

I'm guessing that the NSA website uses recaptcha, which is served by Google. Perhaps in order to comply with strict origin policy, they want everything on nsa.gov to be served from their domain. They seem to have a reverse proxy that proxies requests to google.com.

That's one plausible explanation, but in any case, even if my explanation is wrong, I doubt the explanation is interesting.

If that's the case, they are being sloppy, considering that everything under www.google.com is proxied through their servers, not just specific reCAPTCHA assets.

Gmail by NSA: https://captcha.nsa.gov/intl/us/gmail/about/

They're inheriting a considerable part of Google's attack surface. For example, Google's open redirects could be used to bypass origin checks as part of an attack on nsa.gov, or to phish NSA employees.

My favorite so far: https://captcha.nsa.gov/logos/2019/loteria/rc2/loteria19.htm...

For me (in Sweden) that URL seems to just redirect to https://www.nsa.gov/?hl=en ...

They appear to have change something in the past few minutes. When I first opened this HN thread it showed me Google's homepage. Now I'm also seeing that redirect.

NSA has just shut down the proxy. The link was a Google Doodles game.

You can just replace captcha.nsa.gov with www.google.com to see what it used to serve up: https://www.google.com/logos/2019/loteria/rc2/loteria19.html...

Somebody possibly got a written up for this.

NBD... Just a quick test in PROD.... ಠ_ಠ

"No no, we just put it out to 'the public', that's BETA, not PROD..." -- some startup guy at the NSA...

You were right: https://twitter.com/NSAGov/status/1224456957622472706

Can someone explain what's going on? Is this a domain hack to get Google's captcha working under an nsa.gov hostname, presumably so that it's usable on whitelist firewalls? I'm surprised Google serves a homepage to the domain, and that it doesn't only respond to requests to google.com (etc.)

Seems to be on purpose, unless someone really misconfigured their Akamai setup. Your purpose sounds viable

Is this more than a reverse proxy to google.com? Seems like the real question is _why_.

>I'm surprised Google serves a homepage to the domain

Google doesn’t, the reverse proxy just rewrites the Host header.

My guess: a custom version of Google that allows NSA analysts to do "Google dorking" - searching for vulnerable hosts with Google - without triggering a captcha. Somebody on twitter mentioned they could not get a captcha with strings that usually reliably cause one.

Maybe this is just a fake front page that calls to the Google search API and pretends to be Google proper. Either it is for agents in the field to inconspicuously use google or they misconfigured it to be public?

Your guess is wrong. This isn't a custom version of google. It's just a regular akamai reverse proxy setup.

> Either it is for agents in the field to inconspicuously use google

By visiting a nsa.gov subdomain served by akamai? Yeah right. I feel like heading to www.google.com would be far less conspicuous.

You can do that? I would expect Google to flag connections to the search page that don't terminate on a residential/commercial IP as suspicious and show you the near "unsolvable" captcha.

At least that is my experience with proxying google services (e.g. silly setup for accessing them from China). Datacenter IPs or SSL "MitM" connections reliably trigger it.

Depends very much on which datacenter you're using. I'd imagine google doesn't get much (any) bot traffic from Akamai, so I'm not surprised that their ranges aren't flagged yet.

But all it takes is a few dozen queries in fast succession and google will start showing a captcha. At least, that is how it seemed to be a few years ago.

I wonder how many people are currently submitting queries via that page...

Akamai rotates their source IPs a lot so you wouldn’t get a captcha very fast.

I'd love to know what the distribution of tries on the "unsolvable" captcha is when served to real people operating in good faith.

Anecdotal, and I'm guessing it's because I was logged in (to my long standing personal Google account) - but I didn't have any issues when I was VPN'd through a Vultr vps of mine when I was in my dorm.

Again I'm guessing it's because I was logged in, from google chrome.

If the NSA rids the web of google captchas, it will have fully deserved its budget and all past mistakes will be forgiven!

Until then, you can use my browser extension to solve them: https://github.com/dessant/buster

Huge fan of your work. Use it daily with no problems. Just wanted to say, from the bottom of my heart, thanks.

