• [^] # Re: Pourquoi?...

    Posté par (site web personnel) . En réponse au journal Exigeons des banques, une vraie mise en œuvre de la DSP2 !. Évalué à 10. Dernière modification le 05 avril 2025 à 10:57.

    Pour apporter de l'eau au moulin et donner un exemple concret.

    Ça c'est la capture des flux DNS lorsque j'ouvre l'appli d'une banque connue (pour l'exemple) :


    10:35:55.657564 IP Android-2.local.shiva-confsrvr > _gateway.domain: 10460+ A? playstoregatewayadapter-pa.googleapis.com. (59)
    10:35:55.673078 IP _gateway.domain > Android-2.local.shiva-confsrvr: 10460 11/0/0 A 142.250.179.106, A 142.250.75.234, A 172.217.18.202, A 142.250.201.170, A 142.250.178.138, A 172.217.20.170, A 216.58.214.170, A 172.217.20.202, A 216.58.215.42, A 142.250.179.74, A 216.58.213.74 (235)
    10:35:55.678236 IP Android-2.local.32430 > _gateway.domain: 18328+ A? play-lh.googleusercontent.com. (47)
    10:35:55.693021 IP _gateway.domain > Android-2.local.32430: 18328 1/0/0 A 142.250.179.86 (63)
    10:36:01.574604 IP Android-2.local.centerline > _gateway.domain: 16610+ A? collect.tealiumiq.com. (39)
    10:36:01.590100 IP _gateway.domain > Android-2.local.centerline: 16610 8/0/0 A 3.124.18.126, A 3.127.174.108, A 35.157.201.4, A 3.73.180.212, A 18.194.17.119, A 52.59.151.208, A 3.66.242.143, A 3.66.208.54 (167)
    10:36:01.870324 IP Android-2.local.19665 > _gateway.domain: 14194+ AAAA? www.eum2.caisse-epargne.fr. (44)
    10:36:01.897827 IP _gateway.domain > Android-2.local.19665: 14194 0/0/0 (44)
    10:36:01.899599 IP Android-2.local.29302 > _gateway.domain: 5344+ A? www.eum2.caisse-epargne.fr. (44)
    10:36:01.914532 IP _gateway.domain > Android-2.local.29302: 5344 1/0/0 A 91.135.181.171 (60)
    10:36:02.077623 IP Android-2.local.28806 > _gateway.domain: 14445+ AAAA? firebaselogging-pa.googleapis.com. (51)
    10:36:02.091941 IP _gateway.domain > Android-2.local.28806: 14445 4/0/0 AAAA 2a00:1450:4007:806::200a, AAAA 2a00:1450:4007:813::200a, AAAA 2a00:1450:4007:818::200a, AAAA 2a00:1450:4007:810::200a (163)
    10:36:02.092205 IP Android-2.local.22417 > _gateway.domain: 30654+ A? firebaselogging-pa.googleapis.com. (51)
    10:36:02.106496 IP _gateway.domain > Android-2.local.22417: 30654 10/0/0 A 142.250.201.170, A 216.58.214.74, A 142.250.75.234, A 216.58.214.170, A 172.217.20.170, A 172.217.20.202, A 216.58.215.42, A 142.250.179.74, A 142.250.179.106, A 142.250.178.138 (211)
    10:36:02.144270 IP Android-2.local.33235 > _gateway.domain: 28566+ AAAA? www.as-ano-bad-ce-m.caisse-epargne.fr. (55)
    10:36:02.194143 IP _gateway.domain > Android-2.local.33235: 28566 0/0/0 (55)
    10:36:02.194353 IP Android-2.local.28898 > _gateway.domain: 18045+ A? www.as-ano-bad-ce-m.caisse-epargne.fr. (55)
    10:36:02.222258 IP _gateway.domain > Android-2.local.28898: 18045 1/0/0 A 91.135.181.231 (71)
    10:36:02.491353 IP Android-2.local.4588 > _gateway.domain: 18082+ AAAA? www.icg1auth.caisse-epargne.fr. (48)
    10:36:02.542139 IP _gateway.domain > Android-2.local.4588: 18082 0/0/0 (48)
    10:36:02.543249 IP Android-2.local.14048 > _gateway.domain: 14405+ A? www.icg1auth.caisse-epargne.fr. (48)
    10:36:02.557353 IP Android-2.local.27513 > _gateway.domain: 9759+ A? 4892.n.trusteer.com. (37)
    10:36:02.558136 IP Android-2.local.17429 > _gateway.domain: 7031+ A? 4892.n.trusteer.com. (37)
    10:36:02.558192 IP Android-2.local.14790 > _gateway.domain: 6450+ AAAA? www.rs-ano-bad-ce-m.caisse-epargne.fr. (55)
    10:36:02.571752 IP _gateway.domain > Android-2.local.14048: 14405 1/0/0 A 91.135.181.104 (64)
    10:36:02.587731 IP _gateway.domain > Android-2.local.17429: 7031 1/0/0 A 52.59.153.27 (53)
    10:36:02.587760 IP _gateway.domain > Android-2.local.27513: 9759 1/0/0 A 52.59.153.27 (53)
    10:36:02.621707 IP _gateway.domain > Android-2.local.14790: 6450 0/0/0 (55)
    10:36:02.621943 IP Android-2.local.22615 > _gateway.domain: 17559+ A? www.rs-ano-bad-ce-m.caisse-epargne.fr. (55)
    10:36:03.547451 IP Android-2.local.33058 > _gateway.domain: 5820+ A? rab.api.caisse-epargne.fr. (43)
    10:36:03.589386 IP _gateway.domain > Android-2.local.33058: 5820 5/0/0 CNAME d20icyvvsxzf6a.cloudfront.net., A 3.165.136.80, A 3.165.136.46, A 3.165.136.64, A 3.165.136.116 (150)

