Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

201–210 of 358 posts

Re: Found hooked up to my router

#201

Post by Falkon1313 »

nixpulvis wrote: post #104
qualsiasi wrote: post #30

If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.

This is why, as much as I hate it most of the time, it's a good idea not to have your devs with access to your network setup. If your a small shop, limit the access as much as reasonably possible.

Emphasis on reasonable. If you limit workers' access too much for them to do their jobs they will find creative workarounds. Some of those can be more dangerous than just giving them the access that they need in a way that you control. Examples being if you make it so that the only way developers can debug a system is by adding in backdoors, or if you lock down the network so much that they need to use an unsecured public network to do their work. I've seen those things happen. Developers and IT need to work together, not be adversaries.

Re: Found hooked up to my router

#202

Post by acct1771 »

Merad wrote: post #181
sjwright wrote: post #167

Earlier quoted context omitted.

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…

I don't think I've ever heard of a company that actually does this in practice. I suspect it ends up simply being more trouble than it's actually worth. I know at that company the list of approved device would probably end up being dozens of pages long... and yeah, thumb drives and USB hard drives were used a decent amount, especially outside of IT.

Anecdote for anecdote, I have.

Re: Found hooked up to my router

#203

Post by sjwright »

Merad wrote: post #181
sjwright wrote: post #167

Earlier quoted context omitted.

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…

I don't think I've ever heard of a company that actually does this in practice. I suspect it ends up simply being more trouble than it's actually worth. I know at that company the list of approved device would probably end up being dozens of pages long... and yeah, thumb drives and USB hard drives were used a decent amount, especially outside of IT.

Maybe someone needs to invent a USB-based thumb drive reader that only allows generic mass storage devices to be attached but does not work as a hub, rather as a proxy device.

Bonus points: don't mount the drive directly, instead connect it to a centralised server on the corporate network that scans for threats and mounts a sanitised version of the drive's contents as a network share.

Triple word score: audit everything contained on every drive and everything that is copied on and off.

Sell that for $200 per unit to Fortune 500 companies and paranoid government agencies worldwide... and you'll retire early.

Re: Found hooked up to my router

#204

Post by mr_toad »

sjwright wrote: post #167
Merad wrote: post #106

Earlier quoted context omitted.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…

Trouble is that the same corporation has the following additional policies:

* A ban on mail attachments of certain types (excel, zip files...) * mailbox limits from the 1990’s (100MB or so) * a ban on Dropbox, Gdrive or any other file sharing service * No public facing sftp or similar * A web site so mired in red tape that it takes 6 months and a dozen approvals to get anything uploaded.

Often the USB drive or something similar is the only way for employees to actually do their jobs.

Re: Found hooked up to my router

#205

Post by sjwright »

mr_toad wrote: post #204
sjwright wrote: post #167

Earlier quoted context omitted.

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…

Trouble is that the same corporation has the following additional policies: * A ban on mail attachments of certain types (excel, zip files...) * mailbox limits from the 1990’s (100MB or so) * a ban on Dropbox, Gdrive or any other file sharing service * No public facing sftp or similar * A web site so mired in red tape that it takes 6 months and a dozen approvals to get anything uploaded. Often the USB drive or someth…

It seems the problem is bad corporate file sharing policies that are incorrectly validated as successful because the employees are using workarounds rather than pointing out its inadequacies.

Re: Found hooked up to my router

#206

Post by jugg1es »

hguant wrote: post #186
amckinlay wrote: post #115

Earlier quoted context omitted.

I still don't understand how this device could steal login details. Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

>Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Yes, everything SHOULD be like this. I should be able to trust my neighbors and leave my doors unlocked as well, and I should be able to have faith in my elected officials. And yet... The other issue is that you can connect to a website that implements HTTPS correctly, and still be borked if that site does…

I'm disappointed that's not a real website

Re: Found hooked up to my router

#207

Post by stef25 »

Pxtl wrote: post #171
Zee2 wrote: post #168

Earlier quoted context omitted.

Which would capture passwords in plaintext sent from the user side, no?

Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.

There's a little "not secure" at the top in Chrome, something most users will simply ignore.

Re: Found hooked up to my router

#208

Post by mr_toad »

marssaxman wrote: post #158
code4tee wrote: post #98

In the days when USB sticks were more common it was an easy tactic for someone to drop one in a company parking lot labeled “salary data” and with almost certainty that thing would get plugged into a device on the corporate network. The biggest security vulnerability in most cases is still users doing dumb things.

Have USB sticks stopped being common...? I'd guess there are a dozen or two around my house right now.

Many people have started using cloud services for private file sharing. But corporations often ban their use, so employees resort to USB devices.

Re: Found hooked up to my router

#209

Post by sjwright »

throwaway0255 wrote: post #198
sjwright wrote: post #167

Earlier quoted context omitted.

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…

The computer security industry for SMBs is like 95% theater and 5% actual practice. Conducting that test produced something tangible for whoever made the purchasing decision: It clearly illustrated a need for the services rendered, did it in a way that offered job security to management by giving them license to assert the position over their subordinates, and established a metric by which to evaluate the security co…

> The computer security industry for SMBs is like 95% theater and 5% actual practice.

I'd say it's 40% paranoid arse-covering by IT department heads, 35% whatever middle management incorrectly assumes to be current best practices, 20% ego-stroking by the CIO, and 5% sensible context-driven decision-making by IT front-line staff.

Re: Found hooked up to my router

#210

Post by ardy42 »

kupiakos wrote: post #195
confounded wrote: post #178

Earlier quoted context omitted.

The box controls the DNS; majorwebsite.com points to any sever the attacker likes. The only defense is HSTS/certificate-pinning, for sites previously visited with that browser & device (it’s a TOFU security model). HN has HSTS, but not Reddit, or my credit union, or my local pizza place, or Kaiser Permanente, etc. etc. etc. EDIT: I believe e.g. Chrome and Firefox bake in some major certificates, which would also like…

That's assuming the box can generate certificates trusted by the target machines - there's a reason the CN field exists.

> That's assuming the box can generate certificates trusted by the target machines - there's a reason the CN field exists.

If you're dumb enough to install one of these boxes on your network, you might also be dumb enough to install an attacker-provided root certificate on your PC.

Post reply on HN