You're sweet, thanks a lot!

Thank you so much for creating this.

https://mastodon.cloud/@dredmorbius/102054627041751386

This is working far faster now than when first posted.

I've seen this on Twitter all day. My guess is that they wanted recaptcha, but serving the resources themselves. The easiest route was probably to reverse proxy google.com, which is what recaptcha is hosted on:

https://developers.google.com/recaptcha/docs/v3#frontend_int...

Could this backfire in any way and create some sort of exploit on nsa.gov? What if someone happened to somehow have access to google.com?

How has no one used this for ads yet? You could make any third party site appear as a first party site. As blockers usually aren’t set up to block first party ads.

This is a thing: https://apomaya.com/

First-party ads are a thing.

Kind of related post: https://news.ycombinator.com/item?id=21582698

Looks to be cname forwarding.

> $ dig captcha.nsa.gov

> ;; ANSWER SECTION:

> captcha.nsa.gov. 13246 IN CNAME www.nsa.gov.edgekey.net.

> www.nsa.gov.edgekey.net. 21528 IN CNAME e6655.dscna.akamaiedge.net.

> e6655.dscna.akamaiedge.net. 19 IN A 23.213.xxx.xxx

The IP addreses at the last one all seem to be Akamai IPs. So So that is fronting Google here it seems?

Can anyone just do that to any domain? My website is hosted at GitHub Pages and requires a CNAME file in the repo root as well as the DNS entry at Cloudflare.

Yes, they are not using a CNAME (whereby the original server serves the page, just on a different domain), they appear to be using a reverse proxy.

You can find more info about how that works here: https://en.wikipedia.org/wiki/Reverse_proxy

That makes a lot more sense.

That's copyright and trademark infringement.

That is not a technical limitation but a legal one.

Yes. The NSA is is breaking the law here.

You have no way of knowing that. They could have an agreement with Google to allow this.

Agreed. The copyright holder / trademark owner must be the party that wants to limit distribution, not the government or some unrelated third party.

i.e. if I see you producing fake Coca Cola drinks, I can't sue you for infringing on The Coca Cola Company's trademark. They would have to sue you. Same applies for the government.

And of course, if NSA does have an agreement with Google to reverse proxy https://google.com/, them doing exactly that would be perfectly legal. I presume they have SOME sort of agreement, and aren't just doing this behind Google's back, as the website is on HN's first page in the first 5 places for an hour already, and Google hasn't banned access.

Try getting even 50 Google queries with a reverse proxy, and you will see what I mean -- they will show you a progressively more difficult ReCAPTCHA until a certain treshold, after which the CAPTCHA is unsolvable and is there only to waste your time. This hasn't happened to HN readers [yet].

Meanwhile I presume they misconfigured a service meant for doing captcha checks using Google. What's more likely? Why are you so aggressively.. eh.. okay, not going to write that.

They most certainly have an agreement with Google here.

Why?

you can do it to any domain that isn't checking the hostname header. Most sites check that the hostname header matches the sites actual domain (like is specified in the CNAME file on github pages)

that's definitely not what's happening here though, most obviously because it has an SSL certificate. If it were just being CNAMEd over to google, the SSL would be invalid. NSA has to be catching the request to terminate the SSL, and then proxying it back to google.

Pretty sure Akamai does not front Google, they are more than large (and competent) enough to do that themselves.

From this twitter thread: https://twitter.com/mikko/status/1224349151384821762

You can't search traceroute. Weird.

Not weird, just WAF.

You also can't search alert(1), so probably just a silly WAF.

Or for `<script>`

People on that thread also noticed more keywords and think it might be Akamai WAF. I don't know enough about it be sure.

You can't have some strings in the URL for the main NSA.gov domain as well. So https://nsa.gov/fakething?hey=traceroute will give you the same error.

Yeah it's clear that a system is just blindly grepping the request url for certain keywords and killing the query.

So you can't search for `traceroute` or `tracert` directly but you can search for misspelling like `tracerout` and the results page just ends up showing the search results for `traceroute` so it's not exactly a very sophisticated filter.

