Can someone post the image here? I have blocked reddit on my phone.
Found hooked up to my router
271–280 of 358 posts
Re: Found hooked up to my router
#272Earlier quoted context omitted.
isnt that a NAS basically?
A consumer (i.e. workplace for people who don't know better) NAS is usually Linux with a few hard drives attached via a cheerful and brightly coloured web UI - occasionally useful, some way short of secure. I expect someone sells hardened ultra-secure corporate NAS boxes, but I've never seen any in the wild.
The trouble is, the sort of people who would buy a pre-hardened NAS are also the sort of people who would be suspicious of a pre-built unit. I know for sure I wouldn't trust anything off the shelf, I'd take the base OS and build something around it.
Whoops, my tin-foil hat appears to have slipped.
Re: Found hooked up to my router
#273Earlier quoted context omitted.
At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.
I was at a financial software firm that dealt with USB security issues by filling the USB sockets with epoxy. The keyboard and mouse could not be removed from their USB sockets as they were held in place with a metal collar bolted to the case. Simple and effective, although it destroyed any resale value of the PCs.
Do businesses (other than super small startups) actually sell their old hardware? Genuinely curious.
Re: Found hooked up to my router
#274Earlier quoted context omitted.
I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?
Well for starters, if you’re curiously plugging it in, you’re going to mount it aren’t you? Second, it can emulate an HID keyboard device and type keystrokes faster than you can react and pull it out, at which point it’s far too late - it’s pulled a secondary payload down or mounted a USB mass storage device and you’re owned.
You got me at the emulate a keyboard thing. Now I’m thinking that you shouldn’t plug strange keyboards or mice in because they could have an onboard payload. The crash cart at a data center is kind of a dumb idea in a way except the place is full of cameras usually
Re: Found hooked up to my router
#275Earlier quoted context omitted.
This is why I keep a large supply of "USB Condoms" (little dongles that short circuit the data, and allow charging/power only)
Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.
You still need to hook up stuff to a computer - mice, keyboards, those weird 3D-mice our CAD people use, printers, and these days even displays are all attached to USB ports. And since the ports USB replaces have mostly gone, there is little alternative left.
At work, we keep a couple of power-socket-to-USB chargers around, if people want to charge their smartphone they can grab one. But simply disabling the USB ports on our users machines is not a realistic option at this point.
Re: Found hooked up to my router
#276Earlier quoted context omitted.
I'm disappointed that's not a real website
Of course it's not real. Its a subdomain of chase.com. Parent should've said something like chase.evil.com.
If the user hasn't visited the subdomain evil.chase.com yet, a http downgrade attack (https://news.ycombinator.com/item?id=18090419) would maybe work.
Re: Found hooked up to my router
#277Earlier quoted context omitted.
Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.
If the site is non-SSL, then there's nothing stopping somebody in control of the network from replacing all "password" fields with plain "text" fields, and then applying a custom font to them so every character entered is displayed as a "•"
That's basically what a password field already is. That would make no difference to anything - the password would be sent over the network in exactly the same way either way.
Re: Found hooked up to my router
#278Earlier quoted context omitted.
Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.
Do they? I don't think so... Try http://login.ebiquity.com Do you see any warnings in your browser? I see no warnings in Chrome.
Chrome changes the "Not secure" in the address bar from grey to red (and displays a red explamation mark symbol there) when data is entered into the form.
Re: Found hooked up to my router
#279Earlier quoted context omitted.
My college used to do similar. If you did not register your MAC address, you would be DHCP assigned into a walled-garden IP block. We found we could run an IP scanner on the authorized subnet (from a computer with a whitelisted MAC), and find the unused IPs, and just set those statically for 'visitors'. No need to register any more MAC addresses.
Out of curiosity, you couldn’t just guess them based on knowing a couple? Or do people assigning them in some fashion that isn’t consecutive within the block?
yeah, definitely not consecutive.
Re: Found hooked up to my router
#280Earlier quoted context omitted.
Trouble is that the same corporation has the following additional policies: * A ban on mail attachments of certain types (excel, zip files...) * mailbox limits from the 1990’s (100MB or so) * a ban on Dropbox, Gdrive or any other file sharing service * No public facing sftp or similar * A web site so mired in red tape that it takes 6 months and a dozen approvals to get anything uploaded. Often the USB drive or someth…
It seems the problem is bad corporate file sharing policies that are incorrectly validated as successful because the employees are using workarounds rather than pointing out its inadequacies.
Welcome to the real world! :)
I have seen this kind of situation, too. It sucks, but if you play by the corporate rulebook and lobby for better rules, you will be either worn out or retired by the time those rules get updated.