0

I need to find out the public-ip of an EC2 instance. I was trying this command:

curl https://ipinfo.io/ip

Is there any security threat of using that method? Like exposing our IP or something?

  • Like exposing our IP or something? Um, it's a public IP. It's exposed by definition. Also, are you aware of the fact that you can just ask your OS about it's own IP address, and don't have to rely on external services that might go down unannounced? – Marcus Müller Mar 27 '18 at 8:20
  • 2
    @MarcusMüller Taking any number of NICs, NAT layers, and proxies, into consideration, asking the OS for "an" IP is pretty meaningless - the "right" IP always depends on the peer. – user155462 Mar 27 '18 at 8:44
  • well, if it's a public-IP EC2 instance, I don't think this applies. – Marcus Müller Mar 27 '18 at 8:46
  • @MarcusMüller "Public" EC2 instances typically reside on an RFC 1918 internal subnet with a 1:1 mapping to a public address as well. So running ip addr will get you an address that is useless. – multithr3at3d Mar 27 '18 at 16:00
  • @multithr3at3d ah! ok, then I was wrong. – Marcus Müller Mar 27 '18 at 16:01
2

If there is a remote execution bug in curl or any lib it relies on, there is a chance curl will run arbitrary code. That might be a security risk if you don't patch your system and run this command using a cron job.


To answer your question: Of course, you are exposing your IP to this service, as you are exposing on any router, country and intelligence. But your ip is public anyway, the known default ports will be scanned like any minute as soon as it's booted.


Also if they give you a wrong IP, and you assume it's yours and you connect using ssh for example, your credentials will go to the server they might control. Also there might be a man-in-the middle attack that will result in showing you the wrong IP and trick you into sending credentials or other data to a wrong server.

  • 1
    Man-in-the-middle attacks on the ipinfo endpoint would be mitigated through use of the https protocol. There is still the risk of the service itself going rogue, which no amount of transport encryption would resolve. – nbering Mar 27 '18 at 9:54
  • And of course, all these threats are the most paranoid observations possible. In any practical risk assessment, this should be pretty safe as long as you’re using, for example, https and public-key based authenticators when you connect to your own systems. – nbering Mar 27 '18 at 9:58
0

The only issue that I can think about is that the company ipinfo.io after you make the request use the IP for do other things.

  • Well in theory, a bug in curl or the TLS library it uses could be exploited. – forest Mar 27 '18 at 8:47
  • yep, but if that is your threat scenario, you better not interact via http or TLS with anyone – Marcus Müller Mar 27 '18 at 8:49
  • 1
    Yep that's true. Point is that there is a security threat to doing that which wouldn't be present in running, say, ip addr show. – forest Mar 27 '18 at 8:50
0

Other answers have already exposed 2 threats:

  • dependance on a external actor (here the company running https://ipinfo.io/ip)
  • dependance on curl tool

But I must say that I can hardly imagine a real use case for that. In order to execute the command on a system, you must be connected to it (or have been connected at a time), and to connect to it you need either a direct access (unlikely on a EC2 instance) or a network connection. And to establish the network connection, you must know a remote system address: either an IP one or a name that you can ask your DNS server for.

So the only use case for that would be for execution on a system where the script was installed by accident - or by a malware. And even in that case, it would be more simple to directly try to connect to a system controlled by the script owner.

Said differently, without more context, I really suspect an X-Y problem: you are trying to solve a problem that only exists because you tried a wrong solution to another question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.