Well the purpose of the filter is almost certainly to prevent running the command on the server in case of an attack, not to prevent it from being searched on Google. You'd have to spell it correctly to get the server to execute it.

Interesting alt names on the SSL certificate:

DNS Name=www.nsa.gov

DNS Name=nsa.gov

DNS Name=apps-test.nsa.gov

DNS Name=stage.nsa.gov

DNS Name=apps.nsa.gov

DNS Name=www2.nsa.gov

DNS Name=captcha.nsa.gov

DNS Name=m.nsa.gov

Even NSA has mobile pages these days!?

It looks like it's actually required by law.

https://www.congress.gov/bill/115th-congress/house-bill/2331

>If, on or after the date that is 180 days after the date of the enactment of this section, an agency creates a website that is intended for use by the public or conducts a redesign of an existing legacy website that is intended for use by the public, the agency shall ensure to the greatest extent practicable that the website is mobile friendly.

One of those leads to this: https://apps.nsa.gov/eqip-applicant/showLogin.login

Eqip is the government system for doing background checks. Just had to fill one out for NIH a few weeks ago.

My first instinct is that this is some kind of puzzle. It'd be pretty disappointing if this was just a misconfiguration or oversight.

That's actually a really viable theory, especially given the "can't search for traceroute" thing - that spits out what seems to be a time-based error string.

It’s not, that’s just standard akamai WAF behaviour.

E: sorry, HN is throttling me and I can’t reply below. This is just a silly web application firewall that blocks a list of “suspicious strings”. There’s not much else to be said about it.

Can you explain in more detail? captcha.nsa.goving for more information didn't return anything.

(I've turned off the throttling since your recent comments look to have been fine. Please don't do flamebait/flamewar in the future!)

I'm curious if this is a (temporary, unsecure) way to use google if you're in a place that google is currently blocked.

Small chance, but in case anyone on HN is in a place google is blocked, would be an interesting test to run.

If you're in a country which bans Google, I'd suspect a high chance having nsa.gov wouldn't be too favourable on your DNS lookup records!

Genuinely curious: are there places that block google but don't block the NSA?

NSA's official statement on twitter:

https://twitter.com/NSAGov/status/1224456957622472706 (1/2)

https://twitter.com/NSAGov/status/1224456959618945024 (2/2)

Looks like the good folks over at the NSA are reading Hacker News. And fix issues quickly. I’m proud of them.

or monitoring their traffic

They probably have alerts set up for anyone on the internet talking about NSA lol

So someone with control of a .google.com address can get a certificate for the equivalent .nsa.gov subdomain ?

You can see what IP it uses to send requests to google using https://captcha.nsa.gov/search?q=what+is+my+ip

The link didn't work for me (i.e. just got regular results) until I added &hl=en to get the English version: https://captcha.nsa.gov/search?q=what+is+my+ip&hl=en

Another write up at the NSA.

NSA thanks you for you participation in this experiment. Please terminate all knowledge with the purple pill at this time.

Assume the party escort submission position or you will miss the party.

it's all a ploy to finger HN users. imagine how many uniques they'll harvest!

Yeah, no way I'm clicking that link. I'll let others do that and read the reports here.

Can anyone from mainland china try this?

I am curious to see if it is blocked.

According to this website [0] it appears to do so which is interesting.

https://www.comparitech.com/privacy-security-tools/blockedin...

GreatFire says it’s unblocked. https://en.greatfire.org/captcha.nsa.gov

https://captcha.nsa.gov/intl/en/about.html

There is some truth to this.

What did this say?

https://google.com/intl/en/about.html

I feel like the valid SSL cert is my biggest issue here.

Why wouldn't it be valid? Its for O=National Security Agency and it has alternate names matching this URL authority.

SSL just verifies that the NSA owns nsa.gov

Why is everyone talking about a captcha? All I get is a google search page (no recaptchas).

Because google recaptcha is served from that domain (www.google.com).

