I hardly think apple or any company are dumb enough to name their backdoor publicly nsagate as a subdomain to their company's domain, it's probably some kind of service, since apple prefixes lots of things with NS (NextStep), it could also be initials for a billion other words, see
http://www.acronymfinder.com/NSA.html
well I guess it doesn't stand for next step a, or they didn't need any more names than 'a' and never went for 'b' ;)
Also it could be "Next Step Administration", "Next Step Access", etc.. there are a billion possibilities, I'm not saying apple doesn't give access to NSA, they surely do, but I'm saying they obviously won't do it this way ;)
> nmap -Pn -A -T4 nsagate.apple.com
Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-23 21:27 CLST
Nmap scan report for nsagate.apple.com (17.254.0.48)
Host is up.
All 1000 scanned ports on nsagate.apple.com (17.254.0.48) are filtered
"In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specific port(s). A variant called Single Packet Authorization exists, where only a single "knock" is needed, consisting of an encrypted packet.[1][2]
The primary purpose of port knocking is to prevent an attacker from scanning a system for potentially exploitable services by doing a port scan, because unless the attacker sends the correct knock sequence, the protected ports will appear closed."
Comments
I hardly think apple or any company are dumb enough to name their backdoor publicly nsagate as a subdomain to their company's domain, it's probably some kind of service, since apple prefixes lots of things with NS (NextStep), it could also be initials for a billion other words, see http://www.acronymfinder.com/NSA.html
However, if it were for Next Step A:
They also had salt.apple.com and pepper.apple.com. And still functional: apple.apple.com
well I guess it doesn't stand for next step a, or they didn't need any more names than 'a' and never went for 'b' ;)
Also it could be "Next Step Administration", "Next Step Access", etc.. there are a billion possibilities, I'm not saying apple doesn't give access to NSA, they surely do, but I'm saying they obviously won't do it this way ;)
Spotted as early as 2001.
http://lists.apple.com/archives/macos-x-server/2001/Jun/msg0...
and has never been answered...
Still the same IP.
I wouldn't call this anything more than an educated guess - but maybe nsagate stands for name server A-record gateway?
Anybody ever heard for such a kind of gateway?
I'm not implying it's standardized; it would just be a descriptive name.
or simply nsagate for nameserver A gate.
A gateway between NextStep and Apple? Watch out for the NSArchiver class in Foundation Framework.
What ports are open?
Services could be hidden through the use of port knocking.
Cool, never heard of it.
"In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specific port(s). A variant called Single Packet Authorization exists, where only a single "knock" is needed, consisting of an encrypted packet.[1][2]
The primary purpose of port knocking is to prevent an attacker from scanning a system for potentially exploitable services by doing a port scan, because unless the attacker sends the correct knock sequence, the protected ports will appear closed."
http://en.wikipedia.org/wiki/Port_knocking