Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to exploit home routers for anonymity

danmcinerney.org

Post reply on HN
Print view View original

31–40 of 80 posts

Re: How to exploit home routers for anonymity

#31

Post by drdaeman »

devconsole wrote: post #23
kordless wrote: post #20

It feels like we need to include anonymity in the Internet Bill of Rights: 1. I have a right to read or write public information in an anonymous way. 2. I have a right to prevent you from reading or writing MY private information in an anonymous way, even if the intent is to obtain the right to exercise #1 in the process. 3. Using someone else's infrastructure/compute/power to enable #1 without breaking #2 requires y…

With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while. Your infrastructure will immediately be used to download or upload child pornography. If you're exceptionally unlucky, the FBI will come knocking and, if you're unable to provide them with a useful ho…

> unable to prove your innocence

Here's the issue. Return presumption of innocence back and problem's solved.

Obviously, that's impossible in a real world.

> credentials for the anonymous party to use

That wouldn't be anonymous anymore. And there's no way to realistically force a single human to have only one credential - if one's banned they'll just generate a new one.

Re: How to exploit home routers for anonymity

#32

Post by devconsole »

drdaeman wrote: post #31
devconsole wrote: post #23

Earlier quoted context omitted.

With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while. Your infrastructure will immediately be used to download or upload child pornography. If you're exceptionally unlucky, the FBI will come knocking and, if you're unable to provide them with a useful ho…

> unable to prove your innocence Here's the issue. Return presumption of innocence back and problem's solved. Obviously, that's impossible in a real world. > credentials for the anonymous party to use That wouldn't be anonymous anymore. And there's no way to realistically force a single human to have only one credential - if one's banned they'll just generate a new one.

It could be possible to enable someone you trust to use your infrustracture. You don't have to know who this person is. For example, this devconsole HN account that I'm using now is an anonymous HN account, meaning as long as Tor is secure, and I don't reveal myself through e.g. text analysis or timing correlations, it should be hard to figure out who I am. If I were to come to you and ask to use your infrastructure to help me maintain my anonymity, you may read my comment history and decide that you trust me not to do illegal things. Providing such a service would be extremely valuable, because if Tor is indeed not completely impervious, your extra layer of anonymity may be all that preserves one's privacy.

If an authority were to come to you and demand you cooperate in determining my identity, then there would be no way for you to oblige, except by providing them with a log of the VPN activity, or allowing them to set up a pen trap to log the VPN activity. At that point, the privacy is still as strong as the Tor network, so both Tor and this extra layer would have to fall in order to be unmasked.

(In practice, it's more complicated than that: your infrastructure would be a fixed endpoint, meaning that if it's compromised then an adversary would gain a log of your activity. That would provide an overall picture of what you're up to on the internet. Tor rotates endpoints, making it hard to piece together that info. So in practice a user should want your service to be something like a middleman between two different anonymity services. But that's outside the scope of this comment for now.)

This becomes a pretty attractive idea, because it's not necessarily a great idea to assume that Tor should be the world's one realistic defense. Since Snowden used Tor, you can be absolutely certain that various powers are going to take a keen interest in penetrating Tor. They may use dirty tricks to do it, such as joining the Tor project as an apparently-trustworthy developer.

Extra layers of defense such as the one outlined above may be worth pursuing.

Re: How to exploit home routers for anonymity

#33

Post by gamerdonkey »

hf wrote: post #7

The opening paragraph asserts that simply not publishing ("censoring") such concrete, recipe-like exploits of the deficiencies of our shared infrastructure "won't make practices like those outlined [in the article] disappear"[2]. I am reminded of Steve Kemp's 2014 post »Secure your rsync shares, please«[0], relating how he abandoned a project employing zmap[1] upon discovering numerous openly accessible rsync shares…

Hopefully, by making this kind of exploitation common knowledge for the more tech-oriented crowd, we will be able to bring about change in the companies that manufacture the devices. You're right that the vast majority of people do not realize why they need to secure their infrastructure and would not know how to do it if they did. For that kind of person, the default needs to change to something more secure.

This kind of "change through widespread knowledge of exploitation" strategy saw some success in changing the default encryption schemes of WiFi routers. So, we're already kind of in the same area.

Re: How to exploit home routers for anonymity

#34

Post by Zigurd »

kordless wrote: post #20

It feels like we need to include anonymity in the Internet Bill of Rights: 1. I have a right to read or write public information in an anonymous way. 2. I have a right to prevent you from reading or writing MY private information in an anonymous way, even if the intent is to obtain the right to exercise #1 in the process. 3. Using someone else's infrastructure/compute/power to enable #1 without breaking #2 requires y…

The Bill of Rights already explicitly says it isn't the List of Rights.

Re: How to exploit home routers for anonymity

#35

Post by devconsole »

timtadh wrote: post #30

Stuff like this is why I built my own router (I recommend the ALIX series http://pcengines.ch/alix.htm ). High quality hardware and you don't have to worry about the software because you control all of it. Right down to the BIOS if you want to.

How would you verify on demand that the BIOS isn't compromised?

Re: How to exploit home routers for anonymity

#36

Post by 0xdeadbeefbabe »

jasonkolb wrote: post #16
mcherm wrote: post #15

Earlier quoted context omitted.

> What can be done? Are we reduced to just securing our friends' and families' infrastructure, all the while standing by idly while others outside of our direct sphere of influence suffer the consequences of naïvety? No. We can write articles similar to this one which, instead of clearly explaining step-by-step procedures for exploiting weaknesses, clearly explain step-by-step procedures for REPAIRING weaknesses.

I think you give way too much credit to the average person. It's easy to lose sight of how scary technical things are to normal people when you're in it day in and day out, but to ask the average person to change something in their router is kind of like asking me to replace a cylinder in my car. There's a reason things like the Geek Squad are around and can charge as much as they do...

I think you are complementing your own technical prowess.

But the truth is, replacing a cylinder in a car is so much harder than reading and following these instructions, and even if you don't understand either task the car cylinder task takes longer, requires more tools, makes a mess, etc.

An average person who has no intuition for passwords could just turn their router off when they aren't using it.

Re: How to exploit home routers for anonymity

#37

Post by js2 »

kordless wrote: post #12
dfa0 wrote: post #9

Another reminder to use strong, non-default credentials on something that is the edge of your network. I'm still amazed by how many people drive around leaving their cars unlocked.

I leave my keys in the car sometimes when I'm running errands in my home town. I care a whole lot more about my network security at home than I do my car. It's just a car.

You are potentially exposing yourself to liability should your car be stolen and involved in an accident:

http://courses2.cit.cornell.edu/sociallaw/student_projects/E...

(IANAL, it looks like a court is not likely to find you liable, but you're still exposing yourself to the hassle of a law suit.)

Re: How to exploit home routers for anonymity

#38

Post by 0xdeadbeefbabe »

bradleyland wrote: post #22

Probably worth pointing out that one should remain aware of their local laws when carrying out such activities as the ones outlined in this HOW TO. Because you're blindly hitting hosts and attempting logins, you don't know whose infrastructure you're probing. If you accidentally knock on the wrong door, the simple act of attempting a log in can cause issues for you (legal and otherwise). I'm trying to avoid sounding…

Of course you can ignore all that if you are attacking from Nigeria.

Laws are exciting and important (especially good ones like Newton's laws of motion), but laws could improve too: If someone gets caught doing this they probably ought to do community service working on some bug bounty program instead of going to jail.

Re: How to exploit home routers for anonymity

#39

Post by iamwithnail »

drdaeman wrote: post #31
devconsole wrote: post #23

Earlier quoted context omitted.

With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while. Your infrastructure will immediately be used to download or upload child pornography. If you're exceptionally unlucky, the FBI will come knocking and, if you're unable to provide them with a useful ho…

> unable to prove your innocence Here's the issue. Return presumption of innocence back and problem's solved. Obviously, that's impossible in a real world. > credentials for the anonymous party to use That wouldn't be anonymous anymore. And there's no way to realistically force a single human to have only one credential - if one's banned they'll just generate a new one.

While I don't disagree with you, at least in the UK, possession in a cache and in some circumstances, transmission of child abuse images is a strict liability offence, meaning intent doesn't come into it - I suspect it's the same in many jurisdictions. It's a ridiculous position, but it's still the reality for many.

Re: How to exploit home routers for anonymity

#40

Post by ticktocktick »

MAGZine wrote: post #28
dfa0 wrote: post #18

Earlier quoted context omitted.

The reason to secure your network is a good reason to secure your car. Your network and your car can/will be used by bad guys to do bad things. You should care.

somehow i'm less worried about people stealing my car when I'm driving around at 60kmph.

You are part of a society in which you have an obligation to protect and preserve the safety of others through reasonable and responsible actions.

I don't think that locking your car while it is parked or not leaving your keys in it while it is unattended is too much to ask.

FFS.

Post reply on HN