Comments on: ABE Patrols the Routes to Your Routers http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/ Giorgio Maone's answers to the Web, the Universe, and Everything Wed, 16 May 2012 22:10:03 +0000 http://wordpress.org/?v=2.2.3 By: Lee http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-24249 Lee Tue, 14 Dec 2010 13:51:58 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-24249 hello, i use no script all the time in fact when i install a browser its the first thing i do to add NS. I came here from a google search "what does a website requesting lan resources mean". ABE stopped a website from applying something though what i dont know, the site was http://www.cluesforum.info/ i jus went back to get the link and the warning has gone, can someone tell me (a total idiot) what has happened please?. hello, i use no script all the time in fact when i install a browser its the first thing i do to add NS.
I came here from a google search "what does a website requesting lan resources mean". ABE stopped a website from applying something though what i dont know, the site was http://www.cluesforum.info/ i jus went back to get the link and the warning has gone, can someone tell me (a total idiot) what has happened please?.

]]> By: CISO http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23493 CISO Wed, 11 Aug 2010 19:44:05 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23493 Scan your networks now, make sure your DNS servers are responding well, and make sure they do NOT answer to anyone at the world, want to know why it's important? read here: http://sites.google.com/site/dnslocator/ Scan your networks now, make sure your DNS servers are responding well,
and make sure they do NOT answer to anyone at the world,
want to know why it’s important? read here:

http://sites.google.com/site/dnslocator/

]]> By: c calver http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23488 c calver Wed, 11 Aug 2010 15:41:03 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23488 seems like this new feature is seen by my 3Com OfficeConnect router firewall as a Land Attack - but only by my note books that use Intel Pro Wireless - not the single one I have that uses a Broadcom chip - is that a good or bad thing? Any way when I saw this I was not a happy bunny as I try very hard to keep my pcs clean and was wondering what was up and how it happened - especially as I had just installed a new harddrive and fresh Xp in one and this pc was so behaving seems like this new feature is seen by my 3Com OfficeConnect router firewall as a Land Attack - but only by my note books that use Intel Pro Wireless - not the single one I have that uses a Broadcom chip - is that a good or bad thing? Any way when I saw this I was not a happy bunny as I try very hard to keep my pcs clean and was wondering what was up and how it happened - especially as I had just installed a new harddrive and fresh Xp in one and this pc was so behaving

]]> By: Peter http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23460 Peter Tue, 10 Aug 2010 11:10:41 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23460 Hi Giorgio, thanks a lot for this new feature! Very nice :-) And general thanks for noscript! Firefox without noscript is like a dog without a bone. Hi Giorgio,

thanks a lot for this new feature! Very nice :-)
And general thanks for noscript! Firefox without noscript is like a dog without a bone.

]]> By: DareDeMo http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23398 DareDeMo Fri, 06 Aug 2010 21:36:51 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23398 A-ha! When I'd pinged a1plpkivs-v03.any.prod.ash1.secureserver.net, I'd gotten 72.167.239.239 last week... but last night I spaced and didn't ping ocsp.godaddy.com to compare. Result: in my neck of the woods, that turns into ocsp.godaddy.com.akadns.net & resolves to 72.167.239.239 as well. Cool beans. Thanks for getting me back on to the straight and narrow -- have an excellent weekend! A-ha!

When I’d pinged a1plpkivs-v03.any.prod.ash1.secureserver.net, I’d gotten 72.167.239.239 last week… but last night I spaced and didn’t ping ocsp.godaddy.com to compare. Result: in my neck of the woods, that turns into ocsp.godaddy.com.akadns.net & resolves to 72.167.239.239 as well. Cool beans.

Thanks for getting me back on to the straight and narrow — have an excellent weekend!