    Ça c'est quand je sélectionne le compte utilisateur :

    10:37:33.246150 IP Android-2.local.37037 > _gateway.domain: 47088+ AAAA? www.rs-ano-bad-ce-m.caisse-epargne.fr. (55)
    10:37:33.333968 IP _gateway.domain > Android-2.local.37037: 47088 0/0/0 (55)
    10:37:33.334294 IP Android-2.local.65126 > _gateway.domain: 57141+ A? www.rs-ano-bad-ce-m.caisse-epargne.fr. (55)
    10:37:33.362438 IP _gateway.domain > Android-2.local.65126: 57141 1/0/0 A 91.135.181.231 (71)
    10:37:36.958093 IP Android-2.local.48345 > _gateway.domain: 60701+ AAAA? customers.kameleoon.com. (41)
    10:37:36.960732 IP Android-2.local.65300 > _gateway.domain: 59448+ AAAA? www.as-ext-bad-ce.caisse-epargne.fr. (53)
    10:37:37.047294 IP _gateway.domain > Android-2.local.65300: 59448 0/0/0 (53)
    10:37:37.047698 IP Android-2.local.53507 > _gateway.domain: 38417+ A? www.as-ext-bad-ce.caisse-epargne.fr. (53)
    10:37:37.054054 IP _gateway.domain > Android-2.local.48345: 60701 1/1/0 CNAME customers-services01.kameleoon.com. (135)
    10:37:37.057457 IP Android-2.local.38492 > _gateway.domain: 36055+ A? customers.kameleoon.com. (41)
    10:37:37.075100 IP _gateway.domain > Android-2.local.38492: 36055 2/0/0 CNAME customers-services01.kameleoon.com., A 138.201.37.217 (92)
    10:37:37.080416 IP _gateway.domain > Android-2.local.53507: 38417 1/0/0 A 91.135.185.227 (69)
    10:37:37.761252 IP Android-2.local.47951 > _gateway.domain: 55881+ AAAA? www.icgauth.caisse-epargne.fr. (47)
    10:37:37.789537 IP _gateway.domain > Android-2.local.47951: 55881 0/0/0 (47)
    10:37:37.792814 IP Android-2.local.64234 > _gateway.domain: 42570+ A? www.icgauth.caisse-epargne.fr. (47)
    10:37:37.807516 IP _gateway.domain > Android-2.local.64234: 42570 1/0/0 A 91.135.181.104 (63)

    ET ça c'est quand je valide le formulaire d'authentification :

    10:38:12.885480 IP Android-2.local.ssr-servermgr > _gateway.domain: 47448+ A? 4892.n.trusteer.com. (37)
    10:38:12.900231 IP _gateway.domain > Android-2.local.ssr-servermgr: 47448 1/0/0 A 52.59.153.27 (53)
    10:38:13.968654 IP Android-2.local.49928 > _gateway.domain: 58414+ AAAA? www.icgauth.caisse-epargne.fr. (47)
    10:38:14.018772 IP _gateway.domain > Android-2.local.49928: 58414 0/0/0 (47)
    10:38:14.019147 IP Android-2.local.53418 > _gateway.domain: 39397+ A? www.icgauth.caisse-epargne.fr. (47)
    10:38:14.034016 IP _gateway.domain > Android-2.local.53418: 39397 1/0/0 A 91.135.181.104 (63)
    10:38:14.333767 IP Android-2.local.56472 > _gateway.domain: 64939+ AAAA? www.as-ext-bad-ce.caisse-epargne.fr. (53)
    10:38:14.361458 IP _gateway.domain > Android-2.local.56472: 64939 0/0/0 (53)
    10:38:14.362254 IP Android-2.local.41760 > _gateway.domain: 44743+ A? www.as-ext-bad-ce.caisse-epargne.fr. (53)
    10:38:14.389817 IP _gateway.domain > Android-2.local.41760: 44743 1/0/0 A 91.135.185.227 (69)
    10:38:14.790043 IP Android-2.local.48629 > _gateway.domain: 46042+ AAAA? www.rs-ext-bad-ce.caisse-epargne.fr. (53)
    10:38:14.840512 IP _gateway.domain > Android-2.local.48629: 46042 0/0/0 (53)
    10:38:14.840815 IP Android-2.local.39753 > _gateway.domain: 49019+ A? www.rs-ext-bad-ce.caisse-epargne.fr. (53)
    10:38:14.840837 IP Android-2.local.63194 > _gateway.domain: 61159+ AAAA? www.rs-ext-bad-ce.caisse-epargne.fr. (53)
    10:38:14.841129 IP _gateway.domain > Android-2.local.63194: 61159 0/0/0 (53)
    10:38:14.878206 IP _gateway.domain > Android-2.local.39753: 49019 1/0/0 A 91.135.185.227 (69)

    On voit qu'il n'y a pas que des requêtes vers des machines qui appartiennent à la banque en question.