Hacker News Reader

Comment by dmix | Hacker News Reader

Came across a discussion on Twitter pointing out reddit users who apparently discovered IP addresses in error messages printing out in the HTTP response:

26 Mar 2013: http://www.reddit.com/r/SilkRoad/comments/1b1lvy/warning_the...

26 Mar 2013: http://www.reddit.com/r/Bitcoin/comments/1b1n7y/warning_to_s...

03 May 2013: http://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_b...

View on HN

Wow, I love how those threads are full of people who insist the OP is full of shit and that Silk Road doesn't even have a public IP address.

Maybe we'd have fewer incidents like these if keyboard jockeys were a bit more teachable. Even super 1337 h4xx0r5 make mistakes, often obvious ones. Software is complicated. Let this be a lesson to any of us who may dismiss a correction too quickly.

Yes. They all tend to talk in certainties about something that they are only speculating about:

  > you would have to go out of your way to expose
  > your public IP via Tor.

  > However, the hidden service you connect to,
  > would be the load balancer. This service would
  > have zero knowledge of its "external" ip
  > address, as it would be running in a VM
  > pointing to a port on the loopback device.

(because obviously nothing else is possible)

  > - Server is almost 100% certainly running in a
  > VM and doesn't have a public IP.
  >
  > - The entire harddrive for the server (which
  > includes all the the information such as
  > private messages and addresses) is almost 100%
  > encrypted.
  > 
  > This is the motherfucking SilkRoad. They've
  > been operating so successfully for so long
  > because they're not amateurs. OP is a liar.

... etc ...

the funny part is: the people i know that used the service (who were far down towards 'non' on the technical spectrum) complained regularly about it's terrible design, stability and security, and were under the impression it was administrated by parties that had little idea what they were doing. they theorized it was a big scheme to go Gox* on them once enough coins were present in the system.

it's interesting that these people, who have no idea what an ip or load balancer or VM is, were able to pick up on this. i would guess that the h4xx0r5 actually spent little time using the service or had the bit of their own necks being exposed taint their assessment.

* yeah, i know no one really knows exactly what happened, but it's fun to poke fun.

Assuming the reddit posters are correct. This means the PHP app knew the public IP. Isn't the only way to know about it to enter it into the web server configuration?

No, there are several $_SERVER variables available to all php applications. The two relevant ones in this case would be HTTP_HOST and SERVER_ADDR, most likely the author of the application was leaking one of those in his application.

But a webserver does not know its external IP, that is the whole confusion. Don't PHP docs say:

'SERVER_NAME' The name of the server host under which the current script is executing. If the script is running on a virtual host, this will be the value defined for that virtual host.

'HTTP_HOST' Contents of the Host: header from the current request, if there is one.

1.) You're assuming that the script was running on a vhost, we don't know.

2.) Even if the script is running in a vhost, if a listening port is specified but not an IP address the SERVER_NAME will be the IP of whatever the interface the http connection came from was.

Reply on news.ycombinator.com