2

Company A has a set of servers with public IP address but not associated with any domain. The servers contain confidential information, so company A doesn't want to give access to 3rd party.

Company B has generated confidential security reports for those servers.

How does company B verify that company A owns all those servers before sending those reports?

  • 1
    If company B is an ISP, it will know who is the IP owner. – mootmoot Jun 27 '18 at 14:28
  • Company B should have already verified that Company A owned those servers prior to doing any security testing... – hft Jun 27 '18 at 21:46
2

You can do this, as Google does with their Web Master Tools. See https://support.google.com/webmasters/answer/35179?hl=en

Basically, Company B can require Company A to upload a small file (e.g. text file) with a GUID in it or with a GUID as a file name. Company B then verifies the availability of this file on every of the acclaimed properties.

However, evil Company C could place that file too, to get the reports also. Company B must make sure, they only send the reports regarding the IP, not for all IP's at once.

| improve this answer | |
  • Doesnt it need a webserver? Lets say x.y.z.a is ip address, how to verify if that file is present? – ChillarAnand Jun 27 '18 at 14:35
  • 1
    @ChillarAnand You could use any protocol to place retrieve the GUID's. Even SNMP for example. – Marcel Jun 27 '18 at 14:37
2

iana.org (Internet Assigned Numbers Authority) is the global organization governs IP allocations worldwide. And it has regional sub bodies to govern respective area such as:

AFRINIC Africa Region

APNIC Asia/Pacific Region

ARIN Canada, USA, and some Caribbean Islands

LACNIC Latin America and some Caribbean Islands

RIPE NCC Europe, the Middle East, and Central Asia

These organizations allocate IPs for the ISPs on respective regions and ISPs allocating IPs to their customers. ISPs must update the respective regional registries with customer details for IP allocations.

Each of these sub bodies have an online tool (Whois) where we can check these IP allocations. For example, APNIC has a site http://wq.apnic.net/static/search.html where we can check who owns IP address.

For example: enter image description here

Hence in your case Company B can verify the relevant IPs on respective regional registry’s Whois site.

Note: This only works if the enterprises/organization has been allocated dedicated IPs for their usage by IANA or their ISP.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.