82

You have identified only one risk, that of an attacker identifying machine roles on the network by using predictable host names. I think you missed the competing risk, that of increased operator error by not using predictable and descriptive host names. This is how I would assess those conflicting measures: Use unpredictable host names Benefit(s) An ...


70

The hostname is included in the initial SSL handshake to support servers which have multiple host names (with different certificates) on the same IP address (SNI: Server Name Indication). This is similar to the Host-header in plain HTTP requests. The name is included in the first message from the client (ClientHello), that is before any identification and ...


53

Your public facing IP address is for most intents and purposes public information. No security should be dependent on it being private, however it's not something you want to wave around willy nilly necessarily (just like you wouldn't wave your home address around) but it also isn't something that is hard for someone to find with generally minimal effort if ...


45

Easier to hack? No. Easier to DoS? Potentially. Using an IP address instead of a host name with a DNS entry means you're giving up a layer of routing flexibility that can be very beneficial. For example, if malware targets your IP address in a DoS attack, if you're using a domain name, you switch the IP address of the site and in the DNS record, and ...


40

Update: It seems like a Finnish man was able to demonstrate this "attack" by issuing a certificate for the domain live.fi by having the address hostmaster@live.fi. Last year, I made a bet with a friend that I can get a browser-trusted certificate with his domain name in order to launch a successful MiTM attack on his login form to steal his password. Long ...


39

Your network guy might have a good reason for not wanting to share the information you enquired about. You see, what you describe you asked him of is not the IP range (CIDR) your company has been assigned to, but actual list of individual live IPs within that ASN. Now, getting the CIDR range that your organisation was assigned to its ASN is relatively easy, ...


35

Here is one method of purchasing a domain name pretty close to anonymously. Use Tor. Understand its weaknesses Buy a prepaid credit card in cash, specifically one not requiring activation or signature. Randomly generate a full alias to use during online registration. Register an account at a domain registrar. Use the prepaid credit card to buy a domain. ...


32

Some common risks to check: Domain has Bad reputation - check for any existing negative online reviews for the domain. Domain is Blocked in search results - Risk of search engine turning off the domain in its search results due to the previous content, malware etc. Domain is Black listed - Domain on black lists such as Web of Trust and spam lists. ...


32

Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.


29

As a pentester being able to find the subdomains for a site comes up often. So I wrote a tool, SubBrute that does this quite well if I do say so my self. In short, this is better than other tools (fierce2) in that its a lot faster, more accurate and easier to work with. This tool comes with a list of real subdomains obtained from spidering the web. ...


28

Yes, it can be issued. Luckily the common browsers do not accept wildcard certificates for TLDs. Chromium Source Code: // Do not allow wildcards for public/ICANN registry controlled domains - // that is, prevent *.com or *.co.uk as valid presented names, but do not // prevent *.appspot.com (a private registry controlled domain). // In addition, unknown ...


28

To answer your specific question, .local has already been reserved by ICANN as an internal gTLD. Please see section 2.2.1.2.1 "Reserved Names" in the ICANN Applicant Guidebook. The full list of reserved gTLDs are: AFRINIC IANA-SERVERS NRO ALAC ICANN RFC-EDITOR APNIC IESG RIPE ARIN IETF ROOT-SERVERS ASO INTERNIC RSSAC CCNSO INVALID SSAC ...


27

The answer depends on the web-server you are using. For example, apache allows for the creation of multiple virtual hosts, of which the first described is considered the default one. What I suggest to do, is to create this default "catch-all" virtual-host with a global deny rule on it. Then configure your own web-site with a virtual-host identified with ...


25

I don't think they are actually redirecting to your site. If it was a true redirect, then the phone number couldn't be different. My guess is your website was scraped and copied to another site. They registered a new domain and used the content of your site. Then they created some spam SEO links to trick Google into moving them up higher in the rankings to ...


