Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

81–90 of 358 posts

Re: Found hooked up to my router

#81

Post by swiftcoder »

p49k wrote: post #70
krn wrote: post #68

Earlier quoted context omitted.

What about DNS spoofing[1] at the local network level? [1] https://en.wikipedia.org/wiki/DNS_spoofing

The spoofer wouldn’t be able to obtain a valid certificate for the spoofed site, though.

The spoofer can obtain a valid certificate for another, seemingly legitimate site. Any software that hasn't explicitly pinned the leaf TLS certificates will still accept the (valid) certificate it is redirected to.

And sadly, a lot of software still doesn't perform certificate pinning.

Re: Found hooked up to my router

#82

Post by adamconroy »

jeffmcjunkin wrote: post #75
adamconroy wrote: post #63

I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).

It could use something like bdfproxy[1] to intercept HTTP-downloaded EXE files, then add some persistent malware in _addition_ to whatever the EXE was doing. This has been done before, over Tor[2]. The malware doesn't have to add a new root certificate, either, though that's completely possible. The Zeus trojan [3] does "man-in-the-browser" to intercept banking information, for example. [1] https://github.com/secrets…

so the spoofer distributing these devices is going to all this trouble/expense/risk in the hope there is a http downloaded exe it can corrupt, then hopes the hashing doesn't fail on that corrupt exe, and hopes the user ignores the untrusted source warning so that it can install a trojan?

Re: Found hooked up to my router

#83

Post by Ajedi32 »

adamconroy wrote: post #63

I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).

SSL stripping perhaps? There are still plenty of sites that don't implement HSTS, and not all users are vigilant enough to notice when the site they're visiting suddenly doesn't have HTTPS anymore.

Web security has been improving a lot in recent years, but it's not yet at the point where a man in the middle isn't a relevant threat.

Re: Found hooked up to my router

#84

Post by stordoff »

adamconroy wrote: post #72
krn wrote: post #68

Earlier quoted context omitted.

What about DNS spoofing[1] at the local network level? [1] https://en.wikipedia.org/wiki/DNS_spoofing

it might redirect to a malicious web page, but https would still prevent a problem. perhaps read the article you posted.

Only if they are serving HTTPS or HTTPS is pinned. Otherwise, aren't you relying on the user noticing the lack of HTTPS (which I wouldn't want to do)?

Re: Found hooked up to my router

#85

Post by krn »

adamconroy wrote: post #72
krn wrote: post #68

Earlier quoted context omitted.

What about DNS spoofing[1] at the local network level? [1] https://en.wikipedia.org/wiki/DNS_spoofing

it might redirect to a malicious web page, but https would still prevent a problem. perhaps read the article you posted.

The user can just be redirected to another similar looking site with a valid TLS certificate.

Re: Found hooked up to my router

#86

Post by tedunangst »

daveFNbuck wrote: post #60
petemill wrote: post #45

Whilst it's certainly a scam to do with advertising [0], I doesn't look like there's any evidence that the scam has anything to do with 'stealing' anything from network / network traffic: > Facebook has several mechanisms in place to protect your account. We make every attempt to work within the these constraints. In order to keep your account from being locked we use a small device called a Raspberry Pi. This device…

The first comment in the thread you link to says the Raspberry Pi connects to botnets and records all network traffic.

> It records EVERY KEYSTROKE sent of the network, even SSL connection.

One wonders how it does that.

Re: Found hooked up to my router

#87

Post by tedunangst »

krn wrote: post #85
adamconroy wrote: post #72

Earlier quoted context omitted.

it might redirect to a malicious web page, but https would still prevent a problem. perhaps read the article you posted.

The user can just be redirected to another similar looking site with a valid TLS certificate.

How?

Re: Found hooked up to my router

#88

Post by Ajedi32 »

adamconroy wrote: post #82
jeffmcjunkin wrote: post #75

Earlier quoted context omitted.

It could use something like bdfproxy[1] to intercept HTTP-downloaded EXE files, then add some persistent malware in _addition_ to whatever the EXE was doing. This has been done before, over Tor[2]. The malware doesn't have to add a new root certificate, either, though that's completely possible. The Zeus trojan [3] does "man-in-the-browser" to intercept banking information, for example. [1] https://github.com/secrets…

so the spoofer distributing these devices is going to all this trouble/expense/risk in the hope there is a http downloaded exe it can corrupt, then hopes the hashing doesn't fail on that corrupt exe, and hopes the user ignores the untrusted source warning so that it can install a trojan?

How many users do you know of who manually check hashes on downloaded executables?

And of course the user is going to ignore the untrusted source warning on an executable they intentionally downloaded and are trying to run.

Re: Found hooked up to my router

#89

Post by tedunangst »

swiftcoder wrote: post #81
p49k wrote: post #70

Earlier quoted context omitted.

The spoofer wouldn’t be able to obtain a valid certificate for the spoofed site, though.

The spoofer can obtain a valid certificate for another, seemingly legitimate site. Any software that hasn't explicitly pinned the leaf TLS certificates will still accept the (valid) certificate it is redirected to. And sadly, a lot of software still doesn't perform certificate pinning.

How is this redirect performed?

Re: Found hooked up to my router

#90

Post by empath75 »

adamconroy wrote: post #63

I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).

What are the odds that someone dumb enough to install this would be scared off by an insecure site warning?
Post reply on HN