Examine the URL, especially the subdomain

It's just a CNAME to an akamai IP:

    $ host captcha.nsa.gov
    captcha.nsa.gov is an alias for www.nsa.gov.edgekey.net.
    www.nsa.gov.edgekey.net is an alias for e6655.dscna.akamaiedge.net.
    e6655.dscna.akamaiedge.net has address 104.75.125.118
    e6655.dscna.akamaiedge.net has IPv6 address 2600:1406:5800:7b5::19ff
    e6655.dscna.akamaiedge.net has IPv6 address 2600:1406:5800:792::19ff

edgekey.net is an akamai thingy, all of nsa.gov seems to go through it

    $ host www.nsa.gov
    www.nsa.gov is an alias for nsa.gov.edgekey.net.
    nsa.gov.edgekey.net is an alias for e16248.dscb.akamaiedge.net.

I don't get it - I'm seeing a Brazilian version of Google?

I assume that the archive.org mirror is showing what was visible? https://web.archive.org/web/20200203154312/http://captcha.ns...

I see a google search page (google.com equivalent). Which fits with the reverse proxy that does ~any google url.

NSA's cert, too. All your are TLS belong to us.

A potential vector would be to potentially load images/content through google image/AMP and make it appear as legitimate NSA content

The creapiest thing to me is that this post is 7 hours old, and the comment states it's disabled. It was fixed within 2 hours. Ergo, the NSA is actively monitoring HackerNews and taking quick actions when needed.

I wonder what other sites the nsa has active alerting on?

Or maybe the domain admins have active alerts on their own domains. Which would be good practice.

Doh, I was hoping for a captcha made by the NSA, for catching bots, and terrorists and such.

Why Brazil?

Because Googles geoip DB thinks Akamai IPs like "23.59.250.119 " are in Brazil.

Ah that makes perfect sense, Brazil confused me for a minute there.

Nothing especially interesting happening here, someone just pointed captcha.nsa.gov at google.com in their akamai config.

Perhaps they’re just using google.com like example.com, or they’re trying to serve recaptcha under nsa.gov.

That doesn’t explain the fact that you can’t search for traceroute.

It does though, Akamai WAF.

Okay. That seems pretty logical.

They could be doing something else on their internal network and this is just fallback for when their apps are outside the network.

No ads. Nice! :D

It seems like we broke it -- it now refuses to do any searches for me (due to suspicious activity from 'my' ip)

And it's gone (redirects to nsa.gov)...

It's likely this is set up to collect data by impersonating Google Search in an iframe etc.

Consider reporting this to Safe Browsing complaint form as phishing attempt: https://www.google.com/safebrowsing/report_phish/

You think the NSA is phishing from a nsa domain?

Why assume that was served on the link, and how it was served, is working as intended?

It could have been part of a phishing setup that got accidentally pushed out with obfuscation components still missing.

It's not like everybody working at NSA is a flawless human being, mistakes happen everywhere, sometimes even rather big ones.

Also kinda weird how everybody seems to be giving the NSA the benefit of the doubt of this having some kind of supposedly totally benign purpose, completely ignoring the NSA's history and purpose.

Why is it in Portuguese?

What's odd is that it came up in English at first, but now it's Portuguese for me. Another comment here mentioned it's the Brazilian version of Google's search page.

depends on where the traffic exits the Akamai network... they are likely using it to proxy Recaptcha, so they likely said "we don't care where it exits" and Akamai picks whatever is most convenient for them... in that case, Brazil.

It depends on the IP of the Akamai server that's hitting it. If you search "what is my ip" you'll see it.

A test version of a MITM proxy that captures data?

Just went down, now redirects to www.nsa.gov.

I am somewhat baffled. What was that?

??????

This looks really really dumb. I wonder if you can get personal sites to display through nsa.gov somehow through this.

Among other things, it's weird that it shows up with a different GeoIP triangulation for different users. Someone commented here about seeing this in Portuguese. I'm seeing this in Japanese. Does anyone what's going on?

EDIT: And now it's showing up in English.

It gives me Brasil's Google

yeah I am on brazil also.

I believe this has to do with which Akamai server ends up handling the page request.

Reply on news.ycombinator.com