1

Today I connected to a free socks proxy and checked the dns and found that the serverhost name was prism1.nsa.gov! I was wondering if this is how the nsa attempts to perform mitm attacks on clients? As most people know the nsa has successfully exploiTed tor users by exploiting the exit nodes used to reach the clear...but do they do this same method for socks users? Are they hoping that some malicious user will unknowingly connect to their server and conduct nefarious acts through their server and everything will be logged ? Entrapment? https://i.sstatic.net/Ss7B3.jpg (screenshot of nsa socks hostname)

1
  • I highly doubt this is actually the NSA.
    – Ben N
    Jan 28, 2016 at 14:18

1 Answer 1

0

If they are situated as the DNS server then they can log every hostname that a client attempts to connect to (because they are the resource for hostname to IP address resolutions).

That means they can also change the IP address of the requested hostname to whatever server they want (one of their own). From there they could create a fake copy of the site that the victim is attempting to access and capture login credentials, whilst returning a vague (made up) error message to the user with something like "Please refresh the page".

The victim would refresh the page and by then the NSA would've changed the host IP back to the legitimate one, and made off with the victim's account.

In this case, I believe it is targeting users who are not familiar with how something like this works. You caught it though...

But then again this could just be your proxy host trolling you. The host prism1.nsa.gov would be painfully obvious of the NSA to use, even for an uneducated user.

Here is a fantastic article by OccupyTheWeb over on WonderHowTo's Null Byte about another way they do this called Quantum Insert.

2
  • I also suspected the host name to be way too obvious and that surely the nsa would know better? But then that got me thinking....aren't all dotgov registrations only available to local federal and state organizations? If this is true whoever registered that domain name must not know how to do their job correctly.
    – Tambaepyuh
    Jan 28, 2016 at 4:14
  • @Tambaepyuh The dotgov.gov website says: The Gov Internet domain facilitates collaboration among government-to-government, government-to-business, and government-to-citizen entities. The domain hosts only official, government sites at the federal, state and local levels of government, including federally recognized Indian tribes and Alaskan Native groups, known as Native Sovereign Nations (NSNs). I do think there are a lot of hoops to jump through to get one of these but prism1.nsa.gov would be a subdomain so you would only need to edit the domain registry...
    – c0deous
    Jan 28, 2016 at 16:11

Not the answer you're looking for? Browse other questions tagged .