Home page logo

basics logo Security Basics mailing list archives

RE: Company Firewall's IP Address
From: "Michael S Hines" <mshines () purdue edu>
Date: Tue, 12 Nov 2002 19:32:09 -0500

A little digging with our friend Sam Spade shows us the following ----

The Domain registration shows the following:

   P.O. Box 1222
   San Luis Obispo

   Domain Name: BONZI.COM

   Administrative Contact, Technical Contact:
      Administrator  (ADM649-ORG)  admin () BONZI COM
      BONZI Software
      P.O. Box 1222
      San Luis Obispo, CA 93406
      (805) 546-1955
      Fax- (805) 546-1956

   Record expires on 15-Sep-2009.
   Record created on 14-Sep-1995.
   Database last updated on 12-Nov-2002 19:08:29 EST.

   Domain servers in listed order:

it returns an IP address of
pings to it this evening at 7:10 pm are failing...  it may have been taken
Bonzi owns a block of addresses - a subset of UUNET's addresses, as noted

11/12/02 19:11:27 IP block www.bonzi.com
Trying at ARIN
Trying 63.68.55 at ARIN
UUNET Technologies, Inc. UUNET63 (NET-63-64-0-0-1)
Bonzi Software UU-63-68-54 (NET-63-68-54-0-1)
a web inquiry shows the following:
11/12/02 19:14:18 Browsing http://www.bonzi.com/
Fetching http://www.bonzi.com/ ...
GET / HTTP/1.1 Host: www.bonzi.com Connection: close User-Agent: Sam Spade
1.14  HTTP/1.1 302 Object Moved Location:
http://www.bonzi.com/bonziportal/index.asp Server: Microsoft-IIS/5.0
Content-Type: text/html Connection: close Content-Length: 165
<head><title>Document Moved</title></head>
Sam Spade can be your friend - check it out at

You'll have to draw your own conclusions.

If you're on the Internet (and not behind a proxy) then you ARE advertising
your IP addresses.  Sounds like yours may have been found by a random
scanner.  The good news is that it appears your firewall worked, your
internal address was not disclosed.  And you wisely posted using a public
e-mail service (not your internal network id).  Only problem was Yahoo
displayed the IP address of the Webmail poster in the message header - it
was posted by the host IP  The lookup on that is left as an
exercise for the reader...

All of the above information is in the public domain and readily available
using one or more of the tools that should be in an auditors toolbox.

Michael S Hines                | Phone 765-494-5875
Purdue University              | FAX   765-496-1380
Information Technology () Purdue  | Email mshines () purdue edu
OS/390 Systems Programmer      | Certifications:
401 S Grant St                 |    CIA, CISA, CFE, CDP
West Lafayette, IN 47907-2024  |

-----Original Message-----
From: owner-cisaca-l () purdue edu [mailto:owner-cisaca-l () purdue edu]On
Behalf Of tony tony
Sent: Tuesday, November 12, 2002 5:09 PM
To: security-basics () securityfocus com; Cisaca
Subject: Company Firewall's IP Address

I was doing security research on the internet at work yesterday....when all
a sudden I got a pop up advertisement that stated that I was broadcasting my
address to the entire internet.  It then showed a screen with my IP address
which was the the external IP interface of one of our companies firewalls.

It just bothers me that someone would be able to determine the IP address of
our firewall that easily.  It seems to me that our firewall should operate
in a
more stealth mode.  Our firewall administrator said it is not technically
possible to do this.  What is your take?I am not a checkpoint firewall
I do not know.   All I know is that if I was a hacker, I would love to
away on an ip address that represented a firewall.

Click on the following to learn more about this pop up site.


Do you Yahoo!?
U2 on LAUNCH - Exclusive greatest hits videos

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]