0

My question is similar to this: how to find URLs accessed by a process

I don't care about what is transmitted, but from where it is downloaded. I need to specify to the security department which URLs are needed to be accessed by a build tool. It's very hard to do this by a static analysys, so I think monitoring is a more liable and easy solution.

Maybe strace could be useful. If needed, I have root access to the machine. I'm not interested on other internet accesses by other tools in the same host.

1 Answer 1

1

That's impossible in theory and practice:

An IP address can be pointed at by an arbitrary amount of DNS entries. So, if you only see the TCP connection, there's no way to know which domain was meant. Sure, you can do a reverse DNS lookup, but that will a) not necessarily work, and b) at best give you one of the domains.

If your build tool is reasonable, then all the connections that it uses to download stuff (using HTTPS, FTPS, the git protocol,…) are encrypted, so you can't inspect the traffic's content, either.

Most things where you'd download code and containers from (github, docker, gitlab, Google's repo tool, …) do use encryption. Also, they use CDNs, so that there's not even a single IP address you connect to – the resolution which host to connect to is done by DNS lookups.

So, there's positively no way, aside from adding a backdoor / debug hook specific to each application, to know which domains it accesses, and even less, which URLs it accesses.

The only way to do that would be by enforcing a TLS-/SSL-stripping man-in-the middle proxy. But that would erase all the security you could get by git doing TLS verification – so, that "security measure" would actually make your whole thing less secure.

I need to specify to the security department which URLs are needed to be accessed by a build tool.

How's that going to work for something like git-via-http(s)? The URLs will change as the software changes, adding submodules residing on other servers is a normal coding operation.

I think your security department needs to live with the fact that you're doing software builds, and they can't police that, unless they have someone they can put aside to maintain the software at the same technical quality as you do. You can quote me on that :)

4
  • Then, I can provide the IPs instead of the domain names. That's true, nowadays, https protocol is mostly used. Commented Jan 10, 2023 at 14:54
  • Would it be possible to intervept DNS lookups in the host machine? With this, it could be enough. Commented Jan 10, 2023 at 15:01
  • 1
    you can of course try to get all UDP traffic going to ports that are used for DNS, but that only informs you about the hostnames being resolved (if a hostname has already been resolved and is cached on your system, you won't know). There's also the off-chance that your tools use DNS over TLS ore DNS over HTTPS, in which case you can't look inside the DNS traffic, to protect against an internet provider or company figuring out what domains you look up. Commented Jan 10, 2023 at 16:12
  • 1
    but ask yourself: what does your company win in actual security when they have to allow all of github's CDN servers, and most of cloudflare? That just means your computer gets access to practically all public software there is, and it can download pretty much arbitrary things. Commented Jan 10, 2023 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .