D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] OT: Scam call

 

On Fri, Mar 22, 2013 at 3:21 PM, Kevin Lucas wrote:
> On the subject of Scammer and hackers..
>
> I had to set up a method of remotely assisting someone 300 miles away on
> a Virgin media cable connection
>
> We both have Linux and I have set the router for VNC and ssh
> I thought we would need some form of Dynamic DNS so i could connect
> anytime without asking him for his external IP
>
> But....
> I connected once with Vnc viewer and in the logs it gives me the virgin
> host in the format of cpcx-clifxx-2-0-custxxx.12-4.cable.virginmedia.com
>
> which I have just alised to him so just vncviewer "bob" will always
> connect!
>
> I looked at mine for a BT Customer and yes the format is
> hostxx-150-xxx-x.range86-xxx.btcentralplus.com
>
> works for me at any time!
>
> By by Dynamic DNS
>
> gotten in the wrong hands this could target a BT/ Virgin customer quite
> easily!
> I have fail to ban on both machines and regularly get ssh and vnc
> attempts,  the secure logs are full of them.
>
> Just a bit of paranoia ( hope India isn't listening).

I'm not really sure what you mean and what the problem is here.

What you describe looks like rDNS to me: the fact that a lot of IP
addresses have a reverse DNS. For example, the reverse DNS for
80.68.88.22 (the IP address where the DCGLUG website is hosted) is
lintel.vm.bytemark.co.uk. So multiple hostnames can point to the same
IP address, but it has one unique rDNS record.

That's useful for a number of reasons. It's used frequently in
spam-filtering. However, it is NOT a replacement for dynamic DNS:
dynamic DNS ensures a changing IP address has a fixed hostname
pointing to it. Reverse DNS records don't change, at least not
dynamically.

Knowing the IP address means knowing the rDNS (if it exists) and vice
versa. So it's not a security issue.

Martijn.

-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq