21–30 of 33 posts
Samy is smart. Been friends with him for about 15 years. One of the smartest hackers I know. Built most of Fonality's backend, too. Also won "Caesars Challenge" in Vegas when he was like 14 years old.
Not to downplay a rather interesting vulnerability, but why does it matter if someone figures out where you are? As much as I love my own real (not internet) privacy, I don't depend on people not knowing where I am. The success of sites such as Foursquare lead me to believe a large amount of people feel the same way.
Furthermore, if you've got control of the router (and thus DNS server settings...) the user has much bigger problems: http://www.schneier.com/blog/archives/2007/02/driveby_pharmi...
Maybe, even if the user changed the default password, he probably stored the new credentials in the browser.
Earlier quoted context omitted.
Let's assume the users is on 192.168.50.0/24 can his attack figure that out?
The attack/code he showed cannot, but what you can do it write different iframes. Here is an example: a+'.'+b+'.'+c+'.'+d where a=192 b=168 c=0-255 b=0-255 Of course this could be any private network address range[1]. Next you would use document.write or .innertext to make these iframes. Personally I wouldn't stop at the first one. I would log all the frames that loaded into an array and from there test them further.…
for(var c=0;ihttp://192.168. + c + '.' + d + '" id="' + i + '.' + j + '" name="' + c + '.' + d + '">'); } }
portscans, wow.
For a massively-deployed hack like Samy's, it makes plenty of sense to just check the small handful of major-brand wifi routers.
Samy is smart. Been friends with him for about 15 years. One of the smartest hackers I know. Built most of Fonality's backend, too. Also won "Caesars Challenge" in Vegas when he was like 14 years old.
Relevance? Are you the same guy telling people "I went to high school with that chick" when looking at porn with comment features?
Very clever. What if you used the same attack to modify the router's iptables and open a port to the outside world. Upload some patched firmware and you now have the worlds largest botnet.
Earlier quoted context omitted.
Or even better, change the default IP address for the admin login. This attack relies on a bunch of hidden iframes loading IPs that are common default addresses of the admin login page.
Let's assume the users is on 192.168.50.0/24 can his attack figure that out?
Earlier quoted context omitted.
Or even better, change the default IP address for the admin login. This attack relies on a bunch of hidden iframes loading IPs that are common default addresses of the admin login page.
How's that better? That's like changing the port SSH listens on to 2222 even though root's password is "root".
Earlier quoted context omitted.
Wait where does it state he he gained access to router? You can get the mac address of your router with sending a http request to it. Mine states it on the homepage. Doesn't mean you can change anything on there. What I'd like to know is how he manages to send this request, javascript origination policy should be blocking this. EDIT: I was referring to the original article, schneier has a point, if the users has the…
I'm also curious as to how he's managing to call to the router via javascript. Anyone have more details on the hack? edit: Here's more info... http://samy.pl/mapxss/ The hack relies on a specific XSS vulnerability in the Verizon FiOS router. It requires that you're already logged into your router or that you're using default username/password.
That said, I've upvoted you for the link.
Earlier quoted context omitted.
The attack/code he showed cannot, but what you can do it write different iframes. Here is an example: a+'.'+b+'.'+c+'.'+d where a=192 b=168 c=0-255 b=0-255 Of course this could be any private network address range[1]. Next you would use document.write or .innertext to make these iframes. Personally I wouldn't stop at the first one. I would log all the frames that loaded into an array and from there test them further.…
This will take forever, and also make the user's browser unresponsive. for(var c=0;i http://192.168 . + c + '.' + d + '" id="' + i + '.' + j + '" name="' + c + '.' + d + '"> '); } } portscans, wow. For a massively-deployed hack like Samy's, it makes plenty of sense to just check the small handful of major-brand wifi routers.