Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to exploit home routers for anonymity

danmcinerney.org

Post reply on HN
Print view View original

61–70 of 80 posts

Re: How to exploit home routers for anonymity

#61

Post by pavel_lishin »

bradleyland wrote: post #22

Probably worth pointing out that one should remain aware of their local laws when carrying out such activities as the ones outlined in this HOW TO. Because you're blindly hitting hosts and attempting logins, you don't know whose infrastructure you're probing. If you accidentally knock on the wrong door, the simple act of attempting a log in can cause issues for you (legal and otherwise). I'm trying to avoid sounding…

> it's likely that you haven't thought through what can happen if something you try actually works.

Yup. Luckily, when I tried something similar, I was very much a minor, so the only consequence was that our ISP banned our previous account and required us to sign up for a new one.

Re: How to exploit home routers for anonymity

#62

Post by domdip »

dasil003 wrote: post #59
dsl wrote: post #54

Earlier quoted context omitted.

Unless that consumer grade router is running a bank of a nuclear power plant. There are very few places outside the reach of US law enforcement. Especially if they bother to get Interpol involved.

I am now imagining wardriving to a nuclear power plant parking lot in order to score free wifi off their NetGear.

Why not, it worked against TJX, right?

Orders of magnitude more likely to find an open WiFi in a bank's parking lot than you are to find a WAN-facing consumer-grade router. Any employee in the company could screw up the former ("I didn't get good wifi so I brought in a router from home!"). The latter requires grossly incompetent netsec.

Re: How to exploit home routers for anonymity

#63

Post by wmf »

noonespecial wrote: post #60

The nice thing about this is that you don’t have to wonder whether or not your VPN provider is saving logs or not, you are in control of that. If you take over a single router, a provider does indeed have logs of both the inbound you used to reach the router, and the outbound traffic you create from it. Simple timing logging will show its you and if its "their" router, they'll (at least theoretically) be able to decr…

In this case the VPN "provider" is the router itself and since you owned it you can eliminate logs. The ISP may have flow-level logs but those are so voluminous that they probably aren't kept long.

Re: How to exploit home routers for anonymity

#64

Post by drdaeman »

gknoy wrote: post #43
devconsole wrote: post #32

Earlier quoted context omitted.

It could be possible to enable someone you trust to use your infrustracture. You don't have to know who this person is. For example, this devconsole HN account that I'm using now is an anonymous HN account, meaning as long as Tor is secure, and I don't reveal myself through e.g. text analysis or timing correlations, it should be hard to figure out who I am. If I were to come to you and ask to use your infrastructure…

> It could be possible to enable someone you trust to use your infrustracture. You don't have to know who this person is. Am I the only one to whom this sounds absolutely crazy? How can I trust you if I don't know who you are? (I mean the general you, not you personally, devconsole.) Your comments could have been deliberately sanitized -- perhaps you have trolling accounts elsewhere that you are exceptionally good at…

> Am I the only one to whom this sounds absolutely crazy? How can I trust you if I don't know who you are?

Well, cryptographers had invented a fancy thing called "ring signatures" that allows one to check whenever a signature belongs to someone in a group, but don't allow to determine who exactly that was. So, technically, it's well possible to remail anonymous (as far as belonging to a group does not break your anonymity) and be trusted at the same time.

But, unfortunately, I don't think F2F mesh networks would prosper anytime soon.

Re: How to exploit home routers for anonymity

#65

Post by lurkinggrue »

devconsole wrote: post #35
timtadh wrote: post #30

Stuff like this is why I built my own router (I recommend the ALIX series http://pcengines.ch/alix.htm ). High quality hardware and you don't have to worry about the software because you control all of it. Right down to the BIOS if you want to.

How would you verify on demand that the BIOS isn't compromised?

Could be the processors as well, better to forge the chips by hand to be sure.

Re: How to exploit home routers for anonymity

#66

Post by rainsford »

vezzy-fnord wrote: post #42
rainsford wrote: post #13

Earlier quoted context omitted.

I think that oversimplifies an important point. Criminals may not CARE about breaking into someone's computer or router, but that doesn't mean they're capable of doing so. Tor significantly lowers the bar for anonymity online, and there is no question in my mind that it enables criminals who wouldn't have the means to mask their identities otherwise. This is not necessarily an argument against tools like Tor, but it'…

Criminals are humans. They will use and abuse whatever infrastructure any other person has access to for their own purposes, much like (you guessed it) any other person. Your argument is about as lazy as it is old. The only possible solutions are to make all criminals go extinct (good luck), or to take away tons of important tools away from the public, because get this, criminals might use them! How terrible.

Nowhere did I advocate "taking away tons of important tools", in fact I specifically said my point wasn't necessarily an argument against Tor. But what I think is lazy is the way some people pretend that there are no tradeoffs involved in things like Tor and that they only benefit "the public".

Re: How to exploit home routers for anonymity

#67

Post by maxerickson »

DanBC wrote: post #49
devconsole wrote: post #46

Earlier quoted context omitted.

Could you "enable anonymity" at very low bandwidth ... say ... the equivalent of 9600 baud? What a fantastic idea. This seems worth pursuing. It should be possible to configure a modern browser to work with low bandwidth: HTML/CSS/JS would load, but images and other media wouldn't. Is there any reason why HN, Reddit, Twitter, webmail, and other services like IRC wouldn't be usable under those conditions? It seems lik…

I would love to see someone try to use HN at 9600 bps. That's bits per second, so 9600 / 8 = 1200 characters per second, roughly.

I stuck with ~30K bps a lot longer than was reasonable (it's still been years...). HN would be fine, a few seconds waiting for a few minutes reading. Megabyte js monstrosities were the problem, they would time out.

Re: How to exploit home routers for anonymity

#68

Post by ensignavenger »

iamwithnail wrote: post #39
drdaeman wrote: post #31

Earlier quoted context omitted.

> unable to prove your innocence Here's the issue. Return presumption of innocence back and problem's solved. Obviously, that's impossible in a real world. > credentials for the anonymous party to use That wouldn't be anonymous anymore. And there's no way to realistically force a single human to have only one credential - if one's banned they'll just generate a new one.

While I don't disagree with you, at least in the UK, possession in a cache and in some circumstances, transmission of child abuse images is a strict liability offence, meaning intent doesn't come into it - I suspect it's the same in many jurisdictions. It's a ridiculous position, but it's still the reality for many.

Are there any actual cases where someone was found guilty just for operating a computer/router/whatever that relayed information?

What is a piece of legislation says and what is actually "law" is often not the same, as the courts can interpret it however they want.

Re: How to exploit home routers for anonymity

#69

Post by kordless »

Zigurd wrote: post #34
kordless wrote: post #20

It feels like we need to include anonymity in the Internet Bill of Rights: 1. I have a right to read or write public information in an anonymous way. 2. I have a right to prevent you from reading or writing MY private information in an anonymous way, even if the intent is to obtain the right to exercise #1 in the process. 3. Using someone else's infrastructure/compute/power to enable #1 without breaking #2 requires y…

The Bill of Rights already explicitly says it isn't the List of Rights.

The intent of it is a framework, right? i.e. it's not inclusive of all rights, just ones that are currently applicable and a template of intent for future ones.

Re: How to exploit home routers for anonymity

#70

Post by ZoF »

wmf wrote: post #63
noonespecial wrote: post #60

The nice thing about this is that you don’t have to wonder whether or not your VPN provider is saving logs or not, you are in control of that. If you take over a single router, a provider does indeed have logs of both the inbound you used to reach the router, and the outbound traffic you create from it. Simple timing logging will show its you and if its "their" router, they'll (at least theoretically) be able to decr…

In this case the VPN "provider" is the router itself and since you owned it you can eliminate logs. The ISP may have flow-level logs but those are so voluminous that they probably aren't kept long.

The parent comment was(pretty clearly) referring to what you're calling "flow-level logs"... Quite obviously you can delete the router's logs(it's mentioned in the article and by the parent comment); the ISP's traffic logs on the other hand?

> those are so voluminous that they probably aren't kept long.

Bold assertion.

Post reply on HN