Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Hacked a Router

disconnected.io

Post reply on HN
Print view View original

71–80 of 96 posts

Re: How I Hacked a Router

#71

Post by icebraining »

joev_ wrote: post #41
icebraining wrote: post #29

One more reason to use NoScript - it would have made the CSRF significantly harder to pull off. And a reason to use an OS with a proper package manager, of course ;)

Not really. Depending on the protocol CSRFs are often an easy 1-click exploit on noscript-enabled browsers. Something like this: " /> Is the corresponding 1-click that works on noscript.

Hmm, I thought ClearClick would catch that, but apparently it doesn't. That's unnerving. Even ABE lets it through.

That said, it would still require the victim to load the fake LinkedIn page (with the wrong domain), which is more likely to look suspicious.

And it would've loaded the router page after the POST (instead of redirecting to LinkedIn), which would definitively signal that something was wrong.

Re: How I Hacked a Router

#73

Post by ambrop7 »

"It took about a week before Bill decided to upgrade notepad++ to the new version."

Which is why I'm always wary of installing unsigned software. In such cases I try to check some hashes some way. Obviously if the download page lists them I check against those, but in most cases it's insufficient because that page is not HTTPS. So I always help myself with google, both by googling the filename to find some pages listing a hash, and by googling my own hash (note that Google is accessed with HTTPS).

Re: How I Hacked a Router

#74

Post by ambrop7 »

ushi wrote: post #6
aaronem wrote: post #3

Earlier quoted context omitted.

Sure, but if you're MITMing DNS, you just serve a copy of the Notepad++ download page (or whatever) whose listed checksum matches that of your backdoored executable, so that's not a problem in this scenario.

Thats exactly what i mean - checksums are useless in this scenario. They should have been signed with a key your computer knows. (Retrieved before the first install)

They're not useless if you rely on Google for verification (see my top level comment).

Re: How I Hacked a Router

#76

Post by frozenport »

ambrop7 wrote: post #73

"It took about a week before Bill decided to upgrade notepad++ to the new version." Which is why I'm always wary of installing unsigned software. In such cases I try to check some hashes some way. Obviously if the download page lists them I check against those, but in most cases it's insufficient because that page is not HTTPS. So I always help myself with google, both by googling the filename to find some pages list…

Sounds extremely involved.

Re: How I Hacked a Router

#79

Post by why-el »

ambrop7 wrote: post #73

"It took about a week before Bill decided to upgrade notepad++ to the new version." Which is why I'm always wary of installing unsigned software. In such cases I try to check some hashes some way. Obviously if the download page lists them I check against those, but in most cases it's insufficient because that page is not HTTPS. So I always help myself with google, both by googling the filename to find some pages list…

I didn't understand which hashes you are talking about. Do installs usually provide a checksum or? I have not found any that do, or maybe I just ignore it.

Re: How I Hacked a Router

#80

Post by pizzeys »

afro88 wrote: post #40
revelation wrote: post #39

Earlier quoted context omitted.

The mail was just the CSRF attack vector, anyway. Could've just sent him a random short link over IM..

... that he wouldn't have clicked because who clicks random links over IM

Plenty of other ways to catch even the security aware. The obvious, since he knows this person, would be to tweet some 'news link' and have the code only work for Bill. You can be security aware and not be perfect 100% of the time.
Post reply on HN