Found hooked up to my router • Hacker News Board

Re: Found hooked up to my router

#241

Post by eponeponepon » Fri, Sep 28, 2018, 8:16 AM UTC

alangpierce wrote: post #159

mjevans wrote: post #131

Earlier quoted context omitted.

Pick your favorite windows 0-day and use it to only install a cert and nothing else that would tip off AV software.

Are Windows 0-days really that common? I thought they were usually saved for really serious attacks, e.g. from state-sponsored actors, not scams on the level of "pay some random person $15 a month to attach a mysterious device to their router".

I can't answer your question authoritatively, but there are plenty of organised criminal enterprises in the world with state-level resources.

Re: Found hooked up to my router

#242

Post by westpfelia » Fri, Sep 28, 2018, 8:22 AM UTC

jugg1es wrote: post #206

hguant wrote: post #186

Earlier quoted context omitted.

>Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Yes, everything SHOULD be like this. I should be able to trust my neighbors and leave my doors unlocked as well, and I should be able to have faith in my elected officials. And yet... The other issue is that you can connect to a website that implements HTTPS correctly, and still be borked if that site does…

I'm disappointed that's not a real website

It is a real website he just got the URL wrong. Its supposed to be https://www.chase.com/

Re: Found hooked up to my router

#243

Post by mrhackerpoland » Fri, Sep 28, 2018, 8:23 AM UTC

My roommate received this device too.

Having observed its activity. It doesn't steal any data.

It simply setups a ssh dynamic tunnel and uses your network IP for accessing your Facebook account which you sold.

Why? Because Fb locks the account the moment it's accessed from a different network from a different device.

Can it steal your data? Absolutely yes! Does it steal? Probably no.

Afaik, all they want is your fb account for which they pay you.

Re: Found hooked up to my router

#244

Post by mijowi » Fri, Sep 28, 2018, 8:29 AM UTC

jugg1es wrote: post #206

hguant wrote: post #186

Earlier quoted context omitted.

>Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Yes, everything SHOULD be like this. I should be able to trust my neighbors and leave my doors unlocked as well, and I should be able to have faith in my elected officials. And yet... The other issue is that you can connect to a website that implements HTTPS correctly, and still be borked if that site does…

I'm disappointed that's not a real website

Of course it's not real. Its a subdomain of chase.com. Parent should've said something like chase.evil.com.

Re: Found hooked up to my router

#245

Post by TheOtherHobbes » Fri, Sep 28, 2018, 8:29 AM UTC

thecatspaw wrote: post #220

sjwright wrote: post #203

Earlier quoted context omitted.

Maybe someone needs to invent a USB-based thumb drive reader that only allows generic mass storage devices to be attached but does not work as a hub, rather as a proxy device. Bonus points: don't mount the drive directly, instead connect it to a centralised server on the corporate network that scans for threats and mounts a sanitised version of the drive's contents as a network share. Triple word score: audit everyth…

isnt that a NAS basically?

A consumer (i.e. workplace for people who don't know better) NAS is usually Linux with a few hard drives attached via a cheerful and brightly coloured web UI - occasionally useful, some way short of secure.

I expect someone sells hardened ultra-secure corporate NAS boxes, but I've never seen any in the wild.

Re: Found hooked up to my router

#246

Post by westpfelia » Fri, Sep 28, 2018, 8:30 AM UTC

lachlan-sneff wrote: post #121

cobbzilla wrote: post #110

Earlier quoted context omitted.

No, iirc stuxnet spread itself without anyone physically leaving a USB stick anywhere. On a system infected via the network, it would try to infect any USB drives connected to the system.

Stuxnet is fascinating. Still, as far as I can tell, the most complex, interesting malware ever found in the wild. I believe it's unclear how stuxnet found its way into the enrichment facilities.

It probably got in via usb in the parking lot, but there hasn't been an official statement that I know of. It was confirmed that the hack into the DHS intranet was done by USB stick in the parking lot.

Re: Found hooked up to my router

#247

Post by SmellyGeekBoy » Fri, Sep 28, 2018, 8:39 AM UTC

I'd understand why someone would be tempted to install something like this for $1500... Maybe even $150. But $15!? If you're that desperate why not get 3 friends to donate $5 each or something? I'm sure they'd understand if it was truly life-or-death.

Re: Found hooked up to my router

#248

Post by SmellyGeekBoy » Fri, Sep 28, 2018, 8:48 AM UTC

hohenheim wrote: post #231

planb wrote: post #218

This is overblown, isn't it? That thing can't do anything that a public wifi couldn't, and yet everyone connects their laptops to those without hassle. SSL is nearly everywhere now...

There is a big difference though. This thing can actually act as an agent in a botnet that could be used for lot of things, such as DDOS'ng.

Who's to say that the public wifi you're connecting to doesn't have one of these things attached?

Re: Found hooked up to my router

#249

Post by achairapart » Fri, Sep 28, 2018, 8:51 AM UTC

Pxtl wrote: post #171

Zee2 wrote: post #168

Earlier quoted context omitted.

Which would capture passwords in plaintext sent from the user side, no?

Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.

> so this was a linked comment from a thread 3 years ago....

While major websites already were on SSL, a lot of websites didn't and there were no browser warnings yet.

Re: Found hooked up to my router

#250

Post by SmellyGeekBoy » Fri, Sep 28, 2018, 8:52 AM UTC

dingaling wrote: post #239

paultopia wrote: post #21

Earlier quoted context omitted.

For serious. the kind of idiot who would hand over facebook credentials, bank account info, and physical network access for fifteen bucks a month to a total rando is also the kind of idiot who will dig up their roommate's social security card to help them out when the nice person from the IRS calls about back taxes.

I'd quite happily pimp out my unused fake Facebook profile for $15. Lock the 'device' into its own subnetted VLAN so it can't see any local traffic and it's easy money paid into a deposit-only savings account...

How do you know that your router doesn't have a 0day that allows them to escape the VLAN?