]]> By: Giorgio http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23393 Giorgio Fri, 06 Aug 2010 12:48:24 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23393 @<a href="http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23388" rel="nofollow">spirat</a>: It's gonna be implemented as an about:config preference (it's for networking-aware people, after all) in next release. @<a href="http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23392" rel="nofollow">DareDeMo</a>: Nothing to be worried about: <strong>n1plpkivs-v03.any.prod.ams1.secureserver.net</strong>, despite its scary shape, is just the same as <strong><a href="http://en.wikipedia.org/wiki/OCSP" target="_blank" rel="nofollow external" rel="nofollow">ocsp</a>.godaddy.com</strong>, which is queried by Firefox to validate <strong>secure.informaction.com</strong>'s SSL certificate: <pre> > dig ocsp.godaddy.com [...] ocsp.godaddy.com.akadns.net. 36 IN A 188.121.36.239 > dig n1plpkivs-v03.any.prod.ams1.secureserver.net [...] n1plpkivs-v03.any.prod.ams1.secureserver.net. 3319 IN A 188.121.36.239 </pre> @spirat:
It’s gonna be implemented as an about:config preference (it’s for networking-aware people, after all) in next release.

@DareDeMo:
Nothing to be worried about: n1plpkivs-v03.any.prod.ams1.secureserver.net, despite its scary shape, is just the same as ocsp.godaddy.com, which is queried by Firefox to validate secure.informaction.com’s SSL certificate:

> dig ocsp.godaddy.com
[...]
ocsp.godaddy.com.akadns.net. 36 IN      A       188.121.36.239

> dig n1plpkivs-v03.any.prod.ams1.secureserver.net
[...]
n1plpkivs-v03.any.prod.ams1.secureserver.net. 3319 IN A 188.121.36.239
]]> By: DareDeMo http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23392 DareDeMo Fri, 06 Aug 2010 04:53:16 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23392 @Giorgio: Sorry to have asked the question and then dropped off the face of the earth there. 93 hours last week and am cresting 60 already this week. Ack. Pardon the lengthy reply below – I can take this offline if it would be better than flooding this board, & if you’re game. Setup – 2 different VMs, each running Server 2003. One with Firefox 3.6.8 + NoScript 2.0, Firebug 1.5.4 & Web Developer 1.8 add-ons. One with NoScript 2.0 & Web Developer 1.8 add-ons. Each use a blank page upon Firefox startup. Between the two, the experiment results are consistent: A: run netstat –a, see that it’s clean, turn on Firefox w/ NoScript 2.0 enabled, fire off netstat –a again within seconds of having started Firefox, see that netstat reported connection out to a1plpkivs-v03.any.prod.ash1.secureserver.net briefly. B: Next, disable NoScript, turn off Firefox, netstat (clean), turn on Firefox, netstat a bunch of times – clean / no ‘*.secureserver.net’ line. As a different experiment, I rolled one VM back to a snapshot prior to upgrading NoScript to 2.0. No *.secureserver.net oddities observed when fiddling with netstat & Firefox at load. Then installed 2.0 and that crazy guy was back in existence each time Firefox starts unless NoScript is disabled. So, I trotted out a third VM, also Server 2003, with Firefox 3.6.8 on it w/ Firebug 1.5.4 and Web Developer 1.8. NoScript is also on it, but I’d left it at version 1.10. Like the roll-back experiment, with NoScript either enabled or disabled, *.secureserver.net doesn’t make an appearance. Anyhow, I anticipate having more time toward the middle of next week to continue exploring this. I can snapshot that 3rd VM, upgrade NoScript to 2.0 and see if it joins the ranks. May be able to see what Fiddler 2 has to say as well during the various scenarios. Again – thanks for all of the work you’ve done with NoScript as well as casting your eye toward this bit of weirdness my paranoia had me stumble across. ;) @Giorgio:
Sorry to have asked the question and then dropped off the face of the earth there. 93 hours last week and am cresting 60 already this week. Ack.

Pardon the lengthy reply below – I can take this offline if it would be better than flooding this board, & if you’re game.

Setup – 2 different VMs, each running Server 2003. One with Firefox 3.6.8 + NoScript 2.0, Firebug 1.5.4 & Web Developer 1.8 add-ons. One with NoScript 2.0 & Web Developer 1.8 add-ons. Each use a blank page upon Firefox startup.

Between the two, the experiment results are consistent:

A:
run netstat –a, see that it’s clean, turn on Firefox w/ NoScript 2.0 enabled, fire off netstat –a again within seconds of having started Firefox, see that netstat reported connection out to a1plpkivs-v03.any.prod.ash1.secureserver.net briefly.

