Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

331–340 of 358 posts

Re: Found hooked up to my router

#331

Post by zhobbs »

larkeith wrote: post #52
petemill wrote: post #45

Whilst it's certainly a scam to do with advertising [0], I doesn't look like there's any evidence that the scam has anything to do with 'stealing' anything from network / network traffic: > Facebook has several mechanisms in place to protect your account. We make every attempt to work within the these constraints. In order to keep your account from being locked we use a small device called a Raspberry Pi. This device…

I find these claims extremely dubious. Everything they claim the Pi is needed for can be accomplished without the equipment and postage costs with a purely software solution; The hardware allows them to monitor all traffic and avoid antivirus/firewalls. Moreover, I doubt it is difficult to find mass-market Facebook accounts for much less than $15/month - it is far more likely that, given the hardware allows them unfe…

The hardware gives a better guarantee of botnet uptime though. If you want it to be powered on and attached to that network 24/7, you can't rely on their laptop/desktop.

Re: Found hooked up to my router

#332

Post by jlgaddis »

deaps wrote: post #299
deytempo wrote: post #274

Earlier quoted context omitted.

You got me at the emulate a keyboard thing. Now I’m thinking that you shouldn’t plug strange keyboards or mice in because they could have an onboard payload. The crash cart at a data center is kind of a dumb idea in a way except the place is full of cameras usually

You're absolutely correct. You know those little desk fans that come with a USB now and also an adapter to plug into the electrical outlet. I don't plug those into my laptops ever - who knows if there's a payload on them. I will say this. I currently work, and have worked at, a few secret and top secret facilities - and the number of people I see plugging those (and similar) devices into their laptops is scary.

> the number of people I see plugging those (and similar) devices into their laptops is scary.

If such a device is able to cause a compromise / incident in a secure facility, well, several different "failures" at several different levels have occurred in order for it to get to that point.

Re: Found hooked up to my router

#333

Post by evilDagmar »

tialaramex wrote: post #264
kupiakos wrote: post #195

Earlier quoted context omitted.

That's assuming the box can generate certificates trusted by the target machines - there's a reason the CN field exists.

The X.500 series Common Name is a weird thing to fixate on here. It's an arbitrary free text "name". The only reason it's even sometimes useful in the modern era is that the CAB BRs say it has to match one of the SANs so it will probably be a DNS name. But even there good luck, it took until 2016 or so to get the last stragglers to obey that rule properly without "misunderstanding" it and unlike SANs it isn't defined…

Good luck finding anyone willing to issue you a cert that's valid for 20 years.

Re: Found hooked up to my router

#334

Post by nsgi »

wstuartcl wrote: post #311
amckinlay wrote: post #115

Earlier quoted context omitted.

I still don't understand how this device could steal login details. Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

Assume one of many attack vectors: any site that is loaded via http can have content mutated -- forcing users to http (and then acting as MITM), injecting javascript, other payloads. If you can get a foothold on client computers you can also do things like inject trusted CA's to allow yourself to act as MITM without any cert issues raised. DNS can be mutated. Auto update software that does not check the cert chain an…

HTTPS protects against all of these:

> any site that is loaded via http can have content mutated -- forcing users to http (and then acting as MITM), injecting javascript, other payloads.

Which is why everyone is moving to HTTPS.

> If you can get a foothold on client computers you can also do things like inject trusted CA's to allow yourself to act as MITM without any cert issues raised.

If you get access to the client computer all bets are off. You can just force all their traffic through a MITM proxy, no router hacking needed.

> DNS can be mutated.

Which won't allow you to MITM HTTPS sites.

> Auto update software that does not check the cert chain and hash of the deliverable can be used to inject and run code.

Any auto update software which doesn't verify certificates has a major security vulnerability.

Re: Found hooked up to my router

#335

Post by evilDagmar »

sjwright wrote: post #209
throwaway0255 wrote: post #198

Earlier quoted context omitted.

The computer security industry for SMBs is like 95% theater and 5% actual practice. Conducting that test produced something tangible for whoever made the purchasing decision: It clearly illustrated a need for the services rendered, did it in a way that offered job security to management by giving them license to assert the position over their subordinates, and established a metric by which to evaluate the security co…

> The computer security industry for SMBs is like 95% theater and 5% actual practice. I'd say it's 40% paranoid arse-covering by IT department heads, 35% whatever middle management incorrectly assumes to be current best practices, 20% ego-stroking by the CIO, and 5% sensible context-driven decision-making by IT front-line staff.

Those numbers sound a little thin on the bottom, but only a little. Maybe take 15% out of the CIO category and just throw it away, because they're usually very quick to turn on their underlings.

