Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

141–150 of 358 posts

Re: Found hooked up to my router

#141

Post by [deleted] »

Pxtl wrote: post #138
browsercoin wrote: post #119

> I have a Raspberry Pi right now in my hands fron rentyouraccont.com, i have it running diagnostics on an Air-Gapped pc. This thing is wild. Every second it tries to connect to bot-net programs. It not only buys ads on facebook (which btw i cannot find code that it actually does this) but it is creating links to malware ridden embeds. It is part of a Botnet, i can say for sure. Every second it tries to establish a c…

How is that even possible? How does it capture keystrokes (unless you mean Google searches where each key is sent for autocomplete). How does it break SSL?

[deleted]

Re: Found hooked up to my router

#142

Post by swiley »

walrus01 wrote: post #37
z3t4 wrote: post #27

Besides malicious intends and security disasters. These mini-servers could be used for all kind of cool decentralized "self-hosted" services.

a completely legitimate and valuable network engineering resource is run by RIPE using small devices running openwrt: https://atlas.ripe.net/landing/probes-and-anchors/ a RIPE atlas probe is a small tp-link device that needs a LAN port on your network and USB power. It forms a vpn back to RIPE, and uses traffic outbound via the default gateway it gets via DHCP to reports metrics like uptime, latency to various destin…

I've had one of these running forever... I should go check and see what sorts of queries I'm allowed to run on the collected data at this point.

Re: Found hooked up to my router

#143

Post by illumin8 »

badwolf wrote: post #123
eponeponepon wrote: post #117

Earlier quoted context omitted.

Anecdotally, I heard of a toy radio control quadcopter belonging to western military personnel in Afghanistan that turned out to be trying to phone home to ${badguy} when they plugged it into a laptop to charge. This stuff is everywhere, and has been for years.

This is why I keep a large supply of "USB Condoms" (little dongles that short circuit the data, and allow charging/power only)

Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.

Re: Found hooked up to my router

#144

Post by krn »

Pxtl wrote: post #138
browsercoin wrote: post #119

> I have a Raspberry Pi right now in my hands fron rentyouraccont.com, i have it running diagnostics on an Air-Gapped pc. This thing is wild. Every second it tries to connect to bot-net programs. It not only buys ads on facebook (which btw i cannot find code that it actually does this) but it is creating links to malware ridden embeds. It is part of a Botnet, i can say for sure. Every second it tries to establish a c…

How is that even possible? How does it capture keystrokes (unless you mean Google searches where each key is sent for autocomplete). How does it break SSL?

I think that by "every keystroke" he meant "every network packet".

Re: Found hooked up to my router

#145

Post by [deleted] »

Pxtl wrote: post #138
browsercoin wrote: post #119

> I have a Raspberry Pi right now in my hands fron rentyouraccont.com, i have it running diagnostics on an Air-Gapped pc. This thing is wild. Every second it tries to connect to bot-net programs. It not only buys ads on facebook (which btw i cannot find code that it actually does this) but it is creating links to malware ridden embeds. It is part of a Botnet, i can say for sure. Every second it tries to establish a c…

How is that even possible? How does it capture keystrokes (unless you mean Google searches where each key is sent for autocomplete). How does it break SSL?

[deleted]

Re: Found hooked up to my router

#146

Post by goldenCeasar »

ravenstine wrote: post #111
Merad wrote: post #106

Earlier quoted context omitted.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

That's shocking. I know people are dopey, but 50%? I'd have guessed 20% at most.

I would guess that some people may try more than one, or if there are lots of people and few thumbs given time someone more gullible will try them.

Re: Found hooked up to my router

#147

Post by Reelin »

stordoff wrote: post #92
PhantomGremlin wrote: post #34

Earlier quoted context omitted.

Have none of these people ever used public wifi? This situation is totally totally unlike public wifi! When I connect to public wifi, the attack surface into my laptop is the external interface of the latest MacOS, with firewall on. Perhaps there are exploits against that, but they're not common. The Mac does have pf, but I'm sure it's a way out of date version! :) OTOH, "this thing" on the inside of a router/firewal…

> Am I supposed to strictly segment everything? To be honest, I found that easier than prudence and caution. New access point, stick all my IoT devices on there, then I don't have to particularly worry about what they are doing, they can't access anything interesting anyway (no outbound traffic, inbound traffic is only allowed from one device on my LAN).

> they can't access anything interesting anyway

A "smart" TV is presumably running content ID on everything that shows up on its screen, a fitness tracker is (of necessity) monitoring your physical activity, ... you get the picture.

I'm not paranoid that someone is tracking me in particular, or even that they would find anything interesting if they did (I'm really pretty boring in the greater scheme of things). Rather, not knowing what is being collected, by who, where it is stored, how long it is retained for, what metadata is attached to it, if their database has been (or is likely to be) breached, etc, means that there's no way for me to confidently assess what my future risks might be. Keep in mind that anonymous data often isn't so anonymous (https://en.wikipedia.org/wiki/De-anonymization).

At this point, something not being an IoT device is a major selling point for me.

Re: Found hooked up to my router

#148

Post by scroot »

haimez wrote: post #129
lachlan-sneff wrote: post #121

Earlier quoted context omitted.

Stuxnet is fascinating. Still, as far as I can tell, the most complex, interesting malware ever found in the wild. I believe it's unclear how stuxnet found its way into the enrichment facilities.

It did contain a USB device exploit delivering a dropper with a completely separate payload specifically targeted at the Natanz facility. A compromised USB device picked up in the parking lot would do the trick, but there are certainly other ways to get something through the front door and that information is unlikely to be public knowledge any time soon.

I likely got the "parking lot" impression from Alex Gibney's Zero Days, but it's been a few years since that came out.

Re: Found hooked up to my router

#149

Post by 3rdAccount »

Merad wrote: post #106
qualsiasi wrote: post #30

If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

A lot of IT security teams do this. On one side it is depressing, but on another side it is annoying to have to hear them talk about it every staff meeting. All companies seem to have people with zero understanding of computers and will fall for anything. I wonder how effective the education is. I guess if it prevents one attack it can pay for itself.

Re: Found hooked up to my router

#150

Post by colejohnson66 »

illumin8 wrote: post #143
badwolf wrote: post #123

Earlier quoted context omitted.

This is why I keep a large supply of "USB Condoms" (little dongles that short circuit the data, and allow charging/power only)

Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.

Wouldn’t everything then only charge at 100 mA?
Post reply on HN