Earlier quoted context omitted.
Epoxy can't break with a security update
you could warm it up and pick it out when soft though
Not if it's the right kind of epoxy...
Found hooked up to my router
301–310 of 358 posts
Re: Found hooked up to my router
#302One comment in that thread[1] gives a full explanation of what such a Raspberry Pi device hooked up to the router can do: forward all the network traffic, replace router's stock firmware with its own, install software on the network connected devices via known vulnerabilities, spoof websites by acting as custom DNS server. In my opinion, it looks like "a Pi-hole[2], but for phishing". [1] https://www.reddit.com/r/wha…
It's amazing how many people forget that Raspbian is still Linux under all the Wolfram and Raspberry Pi stuff. So you essentially have a tiny computer that can be plugged into almost anything you can program for.
Keep in mind that all modern routers are also tiny computers running a Unix variant like busybox. They can run arbitrary programs and they’re connected to everything you have by default.
Re: Found hooked up to my router
#303Earlier quoted context omitted.
At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.
So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…
It's a pentesting technique, used to assess the level of effectiveness of user training.
While your final comment is accurate, it is impractical as usb mass storage is still required in many places. Also, you can't effectively block HID, and an attacker can use HID disguised as or in a thumb drive to successfully attack a network.
Re: Found hooked up to my router
#304Earlier quoted context omitted.
>Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Yes, everything SHOULD be like this. I should be able to trust my neighbors and leave my doors unlocked as well, and I should be able to have faith in my elected officials. And yet... The other issue is that you can connect to a website that implements HTTPS correctly, and still be borked if that site does…
Perfectly valid cert how? Assuming no theft of a chase private key.
Perfectly valid cert for the evil.com domain - someone below pointed out that I flipped the domain names.
In reality the "evil" page would look something like "https://www.login.chase/login?id=DEADBEEF/.evil.com". For a non-trivial number of users, that's enough - "I see the nice green lock, I see chase, and some crazy web address characters that are always there".
Re: Found hooked up to my router
#305Earlier quoted context omitted.
Do they? I don't think so... Try http://login.ebiquity.com Do you see any warnings in your browser? I see no warnings in Chrome.
Chrome changes the "Not secure" in the address bar from grey to red (and displays a red explamation mark symbol there) when data is entered into the form.
Which version/OS? I have the latest Chrome (69.0.3497.100) on macOS 10.13.3, and I see no red exclamation mark. Nothing changes or warns me at all when I start entering data in the fields.
Maybe you have a browser extension, or setting turned on that I'm missing?
Re: Found hooked up to my router
#306Earlier quoted context omitted.
There's a little "not secure" at the top in Chrome, something most users will simply ignore.
Not so little when the user is also typing into a password field
I can imagine an HN commenter scrutinizing things when encountering that warning, but it's not very actionable for anyone else.
"Ah, okay, it's not so secure, whatever that means... but I still want to login and do what I set out to do."
Re: Found hooked up to my router
#307It seems like they're fishing for gullible Facebook users on Craigslist. I found an example of a Craigslist posting that tries to "rent" your Facebook profile:
Re: Found hooked up to my router
#308Earlier quoted context omitted.
Perfectly valid cert how? Assuming no theft of a chase private key.
Perfectly valid cert for the evil.com domain - someone below pointed out that I flipped the domain names. In reality the "evil" page would look something like " https://www.login.chase/login?id=DEADBEEF/.evil.com" . For a non-trivial number of users, that's enough - "I see the nice green lock, I see chase, and some crazy web address characters that are always there".
Huh? "https://www.login.chase/login?id=DEADBEEF/.evil.com" wouldn't go to evil.com, it would go to login.chase. "chase" is the TLD of that URI.
Unless you're doing something super clever with characters that I'm not understand, that's not how urls work. ".evil.com" is clearly part of the query parameter.
Re: Found hooked up to my router
#309Is a disk image of one of these available anywhere? I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server. Plugging a device into your network doesn't make it magically see all the traffic. It would…
Well if they are willing to break TOS to sell ads on facebook how much further do you need to go to rationalize auth capture, rootkit injection or any other malicious activity.
"Plugging in the device on your network doesn't make it magically see all of the traffic" ... Assuming it has not been constructed to do all of the things you list (or more) does not magically make it not see all of your traffic either. There is no magic involved, it is either constructed to capture/inject or not -- the only way to know is to review the actual bits and firmware.
Re: Found hooked up to my router
#310It seems like they're fishing for gullible Facebook users on Craigslist. I found an example of a Craigslist posting that tries to "rent" your Facebook profile: https://image.ibb.co/dzT9j9/rent_facebook.png
My guess would be either a MITM auth capture, rootkit inject or someone (even a nation state) trying to attribute sources of illicit facebook ads/posts to unsuspecting citizens.
I would not touch that with a 10 foot pole.