Re: Found hooked up to my router

#336

Post by evilDagmar »

LeonM wrote: post #273
DoubleGlazing wrote: post #252

Earlier quoted context omitted.

I was at a financial software firm that dealt with USB security issues by filling the USB sockets with epoxy. The keyboard and mouse could not be removed from their USB sockets as they were held in place with a metal collar bolted to the case. Simple and effective, although it destroyed any resale value of the PCs.

Do businesses (other than super small startups) actually sell their old hardware? Genuinely curious.

In the US, above a certain size you're basically required to sell off the old hardware because throwing it away counts as polluting, and the people who dispose of exclusively tech stuff charge you for that service.

Re: Found hooked up to my router

#337

Post by evilDagmar »

deytempo wrote: post #163
Merad wrote: post #106

Earlier quoted context omitted.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

I’m not sure I understand what the big deal is unless your machine tries to run software automatically from devices that are plugged into it. If you plug something into a centOS machine it’s not going to be able to do anything until you mount it and even then why would code be able to run from it?

...because there are still bugs being found in the USB handling code that can occasionally be exploited for code execution.

Re: Found hooked up to my router

#338

Post by evilDagmar »

TheOtherHobbes wrote: post #262
a3n wrote: post #192

Earlier quoted context omitted.

Never underestimate the distribution of stupid. I worked at a hardware / software company where management distributed USB drives as a reward for something or other. The USB drives weren't even in blister packs they were just loose in plastic envelopes. I threw mine out, and wrote a complaint.

Especially when stupid is an observable attribute in the industry. Time and time again the technology industry has failed to consider security as a serious issue, never mind develop systems that are robust and transparent. We don't have botnets, booby-trapped mail attachments, script-hackable servers, USB drives that can carry a viral payload, and all the rest because users are stupid, but because the industry's defa…

More specifically, they tend to view it as a cost center that does nothing to increase profits.

Thing #1 to remember if you're in infosec is that you must pitch it based on the money saved by not having expensive problems like having to hire outside consultants and auditors after a breach.

Re: Found hooked up to my router

#339

Post by wstuartcl »

nsgi wrote: post #334
wstuartcl wrote: post #311

Earlier quoted context omitted.

Assume one of many attack vectors: any site that is loaded via http can have content mutated -- forcing users to http (and then acting as MITM), injecting javascript, other payloads. If you can get a foothold on client computers you can also do things like inject trusted CA's to allow yourself to act as MITM without any cert issues raised. DNS can be mutated. Auto update software that does not check the cert chain an…

HTTPS protects against all of these: > any site that is loaded via http can have content mutated -- forcing users to http (and then acting as MITM), injecting javascript, other payloads. Which is why everyone is moving to HTTPS. > If you can get a foothold on client computers you can also do things like inject trusted CA's to allow yourself to act as MITM without any cert issues raised. If you get access to the clien…

>HTTPS protects against all of these: >Which is why everyone is moving to HTTPS.

Yes, but a MiTM can block or hamper conversion to https and mutate the content. HPKP and HSTS are not widely used yet (and even if they are the first request can be bypassed given this topology). Given current "end user" level protections having a device such as this on your network basically ensures you can be hijacked if even one request made is over https or not currently pinned to HTTPS.

>If you get access to the client computer all bets are off. You can just force all their traffic through a MITM proxy, no router hacking needed.

FFS, the point is the MITM gives a huge amount of attack surface to breach the client -- which yes, after that is done you lose all bets. Everything from injecting code intip zips/exec/etc downloaded over http to using 0day browser exploits and mutating requests. The device itself is physical access to your network which makes access to the clients 1000x 9if not more) easier.

> DNS can be mutated.

There are other protocols besides HTTPS.

>Any auto update software which doesn't verify certificates has a major security vulnerability.

Given, Yes. That does not make it rare or unusual. look at the CVS. There are many developers that write (or enable) auto updaters that should not be responsible for that given their understanding of security.

Re: Found hooked up to my router

#340

Post by jlgaddis »

abraham_lincoln wrote: post #62
walrus01 wrote: post #42

Earlier quoted context omitted.

In general it's best practice to leave unused ports on managed switches in an admin down/shut state until something you know is connected. Or live, but in a quarantine VLAN. Your idea, however, is not totally uncommon to have a raspbery pi sized device at an offsite location, specifically not plugged into any sort of UPS, which is monitored by various alerting systems. In addition to the alerts that one should get du…

My college used to do similar. If you did not register your MAC address, you would be DHCP assigned into a walled-garden IP block. We found we could run an IP scanner on the authorized subnet (from a computer with a whitelisted MAC), and find the unused IPs, and just set those statically for 'visitors'. No need to register any more MAC addresses.

You simply weren't that much of a concern. DHCP snooping takes care of that problem quite well.
Post reply on HN