5 ms·

nsagate.apple.com

35 points by algorithm_dk 12y ago

sjustinas 12y ago
Spotted as early as 2001. http://lists.apple.com/archives/macos-x-server/2001/Jun/msg00342.html http://lists.apple.com/archives/macos-x-server/2001/Jun/msg0...
- algorithm_dk 12y ago
  and has never been answered...
  - acqq 12y ago
    Still the same IP.
mostafaberg 12y ago
I hardly think apple or any company are dumb enough to name their backdoor publicly nsagate as a subdomain to their company's domain, it's probably some kind of service, since apple prefixes lots of things with NS (NextStep), it could also be initials for a billion other words, see http://www.acronymfinder.com/NSA.html http://www.acronymfinder.com/NSA.html
- acqq 12y ago
  However, if it were for Next Step A: > Ping request could not find host nsbgate.apple.com.
  - algorithm_dk 12y ago
    They also had salt.apple.com and pepper.apple.com. And still functional: apple.apple.com
  - mostafaberg 12y ago
    well I guess it doesn't stand for next step a, or they didn't need any more names than 'a' and never went for 'b' ;) Also it could be "Next Step Administration", "Next Step Access", etc.. there are a billion possibilities, I'm not saying apple doesn't give access to NSA, they surely do, but I'm saying they obviously won't do it this way ;)
verandaguy 12y ago
I wouldn't call this anything more than an educated guess - but maybe nsagate stands for name server A-record gateway?
- acqq 12y ago
  Anybody ever heard for such a kind of gateway?
  - verandaguy 12y ago
    I'm not implying it's standardized; it would just be a descriptive name.
biot 12y ago
A gateway between NextStep and Apple? Watch out for the NSArchiver class in Foundation Framework.
doe88 12y ago
or simply nsagate for nameserver A gate.
sixothree 12y ago
What ports are open?
- joaomsa 12y ago
  Services could be hidden through the use of port knocking.
  - canadev 12y ago
    Cool, never heard of it. "In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specific port(s). A variant called Single Packet Authorization exists, where only a single "knock" is needed, consisting of an encrypted packet.[1][2] The primary purpose of port knocking is to prevent an attacker from scanning a system for potentially exploitable services by doing a port scan, because unless the attacker sends the correct knock sequence, the protected ports will appear closed." http://en.wikipedia.org/wiki/Port_knocking http://en.wikipedia.org/wiki/Port_knocking
- andrewcooke 12y ago
  > nmap -Pn -A -T4 nsagate.apple.com Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-23 21:27 CLST Nmap scan report for nsagate.apple.com (17.254.0.48) Host is up. All 1000 scanned ports on nsagate.apple.com (17.254.0.48) are filtered
deleted 12y ago
[deleted]

nsagate.apple.com

35 points by algorithm_dk 12y ago

Spotted as early as 2001. http://lists.apple.com/archives/macos-x-server/2001/Jun/msg00342.html http://lists.apple.com/archives/macos-x-server/2001/Jun/msg0...

algorithm_dk 12y ago
and has never been answered...
- acqq 12y ago
  Still the same IP.

mostafaberg 12y ago

I hardly think apple or any company are dumb enough to name their backdoor publicly nsagate as a subdomain to their company's domain, it's probably some kind of service, since apple prefixes lots of things with NS (NextStep), it could also be initials for a billion other words, see http://www.acronymfinder.com/NSA.html http://www.acronymfinder.com/NSA.html

acqq 12y ago
However, if it were for Next Step A: > Ping request could not find host nsbgate.apple.com.
- algorithm_dk 12y ago
  They also had salt.apple.com and pepper.apple.com. And still functional: apple.apple.com
- mostafaberg 12y ago
  well I guess it doesn't stand for next step a, or they didn't need any more names than 'a' and never went for 'b' ;) Also it could be "Next Step Administration", "Next Step Access", etc.. there are a billion possibilities, I'm not saying apple doesn't give access to NSA, they surely do, but I'm saying they obviously won't do it this way ;)

verandaguy 12y ago

I wouldn't call this anything more than an educated guess - but maybe nsagate stands for name server A-record gateway?

acqq 12y ago
Anybody ever heard for such a kind of gateway?
- verandaguy 12y ago
  I'm not implying it's standardized; it would just be a descriptive name.

biot 12y ago

A gateway between NextStep and Apple? Watch out for the NSArchiver class in Foundation Framework.

doe88 12y ago

or simply nsagate for nameserver A gate.

sixothree 12y ago

What ports are open?

joaomsa 12y ago
Services could be hidden through the use of port knocking.
- canadev 12y ago
  Cool, never heard of it. "In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specific port(s). A variant called Single Packet Authorization exists, where only a single "knock" is needed, consisting of an encrypted packet.[1][2] The primary purpose of port knocking is to prevent an attacker from scanning a system for potentially exploitable services by doing a port scan, because unless the attacker sends the correct knock sequence, the protected ports will appear closed." http://en.wikipedia.org/wiki/Port_knocking http://en.wikipedia.org/wiki/Port_knocking
andrewcooke 12y ago
> nmap -Pn -A -T4 nsagate.apple.com Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-23 21:27 CLST Nmap scan report for nsagate.apple.com (17.254.0.48) Host is up. All 1000 scanned ports on nsagate.apple.com (17.254.0.48) are filtered

deleted 12y ago

[deleted]