22

SNI is there for virtual hosting (several servers, with distinct names, on the same IP address). When a SSL client connects to a SSL server, it wants to know whether it is talking to the right server. To do that, it looks for the name of the intended server in the certificate. Every evil hacker can buy a certificate for his own server (called evilhacker.com),...


21

I think this guy is wig-freak, LOL, no for real I'm almost sure that this guy doesn't know what he is doing. I can see that actually he is just mirroring existing wig-websites and changing some of the links, but meanwhile he is forgetting to change other links which are redirecting to original website. These are some of his domains: ...


20

This is a nobrainer. Don't let the domain lapse. Domains are cheap, security incidents are expensive.


20

The fact that there is no readily available information to support your conclusion, should give you some idea about its validity. The point is, that if your attacker is already in, he will need to do some additional foot-printing anyway. Your host name may be database.xyz.intranet, but if the nmap gives you 1521 (oracle), 1433 (sql server) or 5432(Postgress)...


17

Typically if your site is accessible as http://1.2.3.4/ that would imply that it is not enforcing any limitations on the Host: header. That would mean that you could access it not just through IP address, but any hostname that happened to resolve to that address - including a domain an attacker registered and pointed at it. This opens up DNS rebinding ...


15

In addition to the ones mentioned already, the previous owner may have a SSL certificate that may still be valid. That would be a major issue especially for sites dealing with commerce.


15

There's just no way to fix it. Even if the registration period is two years and a one year certificate is issued, you could still sell or drop the registration next week. There's nothing the certificate authority can do about that. (Well, I suppose they could monitor the registrations and if there's a change in registrant, they could revoke the certificate. ...


15

A public IP address is called a public IP address for a reason. Treat it like one. Keeping the list of public IP addresses belonging to your company will make no difference to any sort of attacks, be it opportunistic or targeted. If your system is connected to the internet, it will be hammered on by automated scripts and malware out there. If an attacker is ...


15

What you're advocating for is called "security though obscurity". While in theory obscurity does provide some extra protection while not making things worse, it usually does make things worse in practice. It (1) adds complexity to the system which leads to errors, (2) dilutes the understanding of what information is secret and what isn't, and (3) may have a ...


14

No, the certificate would not appear as trusted in the user's browser, because the connection would fail, because the user's browser would not be able to complete an SSL/TLS handshake with the server. In order for the handshake to be completed, the server must have the private key that corresponds to the public key in the certificate.


13

As the previous two mentioned the malware wasn't connecting to the unregistered domain name. The unregistered domain was a technique that was supposed to be used to prevent analysis of the malware. Often times when malware researchers are picking apart malware they do so in a virtual machine. The way certain virtual machines resolve domain names result in ...


10

For the issuing part, everything can be put in a certificate. That a name is "wildcard" has no special significance for the CA. The CA puts a string as dNSName in a Subject Alt Name extension, and that's it. Whether this string contains "*" characters or not will not impact the CA behaviour. What matters is what SSL clients will accept as a "valid ...


10

If you google for wigsforwomenny you will see results with blog spam that links to it. Someone is probably gaming Google's links in order to make their fake site seem reputable. Instead of generating a fake wig site, though, they simply set their referrer to point to a legitimate site - yours. That way if someone does follow through their link spam, it ...


9

Do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? No, you don't. CAs can issue certificate that are valid after the expiry date of the domain (at the time of issuance). Even if they didn't, a domain could be transferred before its expiry date. In addition, you can't possibly control all the CAs that ...


9

No. DNSSEC does not protect the integrity of a DNS name if the registrar for that name is malicious (or compromised). The registrar for grumpyavians.com is the ultimate source of authority for who owns grumpyavians.com (and, e.g., what is the public key for grumpyavians.com). Consequently, if the registrar is malicious or compromised, then the registrar ...


9

Get used to these. You will get them regularly. A lot of overpriced registrars make a living going around sending out e-mails and even snail mail like this to try to get website owners to pay for services from them. The services are generally legitimate but overpriced and often sent prior to actually being needed. They are correct that you must keep your ...


Only top voted, non community-wiki answers of a minimum length are eligible