A Recycled IP Address Caused Me to Pirate Books by Accident

https://nickjanetakis.com/blog/a-recycled-ip-address-caused-me-to-pirate-390000-books-by-accident

by nickjj • 8 years ago

260 98 8 years ago

chatmasta4• 8 years ago

This is known as "subdomain takeover" and is definitely a common problem. It's probably one of the most frequently reported bug types on hackerone.

I wonder -- has anyone written code to spin up EC2 instances and check for subdomains pointing to the IP? Not sure how you could do that efficiently (does rdns work after the IP has been recycled?), but a starting point might be gathering as many NXDOMAIN subdomains as possible, filtering the ones at cloud providers, and starting instances until you get a match.

phlo• 8 years ago

Not sure how you could do that efficiently...

You could probably do that quite efficiently with Passive DNS data. There are a bunch of providers (e.g. FarSight, RiskIQ, many others) that collect and aggregate DNS request data and make it searchable over time.

RDNS is probably not going to be helpful. I'm not aware of any cloud provider setting a PTR record by default, and I think most won't allow you to do that at all.

slrz• 8 years ago

GCP as well as Digital Ocean definitely allow for configuring PTR records. AWS does too, I think. At least with GCP, you have to demonstrate ownership of the domain.

praseodym• 8 years ago

Sites like DomainTools have vast amounts of DNS records indexed and allow reverse lookups by IP address (so not actual reverse DNS) which would make your idea pretty doable.

petercooper• 8 years ago

I believe https://securitytrails.com/ is a new player in this space

Operyl• 8 years ago

Bing has been known to be a great search engine for "reverse IP searches." https://www.bing.com/search?q=ip%3A208.109.192.70

If you're fast enough, it could still be cached in bing when you search.

wpietri• 8 years ago

That's surprisingly good. And it turns out that if search Google for my server's IP, I'll find even more things I host, albeit through listings on a bunch of random semi-garbage sites.

acangiano2• 8 years ago

Interesting. I used this to discover that someone is pointing their (pretty decent) domain name towards my server. I won't, but I could theoretically make it display anything of my choosing.

textmode• 8 years ago

https://api.hackertarget.com/reverseiplookup/?q=208.109.192....

mandatory• 8 years ago

I actually blogged about this in 2015, it's a problem for basically all cloud providers that allow recycled allocation of IPs: https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-po...

gowld2• 8 years ago

Is it possible for IPv4 to not recycle IPs?

Is IPv6 big enough to not recycle IPs in the modern high-churn deployment world? (It's probably big enough to give every human (or payment card holding customer) a few million blocks of IPs that they can personally control, and recycle IPs within each accountable block that)

dan-c• 8 years ago

I wrote a script a few years ago to do the same thing with Digital Ocean floating IPs

https://gist.github.com/rxall/5305bcaa008e51685998

stephengillie2• 8 years ago

I suggested something similar while working at an AWS competitor - automated RBL searching. A huge number of our public IPs were used by spammers or phishers on the free tier. They would use a public IP until it was blocked, then release that and get another from the pool.

As a cloud host, it's embarrassing to have to explain to your customers that their shiny new IP is on an RBL because it was last used to steal passwords.

chatmasta4• 8 years ago

Did this company have an automated process for dealing with abuse tickets? Usually you’ll get at least one abuse ticket before an IP is added to RBL, right? It shouldn’t come as a surprise when your IP is added to the list after you’ve had X number of abuse complaints about the IP.

Seems like a better (or at least, complementary) solution would be more proactive monitoring of the abuse@ email and prompt terminations of clients who generate too many complaints.

wjoe• 8 years ago

Sadly, the more common practice seems to be adding the entire IP blocks of known server/cloud providers to blacklists.

gowld2• 8 years ago

Then it's not a shiny new IP; it's a tarnished used IP that hasn't been refurbished.

alex_young• 8 years ago

Should be simple. Just log 'host' header from http terminations, right?

julianj• 8 years ago

I used to do this. I once ran across a prod HRC VPN subdomain and got myself banned from r/netsec.

https://www.reddit.com/r/netsec/comments/5wizf8/hillaryclint...

iMerNibor• 8 years ago

Just got some new ips and I've been on the other end of this. Some staging domain of a website still points to one of the ips I got and there's a health checker that keeps trying to ping /health on the domain.

