Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

91–100 of 358 posts

Re: Found hooked up to my router

#91

Post by pluc »

Ajedi32 wrote: post #88
adamconroy wrote: post #82

Earlier quoted context omitted.

so the spoofer distributing these devices is going to all this trouble/expense/risk in the hope there is a http downloaded exe it can corrupt, then hopes the hashing doesn't fail on that corrupt exe, and hopes the user ignores the untrusted source warning so that it can install a trojan?

How many users do you know of who manually check hashes on downloaded executables? And of course the user is going to ignore the untrusted source warning on an executable they intentionally downloaded and are trying to run.

I think what he means is that it seems like a lot of trouble to hack someone who is not necessarily hackworthy? Like what kind of things would you expect to gain from someone who would be as computer illiterate as to allow all that to come to fruition?

Re: Found hooked up to my router

#92

Post by stordoff »

PhantomGremlin wrote: post #34
tedunangst wrote: post #9

Earlier quoted context omitted.

Yeah, I have no idea how it could accomplish what is alleged. Just lots of very bad no good end of world comments. Have none of these people ever used public wifi?

Have none of these people ever used public wifi? This situation is totally totally unlike public wifi! When I connect to public wifi, the attack surface into my laptop is the external interface of the latest MacOS, with firewall on. Perhaps there are exploits against that, but they're not common. The Mac does have pf, but I'm sure it's a way out of date version! :) OTOH, "this thing" on the inside of a router/firewal…

> Am I supposed to strictly segment everything?

To be honest, I found that easier than prudence and caution. New access point, stick all my IoT devices on there, then I don't have to particularly worry about what they are doing, they can't access anything interesting anyway (no outbound traffic, inbound traffic is only allowed from one device on my LAN).

Re: Found hooked up to my router

#93

Post by empath75 »

quickthrower2 wrote: post #36

Interesting that it is "worth" $15/month. Maybe they were never going to pay up. But if they were, that seems expensive when they could just use compromised PCs and devices for ... whatever they are going to do? Plus they had to buy and supply the dongle.

What are the odds they got paid?

Re: Found hooked up to my router

#94

Post by ktta »

tedunangst wrote: post #87
krn wrote: post #85

Earlier quoted context omitted.

The user can just be redirected to another similar looking site with a valid TLS certificate.

How?

https://gmail.com.inbox-redirect.pro

This will seem like a valid website, especially if the phishing site is done well. Not just non-technical users, I'd wager some tech familiar users would be fooled too.

The focus always being on the lock icon might not always cover it.

Safari will prevent this though.

Re: Found hooked up to my router

#95

Post by ktta »

tedunangst wrote: post #89
swiftcoder wrote: post #81

Earlier quoted context omitted.

The spoofer can obtain a valid certificate for another, seemingly legitimate site. Any software that hasn't explicitly pinned the leaf TLS certificates will still accept the (valid) certificate it is redirected to. And sadly, a lot of software still doesn't perform certificate pinning.

How is this redirect performed?

When a URL is manually typed in, and HSTS or HSTS-preloading isn't enabled, the initial 301 redirect would be http.

Re: Found hooked up to my router

#96

Post by [deleted] »

swiftcoder wrote: post #81
p49k wrote: post #70

Earlier quoted context omitted.

The spoofer wouldn’t be able to obtain a valid certificate for the spoofed site, though.

The spoofer can obtain a valid certificate for another, seemingly legitimate site. Any software that hasn't explicitly pinned the leaf TLS certificates will still accept the (valid) certificate it is redirected to. And sadly, a lot of software still doesn't perform certificate pinning.

[deleted]

Re: Found hooked up to my router

#97

Post by dlubarov »

tedunangst wrote: post #89
swiftcoder wrote: post #81

Earlier quoted context omitted.

The spoofer can obtain a valid certificate for another, seemingly legitimate site. Any software that hasn't explicitly pinned the leaf TLS certificates will still accept the (valid) certificate it is redirected to. And sadly, a lot of software still doesn't perform certificate pinning.

How is this redirect performed?

It could just be a 3xx redirect over clear http, right? The http site can redirect to a https site with a similar name.

Re: Found hooked up to my router

#98

Post by code4tee »

In the days when USB sticks were more common it was an easy tactic for someone to drop one in a company parking lot labeled “salary data” and with almost certainty that thing would get plugged into a device on the corporate network. The biggest security vulnerability in most cases is still users doing dumb things.

Re: Found hooked up to my router

#100

Post by abraham_lincoln »

dev_dull wrote: post #79
abraham_lincoln wrote: post #62

Earlier quoted context omitted.

My college used to do similar. If you did not register your MAC address, you would be DHCP assigned into a walled-garden IP block. We found we could run an IP scanner on the authorized subnet (from a computer with a whitelisted MAC), and find the unused IPs, and just set those statically for 'visitors'. No need to register any more MAC addresses.

I doubt they were very concerned with you or your friends. 80/20 solutions.

Only had problems when a classmate was running routed.

Oh, and all authorized IPs were in a public address space.

Post reply on HN