253
votes
Accepted
Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?
That domain is an encoded form of the string "WORKGROUP". It is using a variant of hex encoding that uses the letters A-P, instead of the numbers 0-9 followed by A-F.
$ echo ...
- 866
81
votes
Accepted
Computer name naming convention for security
You have identified only one risk, that of an attacker identifying machine roles on the network by using predictable host names.
I think you missed the competing risk, that of increased operator ...
- 1,345
34
votes
Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?
Update: The explanation given by NextDNS support is wrong, see this answer by Miles instead.
I contacted NextDNS support asking for more details and they said this is Google Chrome testing internet ...
- 862
25
votes
Unauthorized domain comes up as my website
I don't think they are actually redirecting to your site. If it was a true redirect, then the phone number couldn't be different. My guess is your website was scraped and copied to another site. They ...
- 9,232
24
votes
Accepted
Why are SSL CAs prohibiting double dash in third and fourth characters?
Adding an answer because too long in a comment, but on the specific point of why reserving everything if xn-- is enough.
In one of first iteration of IDNA standard ("Internationalizing Domain ...
- 1,873
21
votes
Unauthorized domain comes up as my website
I think this guy is wig-freak, LOL, no for real I'm almost sure that this guy doesn't know what he is doing. I can see that actually he is just mirroring existing wig-websites and changing some of the ...
- 10.2k
19
votes
Computer name naming convention for security
The fact that there is no readily available information to support your conclusion, should give you some idea about its validity.
The point is, that if your attacker is already in, he will need to do ...
- 2,180
19
votes
Why are SSL CAs prohibiting double dash in third and fourth characters?
The double hyphen is reserved as a generalized extensibility mechanism of which Punycode is one example.
RFC 5891: 4.2.3.1. Hyphen Restrictions
The Unicode string MUST NOT contain "--" (two ...
- 378
15
votes
Computer name naming convention for security
What you're advocating for is called "security though obscurity". While in theory obscurity does provide some extra protection while not making things worse, it usually does make things worse in ...
- 10.2k
14
votes
Accepted
How does Malware use Unregistered Domains
As the previous two mentioned the malware wasn't connecting to the unregistered domain name. The unregistered domain was a technique that was supposed to be used to prevent analysis of the malware.
...
- 301
10
votes
Unauthorized domain comes up as my website
If you google for wigsforwomenny you will see results with blog spam that links to it. Someone is probably gaming Google's links in order to make their fake site seem reputable. Instead of ...
- 34.7k
10
votes
Accepted
Why some applications host the API in a different domain?
Is there a security benefit to host the API in a different domain than
the dashboard or marketing website?
In a word, resilience.
One benefit is that any security blocks which are put in place due ...
- 73.3k
9
votes
How can I find subdomains of a site?
1. Zone transfer
Some nameservers allow for DNS zone transfers to anyone on the internet, usually unintentionally. In this question, it is explained further: DNS zone transfer attack.
Tools for zone ...
- 33.1k
7
votes
How does Malware use Unregistered Domains
In the case of WannaCry, the unregistered domain acted as a kill switch.
The code did the following:
Issue HTTP GET to unregistered domain
If the GET request fails (because it's unregistered) ...
- 219
7
votes
Why some applications host the API in a different domain?
Under the assumption that the Dropbox web app would e.g. set a session cookie for *.dropbox.com, then this cookie would also be sent to api.dropbox.com.
Since a session cookie is very much security-...
- 255
7
votes
Accepted
A third party Web site wants me to validate my domain ownership using a TXT record
Yes, under certain circumstances, they can.
TXT records are frequently used to verify the domain name ownership for various reasons, including (but not limited to) TLS (HTTPS) certificate issuance. ...
- 3,496
6
votes
Unauthorized domain comes up as my website
I get a 403 when trying to access the site.
This is total speculation, but:
Whoever did this went to the trouble of using a service to hide their whois information. This is not something I normally ...
- 6,338
6
votes
What problem does DNSSEC solve?
1. What is the goal of DNSSEC?
DNSSEC signs DNS records. It does not encrypt, it just confirms authenticity.
The root signs keys from TLDs (such as .org or .de), TLDs sign keys from registrars, and ...
- 33.1k
5
votes
What problem does DNSSEC solve?
It solves integrity guarantee. It will no longer be possible to MITM a signed zone. Right now anyone could falsify DNS records, with DNSSEC they cannot. The client already knows the public key of the ...
- 820
5
votes
Accepted
Is there any point in activating domain privacy after the fact?
Sure there is. All forms of security are about making the attackers job more difficult, not impossible. A physical safe doesn't stop the bad guy from getting the stuff inside, it just makes the ...
- 1,962
5
votes
Why can't I connect to a website via its IP address?
Because the HTTP protocol does allow multiple web sites to be hosted on one IP address. To identify the domain you want to connect to the HTTP protocol uses an header entry Host. If that entry is ...
- 1,471
4
votes
Subdomain takeover due to improper records
Snapchat had this Fastly instance set up, but eventually cancelled their service. However, they had forgotten to remove the DNS record, which allowed this researcher to simply to register a new Fastly ...
- 47
4
votes
Accepted
What is the effect on a domain when the secondary name server is compromised?
DNS resolvers choose the name server to obtain the answer from randomly. There is no difference between primary and secondary NS servers from this point of view.
If you have 2 NS servers and one is ...
- 305
4
votes
Accepted
Can a domain name be trusted?
No. Network connections can be spoofed in a variety of ways. The impact of this is not something that we can say with the information provided; you'll have to evaluate that; but spoofing is ...
- 100k
4
votes
Accepted
Is this sufficient to verify a website's domain?
Is this a sufficient check?
No, your check is flawed.
An attacker can bypass the validation via e.g.:
https://attacker.example/?https://www.trusted.com/
This URL resolves to the origin attacker....
- 45.1k
4
votes
Accepted
Transfer requests for localhost zone on my bind DNS server
This is your guy: https://www.alphastrike.io/
In their own words:
Alpha Strike Labs are a security consulting company specialized in
industrial security and advanced security assessments. Based ...
- 8,465
4
votes
Can a domain be taken by someone else if custom nameservers are misconfigured?
Domain names are registered to your user account on the registrar website. So the only way to get permanent access to a given registered domain is to either:
take ownership of the user account (...
- 13.1k
3
votes
Accepted
Cant access most websites using a fake AP created by aircrack-ng suite
After some comments, you are on the road... now you must locate exactly your problem. To launch sslstrip I can recommend you this nomenclature:
sslstrip -f -p -k -l 10000
-l to listen on port. so ...
- 5,365
3
votes
Is the "same registrable domain" a sound security basis for cookies?
All browsers use the "Public Suffix List", at https://publicsuffix.org/
Besides TLDs, it lists all suffixes "under" which people can have their own domain (for free or not).
This is also called the "...
- 1,873
3
votes
Why are SSL CAs prohibiting double dash in third and fourth characters?
This is due to the double dash's usage in internationalized domain names. xn-- has a special meaning in domain names, and it is technically a violation of the IDNA2008 standard if the -- series of ...
- 265
Only top scored, non community-wiki answers of a minimum length are eligible