Nowhere near the scale of this though, just some background noise I'll ignore

keketi• 8 years ago

Same here. Soon after launching a cloud hosted virtual machine I noticed that it was getting a lot of unexpected HTTP traffic on port 80. They were GET requests with parameters that suggested to me that it was coming from some kind of Javascript browser tracker.

I rebooted the VM to get a new IP address and the traffic stopped. It's somebody else's problem now.

imhoguy• 8 years ago

Serve them a cheap gzip b0mb (example [0]) - it sould move their ass to clean up things.

[0] https://blog.haschek.at/post/f2fda

dx0345• 8 years ago

The users are often innocent, they just want to use the old page. Best is to just serve a 403 or refuse the connection.

dogma1138• 8 years ago

That’s a nice way of getting your ass in a heap of trouble especially if you experience a drive-by by a legitimate service.

Essentially don’t do anything you wouldn’t do in a wrong number call or if someone is knocking on your door looking for the previous tenant.

datenwolf• 8 years ago

Nowhere near the scale of this though, just some background noise I'll ignore

Same situation here. However being on the receiving end of a "formerly" Russian camgirl site makes this a little more than just noise. Any good ideas of what one could do with that?

dx0345• 8 years ago

The problem for you is that you can't do much against it. The domain owner can easily change the record, you can't. The only way is to blackhole all requests coming in for domains other than the ones you want to host. Or is there any way to get the DNS records checked?

rando4442• 8 years ago

The only way someone is going to gain access to my server is if they manage to gain access to my workstation and steal my SSH key pair.

If it has happened before, you'd be foolish to think that it's impossible to happen again.

https://nvd.nist.gov/vuln/detail/CVE-2016-1247

tinix5• 8 years ago

What does this have to do with anything even remotely related to this article, other than it being a webserver? Symlink takeover is not a new vulnerability, and if someone has a user account on your server, you're already owned anyway. Escalating to root is trivial almost always.

rando4442• 8 years ago

The author spends the beginning of the article talking about how he takes security very seriously, that his webserver is practically uncompromisable, and that the odds of it being compromised are so remote because he has "the reflexes of a highly trained ninja" and doesn't run nginx as root.

I'm pointing out that his server isn't as uncompromisable as he's trying to lead the reader to believe.

cathhhhji• 8 years ago

What would be the reason to use someone else's domain that you don't have control over to point to an IP address?

jacquesm2• 8 years ago

So that they end up being the ones that are blamed for whatever illegal stuff the perp is up to.

gruez• 8 years ago

What's the advantage of that compared to using a bare IP? You still need a server to host your illicit content, so you're still exposed that way. Also, DMCA requests are sent to service providers, not to whoever owns the domain. The whole arrangement is probably worse than a bare IP because your site can be "taken down" by someone else with no warning.

nebulous14• 8 years ago

They probably didn't even know that it was accessible via that domain. Their webserver responded to any request with the default site, and google decided to crawl ssl.nickjanetakis.com and found all the pdfs.

nickjj4• 8 years ago

That's what I thought too but then I noticed that someone bothered to put "- Nick Janetakis" in the titles of those PDF pages (check the screenshot in the article).

incompatible3• 8 years ago

What puzzles me is that there are already sites that offer free subdomains. Wouldn't those be sufficient?

dx0345• 8 years ago

I guess a spammer would be able to use the domain ranking for their spam until Google detects that content has changed. Probably easier than promoting a new spam domain

tinix5• 8 years ago

Ha!

One of my old staging subdomains had an old Digital Ocean address left in it for a bit while we migrated some servers, and Google indexed some random ebook pirate site too, here[1] is a snap of the logs for anyone who is curious. Once I updated the DNS, Googlebot started to blow us up.

[1] https://node.zeneval.com/snaps/a79fe276b688da7b589ce539c9a4a...

