Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker Uses XSS and Google Street View Data to Determine Physical Location

securityweek.com

Post reply on HN
Print view View original

11–20 of 33 posts

Re: Hacker Uses XSS and Google Street View Data to Determine Physical Location

#11

Post by woodall »

nkassis wrote: post #10
CytokineStorm wrote: post #3

Earlier quoted context omitted.

Or even better, change the default IP address for the admin login. This attack relies on a bunch of hidden iframes loading IPs that are common default addresses of the admin login page.

Let's assume the users is on 192.168.50.0/24 can his attack figure that out?

The attack/code he showed cannot, but what you can do it write different iframes. Here is an example:

a+'.'+b+'.'+c+'.'+d

where a=192 b=168 c=0-255 b=0-255

Of course this could be any private network address range[1]. Next you would use document.write or .innertext to make these iframes. Personally I wouldn't stop at the first one. I would log all the frames that loaded into an array and from there test them further. I would also get the users IP address and tack on :80, :8080, :21, ect and see what I am presented with- web torrent frontends, ftp servers, ect.

[1] http://en.wikipedia.org/wiki/Private_network

Re: Hacker Uses XSS and Google Street View Data to Determine Physical Location

#12

Post by marcinw »

CytokineStorm wrote: post #3
joecode wrote: post #2

Lesson: Put a password on your router.

Or even better, change the default IP address for the admin login. This attack relies on a bunch of hidden iframes loading IPs that are common default addresses of the admin login page.

How's that better? That's like changing the port SSH listens on to 2222 even though root's password is "root".

Re: Hacker Uses XSS and Google Street View Data to Determine Physical Location

#14

Post by revicon »

nkassis wrote: post #9
tlrobinson wrote: post #8

Earlier quoted context omitted.

He does have control of the router's settings (possibly even the ability to update the firmware with a malicious replacement?). Most routers let you set the DNS server addresses to be provided via DHCP. If you control DNS, you control which addresses domains resolve to. No need to control the routing table. SSL helps mitigate the damage to some extent, but only if the site uses SSL.

Wait where does it state he he gained access to router? You can get the mac address of your router with sending a http request to it. Mine states it on the homepage. Doesn't mean you can change anything on there. What I'd like to know is how he manages to send this request, javascript origination policy should be blocking this. EDIT: I was referring to the original article, schneier has a point, if the users has the…

I'm also curious as to how he's managing to call to the router via javascript. Anyone have more details on the hack?

edit: Here's more info...

http://samy.pl/mapxss/

The hack relies on a specific XSS vulnerability in the Verizon FiOS router. It requires that you're already logged into your router or that you're using default username/password.

Re: Hacker Uses XSS and Google Street View Data to Determine Physical Location

#15

Post by tlrobinson »

nkassis wrote: post #9
tlrobinson wrote: post #8

Earlier quoted context omitted.

He does have control of the router's settings (possibly even the ability to update the firmware with a malicious replacement?). Most routers let you set the DNS server addresses to be provided via DHCP. If you control DNS, you control which addresses domains resolve to. No need to control the routing table. SSL helps mitigate the damage to some extent, but only if the site uses SSL.

Wait where does it state he he gained access to router? You can get the mac address of your router with sending a http request to it. Mine states it on the homepage. Doesn't mean you can change anything on there. What I'd like to know is how he manages to send this request, javascript origination policy should be blocking this. EDIT: I was referring to the original article, schneier has a point, if the users has the…

You need to watch the video again. Starting at 1:20 he mentions logging in using the default admin credentials.

He's using an XSS vulnerability in the router admin interface to execute JavaScript on the router's pages, so he can use JavaScript to do pretty much anything the user can do.

But even without an XSS exploit you can make cross-domain POSTs using forms, and GETs using IMG or SCRIPT tags. You just can't get the response, so it's not suitable for this attack where you need to get the MAC address out.

The "Drive-by Pharming" mentioned in the link I posted used the latter technique, because all it needs to do is POST some form that tells the router to update the DNS settings, it doesn't need the response.

He actually mentioned that technique in the video, but sort of glossed over it (right before "now, this isn't necessary in our geolocation XXXSS attack")

Re: Hacker Uses XSS and Google Street View Data to Determine Physical Location

#17

Post by bl4k »

Who remembers the Intel processor ID debacle of ~10 years ago?

http://www.schneier.com/essay-187.html

There were similar privacy concerns when it was found that Microsoft were able to generate unique identifying fingerprints of PC's, which they used for license tracking.

This just proves that the debate then was moot since MAC addresses would become universal unique identifiers. Now everything from phones, routers, computers and laptops all have unique IDs.

To make the situation worse and unlike the Intel debate, the growth of WiFi means that these unique ID's are actually being broadcast for anybody to pick up and read.

RFID will only make this situation worse. There was so much of a fuss about the Intel ID's back in 99 that I can only think that people care less about their privacy today.

Re: Hacker Uses XSS and Google Street View Data to Determine Physical Location

#18

Post by nkassis »

tlrobinson wrote: post #15
nkassis wrote: post #9

Earlier quoted context omitted.

Wait where does it state he he gained access to router? You can get the mac address of your router with sending a http request to it. Mine states it on the homepage. Doesn't mean you can change anything on there. What I'd like to know is how he manages to send this request, javascript origination policy should be blocking this. EDIT: I was referring to the original article, schneier has a point, if the users has the…

You need to watch the video again. Starting at 1:20 he mentions logging in using the default admin credentials. He's using an XSS vulnerability in the router admin interface to execute JavaScript on the router's pages, so he can use JavaScript to do pretty much anything the user can do. But even without an XSS exploit you can make cross-domain POSTs using forms, and GETs using IMG or SCRIPT tags. You just can't get t…

Thanks for the clarifications. I'm now turning off my router's web interface ;p ssh is all that's needed anyway.

Re: Hacker Uses XSS and Google Street View Data to Determine Physical Location

#19

Post by sounddust »

joecode wrote: post #2

Lesson: Put a password on your router.

That doesn't necessarily solve the problem. The attack needs to login to some routers to extract the MAC address, but others provide it willingly without login (I believe DD-WRT does this on the default logged-out status page, for example, although I can't check at the moment).

Re: Hacker Uses XSS and Google Street View Data to Determine Physical Location

#20

Post by thibaut_barrere »

Batsu wrote: post #4

Not to downplay a rather interesting vulnerability, but why does it matter if someone figures out where you are? As much as I love my own real (not internet) privacy, I don't depend on people not knowing where I am. The success of sites such as Foursquare lead me to believe a large amount of people feel the same way.

> why does it matter if someone figures out where you are?

If this allow to know here you are not (eg: you're not at home), this can be useful to a couple of people.

Post reply on HN