Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

321–330 of 358 posts

Re: Found hooked up to my router

#321

Post by SamBam »

notriddle wrote: post #320
SamBam wrote: post #308

Earlier quoted context omitted.

Huh? " https://www.login.chase/login?id=DEADBEEF/.evil.com" wouldn't go to evil.com, it would go to login.chase. "chase" is the TLD of that URI. Unless you're doing something super clever with characters that I'm not understand, that's not how urls work. ".evil.com" is clearly part of the query parameter.

Assuming they're not doing anything weird with Unicode, the evil pi is probably running its own DNS server, intercepting the traffic intended for normal DNS, and basically creating its own TLD the same way you would normally do localdomain. The evil.com part is redundant.

Sure, that's a totally different scenario than tricky-looking urls.

Re: Found hooked up to my router

#322

Post by yjftsjthsd-h »

3rdAccount wrote: post #149
Merad wrote: post #106

Earlier quoted context omitted.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

A lot of IT security teams do this. On one side it is depressing, but on another side it is annoying to have to hear them talk about it every staff meeting. All companies seem to have people with zero understanding of computers and will fall for anything. I wonder how effective the education is. I guess if it prevents one attack it can pay for itself.

> it is annoying to have to hear them talk about it every staff meeting

Aren't you shooting the messenger?

Re: Found hooked up to my router

#323

Post by daveloyall »

cesarb wrote: post #287
colejohnson66 wrote: post #150

Earlier quoted context omitted.

Wouldn’t everything then only charge at 100 mA?

No, shorting the data pins signals "this is a charger, you can charge as fast as you want, until it's so much current that the voltage starts to drop too much".

Except when the device is designed to prefer chargers from $vendor. LG was notorious for this some years back.

Re: Found hooked up to my router

#324

Post by closetohome »

wstuartcl wrote: post #309
tonyb wrote: post #293

Is a disk image of one of these available anywhere? I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server. Plugging a device into your network doesn't make it magically see all the traffic. It would…

Well if they are willing to break TOS to sell ads on facebook how much further do you need to go to rationalize auth capture, rootkit injection or any other malicious activity. "Plugging in the device on your network doesn't make it magically see all of the traffic" ... Assuming it has not been constructed to do all of the things you list (or more) does not magically make it not see all of your traffic either. There…

Well personally I do see a small distinction between breaking a corporate TOS and felony unauthorized network access.

Re: Found hooked up to my router

#325

Post by closetohome »

SamBam wrote: post #308
hguant wrote: post #304

Earlier quoted context omitted.

Perfectly valid cert for the evil.com domain - someone below pointed out that I flipped the domain names. In reality the "evil" page would look something like " https://www.login.chase/login?id=DEADBEEF/.evil.com" . For a non-trivial number of users, that's enough - "I see the nice green lock, I see chase, and some crazy web address characters that are always there".

Huh? " https://www.login.chase/login?id=DEADBEEF/.evil.com" wouldn't go to evil.com, it would go to login.chase. "chase" is the TLD of that URI. Unless you're doing something super clever with characters that I'm not understand, that's not how urls work. ".evil.com" is clearly part of the query parameter.

This seems...a little unnecessarily pedantic. It's an example of a well-known URL obfuscation technique -- we all understood what he meant.

Re: Found hooked up to my router

#326

Post by nsgi »

implying wrote: post #162
ttty wrote: post #155

Earlier quoted context omitted.

For example you can go to my http://website.com now the normal website has a HTTPS redirect on home page. Your router replaces that page and disables the redirect. Now is up to you to notice you're on a http connection. If you think is rare, I can tell you some fortune 500 FX and stocks trading have this vulnerability a year ago (didn't checked again).

This is why certificate pinning and modern web security practices are so important. On a well configured site, this attack would fail.

HSTS and Certificate Transparency, yes. Certificate Pinning is too easy to shoot yourself in the foot with, so it should only be considered for the most sensitive sites.

Re: Found hooked up to my router

#327

Post by sfoley »

tonyb wrote: post #293

Is a disk image of one of these available anywhere? I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server. Plugging a device into your network doesn't make it magically see all the traffic. It would…

> Plugging a device into your network doesn't make it magically see all the traffic.

Isn't that exactly what Wireshark's "promiscuous mode" does?

Re: Found hooked up to my router

#328

Post by stordoff »

Reelin wrote: post #229
stordoff wrote: post #223

Earlier quoted context omitted.

> A "smart" TV is presumably running content ID on everything that shows up on its screen And? There's no outbound traffic, so it can't do anything with it. The only risk is if it caches everything indefinitely and if I happen to connect to another network. I should have added that anything that _needs_ Internet access gets vetted much more closely. I was also thinking more of home automation like devices, where it d…

Whoops, just reread your previous comment and somehow I missed the "no outbound traffic" part. That would indeed seem to largely eliminate the issue, although I wonder how long it will be until devices start communicating with each other wirelessly to exfiltrate cached data. I realize that last sentence sounds paranoid, but nonetheless it would already appear to be well on its way to a home near you. For example ( ht…

> although I wonder how long it will be until devices start communicating with each other wirelessly to exfiltrate cached data

At that point I'd have to reconsider. I did wonder about the devices finding a open WiFi point, but at some point you have to draw the line between reasonable precautions and paranoia, and there are none near me (currently) anyway.

Re: Found hooked up to my router

#329

Post by nradov »

sfoley wrote: post #327
tonyb wrote: post #293

Is a disk image of one of these available anywhere? I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server. Plugging a device into your network doesn't make it magically see all the traffic. It would…

> Plugging a device into your network doesn't make it magically see all the traffic. Isn't that exactly what Wireshark's "promiscuous mode" does?

For wired Ethernet it depends on whether the traffic even reaches that port or not. Old dumb Ethernet hubs used to pass all traffic to all ports, but modern switches only send traffic to the intended destination.

Re: Found hooked up to my router

#330

Post by jlgaddis »

deytempo wrote: post #163
Merad wrote: post #106

Earlier quoted context omitted.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?

> If you plug something into a centOS machine it’s not going to be able to do anything until you mount it ...

You may want to double check your CentOS desktop's defaults (you might be surprised).

My most critical machines have a file named /etc/modprobe.d/disabled.conf with entries such as these for dozens of filesystems, network protocols, and such:

  install usb-storage /bin/false
  install vfat /bin/false
When absolutely required, they can quickly be temporarily commented out (but not by mistake) and there's some very extensive auditing rules that keep an eye on things at that point.

It's really not that hard to lock a machine down and yet still have it actually remain usable. With the exceptions of the few security-focused distributions (Qubes OS, Tails, etc.), I can't think of any Linux distribution / desktop environment that even comes remotely close to doing anything like that (OOTB) by default, though.

Post reply on HN