I never would have even noticed, had it not been for Googlebot indexing the crap out of us, and causing 10s of thousands of sessions to be created in a short time which threw our Munin graphs off the charts.

The site we were staging ran fine, redis handled it without breaking a sweat, but we're not a public facing service, so I just straight up blocked Google Bot w/ an nginx rule.

hartator5• 8 years ago

But before deleting it, I copied the IP address so I could open a support ticket on DigitalOcean. I figured they would like to know that someone is illegally distributing content on one of their servers. Now that they know the IP address, they can shut it down.

It’s also possible you exposed a web service that wasn’t meant to be public.

stelonix• 8 years ago

This. The article was interesting but the copyright knighthood put me off.

What if the person was simply serving those files for himself over the internet (I've done it countless times) and Google caught it because the author was careless with handling DNS entries? Now DO has an IP and an accusation, more power is given to the DMCA-strike-first-ask-later status quo, all for what? It's not child pornography we're talking about, it's books for Christ's sake. There's no harm, it does not affect your life, why go through the effort of bringing trouble to someone else because of your own lack of care with sensitive issues such as DNS entries?

nebulous14• 8 years ago

Then the webserver admin should work out how to stop google crawling his site and stop his site responding as any DNS name.

nickjj4• 8 years ago

What if the person was simply serving those files for himself over the internet (I've done it countless times) and Google caught it because the author was careless with handling DNS entries?

Author here, I reached out to DO because as a fellow content creator I felt morally obligated to report this.

I wouldn't like someone pirating my content and the people who created those 390,000+ PDFs put a lot of their time into making their content.

There's no harm, it does not affect your life, why go through the effort of bringing trouble to someone else because of your own lack of care with sensitive issues such as DNS entries?

It does affect my life. I noticed now that there has been a couple of copyright infringement notices submit towards my domain (because of this PDF incident).

When you run an online business and your website is your entire brand, something like that is a big deal.

Also if you Googled for my name before I removed the A record, that SSL subdomain was coming up which was competing with my actual site's content. Not good!

oh_sigh• 8 years ago

A personal library of 390,000 books? That's quite the collection. I wonder how much that person paid for those books?

tzs• 8 years ago

What if the person was simply serving those files for himself over the internet

There are a couple of reasons to believe that this is not the case.

First, there were thousands of them. Someone having thousands of books is not unreasonable, of course, but both the breadth and depth of this collection is such that it is extremely unlikely it is someone's personal library.

Second, the PDFs aren't the actual books. They are just short blurbs describing the book and containing download deep links into bookfreenow.com. A couple examples [1] [2]. Clicking to create an account so you can start downloading redirects through some ad companies (and possibly some shady affiliate marketing companies), eventually reaching some download site (I think) that tells you no free slots are available and asks you to make an account.

(The bookfreenow.com pages for each book all seem to be the same template with just the book info substituted. Even the comments on the each page are from the same people, at the same times, and say the exact same things except they have the correct book title on each page. They aren't even trying to make it look like the comments are legit).

[1] http://bookfreenow.com/downloads/the-lm3900-a-new-current-di...

[2] http://bookfreenow.com/downloads/essential-orthopaedics-by-j...

userbinator• 8 years ago

I would agree with you in principle, but this is just another one of those spam sites that flood the search results with useless crap when you're looking for bookz; there's no copyright infringement here, just spam. They're easily distinguished from "real" PDFs of books because the text clearly doesn't make any sense.

Thus, in a "the enemy of my enemy is my friend" sort of way, I'm thankful for the OP for removing another fake ebook site from the Internet.

itake• 8 years ago

Just out of curiosity, how do you know this just wasn't an intentional side effect of someone hosting a website on a DO box? Namely, was the box just responding to anything that would connect to it?

Google has probably already crawled that domain previously, and when it asked for that IP address, it found some other persons website.

smileybarry2• 8 years ago

The screenshot shows the blog author's name attached to all of the search results as a proper, spaced name. (As opposed to a domain substring) It looks like intended impersonation.

hartator5• 8 years ago

I know I made a stupid mistake by not removing the A record but this could happen to anyone. I would like to see more services only allow for DNS based authentication by adding TXT records.

