INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Partial ZIP File Downloads
Published: 2025-01-20.
Last Updated: 2025-01-20 07:27:48 UTC
by Didier Stevens (Version: 1)
Say you want a file that is inside a huge online ZIP file (several gigabytes large). Downloading the complete ZIP file would take too long.
If the HTTP server supports the range header, you can do the following:
We will work with my DidierStevensSuite.zip file as an example (it's 13MB in size, not several GBs, but the principle remains te same).
First, with a HEAD HTTP request, we figure out the ZIP file size ...
The size of the ZIP file is 13189336 bytes.
The end of a ZIP file contains a series of DIR records that compose the directory of files (and directories) contained inside the ZIP file. This directory is usually small, compared to the file size, so we will do a partial download starting at position 13000000.
This can be done with the curl range option: this will add a header that specifies the range we want to download ...
Next we use my zipdump.py tool to parse the ZIP records (-f l) inside the partial ZIP download like this ...
Read the full entry: https://isc.sans.edu/diary/Partial+ZIP+File+Downloads/31608/
Geolocation and Starlink
Published: 2025-01-21.
Last Updated: 2025-01-21 15:40:20 UTC
by Johannes Ullrich (Version: 1)
Until now, satellite internet access has been more of a niche solution for internet access. But with the wide availability of Starlink, this is changing. Starlink's performance and price are competitive for many rural users to forgo solutions like cellular or slower DSL speeds if they are available at all.
Starlink offers a substantially different type of service from most "traditional" satellite networks. Traditional satellite networks use a small number of satellites in high orbits, connecting to a handful of ground stations. The ground station issues the IP address, and each ground station may cover a large geographic area, often exceeding individual countries. The IP address of a satellite user identifies the ground station location, not the user's location. Starlink, on the other hand, uses satellites in low earth orbit. The network can forward traffic among satellites, but typically, the satellite will attempt to pass the traffic to the closest base station in view. Due to the low orbit, each satellite only "sees" a relatively small area, and the ground station is usually within a couple hundred miles of the user.
It appears that Starlink is using AS 14593 and 27277. The first one is the one that is used for customer traffic. The second one seems to be used for the internal corporate network.
AS 14593 advertises 696 different prefixes [HE]. Most are small (/23 and /24). This is typical for a newer company like SpaceX that had to "cobble together" IP address space and couldn't get a large allocation. Starlink does not offer a publicly routable address to customers for regular consumer plans. Instead, it uses "carrier-grade NAT". The customer will receive a 100.64.0.0/10 address per RFC 6598 [CGNAT]. By default, the Starlink router will issue 192.168/16 addresses to the user's equipment unless the router is configured in bridge mode (or bypass mode).
The CGNAT address is later translated to a publicly routable address at the ground station. Starlink does support PTR records for its customer IPs and uses the following hostname scheme:
customer.[ground station identifier].pop.starlinkisp.net
Forward resolution for these hostnames does not work. This is likely configured to avoid issues with customers attempting to run mail servers. The "ground stations identifier" appears to follow the following format:
4 digits: City identifier
3 digits: Region (Country or the State, followed by 'X', for US-based ground stations)
1 digit: number
For example ...
Read the full entry: https://isc.sans.edu/diary/Geolocation+and+Starlink/31612/