B:
Next, disable NoScript, turn off Firefox, netstat (clean), turn on Firefox, netstat a bunch of times – clean / no ‘*.secureserver.net’ line.

As a different experiment, I rolled one VM back to a snapshot prior to upgrading NoScript to 2.0. No *.secureserver.net oddities observed when fiddling with netstat & Firefox at load. Then installed 2.0 and that crazy guy was back in existence each time Firefox starts unless NoScript is disabled.

So, I trotted out a third VM, also Server 2003, with Firefox 3.6.8 on it w/ Firebug 1.5.4 and Web Developer 1.8. NoScript is also on it, but I’d left it at version 1.10. Like the roll-back experiment, with NoScript either enabled or disabled, *.secureserver.net doesn’t make an appearance.

Anyhow, I anticipate having more time toward the middle of next week to continue exploring this. I can snapshot that 3rd VM, upgrade NoScript to 2.0 and see if it joins the ranks. May be able to see what Fiddler 2 has to say as well during the various scenarios.

Again – thanks for all of the work you’ve done with NoScript as well as casting your eye toward this bit of weirdness my paranoia had me stumble across. ;)

]]> By: spirat http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23388 spirat Fri, 06 Aug 2010 01:37:51 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23388 Thanks guys. I was wondering what the new DNS rebinding attack was about, that's a clever guess. This kind of attack will be now useless with NoScript, but only for the external router. I believe that some corporations host their own web servers at the same place, on the same network they connect their employees. So ultimately, a road may be traced through the firewall via a DNS Rebinding attack, even with NoScript. To address this potential threat, why not allowing the user to set manually the IPs of not only the external gateway, but also all the hosts accessible on the same network having other(s) IP(s) on other(s) subnet(s) ? This would permit to have more control and would address too the problem of the external proxy. Am I wrong ? Thanks guys. I was wondering what the new DNS rebinding attack was about, that’s a clever guess.

This kind of attack will be now useless with NoScript, but only for the external router. I believe that some corporations host their own web servers at the same place, on the same network they connect their employees. So ultimately, a road may be traced through the firewall via a DNS Rebinding attack, even with NoScript.

To address this potential threat, why not allowing the user to set manually the IPs of not only the external gateway, but also all the hosts accessible on the same network having other(s) IP(s) on other(s) subnet(s) ?
This would permit to have more control and would address too the problem of the external proxy. Am I wrong ?

]]> By: Giorgio http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23314 Giorgio Sun, 01 Aug 2010 09:43:28 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23314 @<a href="http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23313" rel="nofollow">DareDeMo</a>: I'm almost sure it's not related. All you should see is a HTTP connection to ocsp.godaddy.com (Firefox checking the SSL certificate of secure.informaction.com agaisnt GoDaddy's CA) and a HTTPS connection to secure.informaction.com. Are you sure this goes away if you disable NoScript and comes back when you enable it? Have you got an home page opened at startup? @DareDeMo:
I’m almost sure it’s not related.
All you should see is a HTTP connection to ocsp.godaddy.com (Firefox checking the SSL certificate of secure.informaction.com agaisnt GoDaddy’s CA) and a HTTPS connection to secure.informaction.com.

Are you sure this goes away if you disable NoScript and comes back when you enable it?
Have you got an home page opened at startup?

]]> By: DareDeMo http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23313 DareDeMo Sun, 01 Aug 2010 07:16:05 +0000 http://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/#comment-23313 Something else noticed after upgrading to 2.0: with NoScript enabled, when starting up Firefox, netstat -a notes a brief http connection out and established to a1plpkivs-v03.any.prod.ash1.secureserver.net . Is this related? If not, what might that be? Thank you for all of the work you've put into NoScript & keeping us well protected from so many potential pitfalls that are out on the net. Something else noticed after upgrading to 2.0: with NoScript enabled, when starting up Firefox, netstat -a notes a brief http connection out and established to a1plpkivs-v03.any.prod.ash1.secureserver.net . Is this related? If not, what might that be?

Thank you for all of the work you’ve put into NoScript & keeping us well protected from so many potential pitfalls that are out on the net.

]]>