There is plenty of reasons why one will prefer HTML verification over TXT DNS verification. It's usually faster, and more predictable. Plus DNS are far from being completely secure.

icebraining3• 8 years ago

It's also pretty nice if you're a provider hosting a website for the client (e.g. Github Pages, Shopify, etc). Getting them to point an A record to us is hard enough, but at least it's only once. Then you can use HTML verification for setting up LE certificates, Analytics, etc.

uptown• 8 years ago

What's the purpose for spreading PDFs like this? Are there ways to embed malware into PDFs so they attack the host machine of whoever downloads the files?

tinix5• 8 years ago

When this happened to me, I jumped to the same conclusion, that the PDFs must be a honeypot or something.

But yes, PDFs are exploitable, like any file format.

https://www.sans.org/security-resources/malwarefaq/pdf-overv...

goda90• 8 years ago

There are people who feel good about sharing non-free materials with others. Perhaps this approach is for users where torrenting isn't an option.

Froyoh• 8 years ago

Yep, like me

throwaway218649• 8 years ago

I have Google Alerts set up so I get emailed when people link to my site. A few months ago I started to receive an absurd amount of notifications, but I ignored them. I chalked it up to “Google is probably on drugs”.

Between this quote and the bozo-level advice in the "Domain Validation Should Be More Strict" section ("I would like to see more services only allow for DNS based authentication by adding TXT records" is going to solve this problem? permanently decommissioning IPv6 addresses?), the one lesson I can take away from this article is to stay as far away as possible from any of this guy's security related courses.

nebulous14• 8 years ago

This is a decent reminder to get rid of DNS entries to IP addresses you no longer control.

That said ...

A few months ago I started to receive an absurd amount of notifications, but I ignored them.

Really? I find it pretty amazing that he chalked it up to “Google is probably on drugs”, without even investigating at all!

icebraining3• 8 years ago

I can see myself doing the same thing, particularly if I didn't have much free time when it happened. I wouldn't expect Google Alerts to warn me of a security issue!

nickjj4• 8 years ago

The problem is, when the Google Alert hit my inbox it didn't show the ssl.nickjanetakis.com subdomain in the alert snippet. It just showed "Nick Janetakis".

Still, I should have clicked through to see what was up, but then again, the links looked very suspicious. I don't make a habit of clicking a bunch of unknown links sent via email, especially not when running Windows.

dx0345• 8 years ago

Second this. I found Google to be the best indicator for any issues with a web page. They have pretty mature systems and crawl actively, anything flagging up there is likely to be an issue. Even if it had been spam you'd want to know who creates spam pages impersonating your domain.

z3t4• 8 years ago

Google is aggressive when it comes to crawling (which I think is OK) so it's very much possible that the one who hosted these PDF's had no idea that Google had crawled the site, or that it was under that domain.

smileybarry2• 8 years ago

It seems like they knew what they were doing, given that the search results have the author's name attached to them. (As a proper name, rather than cutting "nickjanetakis" out of "ssl.nickjanetakis.com")

dec0dedab0de• 8 years ago

if you're using cookies for sessions on your main domain this can be a very big flaw.

trumped• 8 years ago

The odds of that are remote because my workstation never leaves my office and I have the reflexes of a highly trained ninja.

Does HE ever leave his office?

incompatible3• 8 years ago

So, if I had a subdomain set up that way, and sci-hub or somebody came along and starting using it, would I have any legal obligation to do anything about it? Could my domain be seized?

incompatible3• 8 years ago

I expect the domain registrar terms and conditions would get your domain shut down sooner or later.

deaps• 8 years ago

I'm not very security minded. I have old domains and subdomains that I used to use that have long since passed - that lived on server IP's that have also long since passed on from my ownership as well.

I just double checked all of my old stuff - and there's not a trace left out there. Apparently, I cleaned up all my old DNS entries as things moved on, even though none of those domains are my 'brand' (as the author states it is his). As a non-security minded person, I find it hard to believe a security-minded person, whose good at his trade, forgets to do this.

A Recycled IP Address Caused Me to Pirate Books by Accident

Related Stories