Live data from Hacker News

Found hooked up to my router

reddit.com

151–160 of 358 posts

Re: Found hooked up to my router

#151

Earlier quoted context omitted.

It's amazing how many people forget that Raspbian is still Linux under all the Wolfram and Raspberry Pi stuff. So you essentially have a tiny computer that can be plugged into almost anything you can program for.

Do people really forget that? I thought that was the whole point of raspberry pis.

It depends on what you're using it for. I bought a kit for setting up a retro-pi because I didn't feel like checking to ensure the parts were all compatible. It gives you step by step instructions to set it up, and none of it requires knowing anything about Linux. You just download an image file, write it to the ssd, and when you plug it in it does all the setup itself and you're just presented with the retro-pi GUI. The only hint that it's Linux under the hood is when the names of processes scroll past on the screen as it's booting.

Re: Found hooked up to my router

#152
post #78

Earlier quoted context omitted.

This is how stuxnet got into the Natanz facility I think. They left a usb stick in the parking lot. Someone picked it up, plugged it in.

No, iirc stuxnet spread itself without anyone physically leaving a USB stick anywhere. On a system infected via the network, it would try to infect any USB drives connected to the system.

Natanz was air gapped. Stuxnet penetrated the facility on a phisical device, once inside it spread over the LAN. The Widespread distribution of it on the open Internet was because of a bug in the code.

Re: Found hooked up to my router

#153
post #116

Earlier quoted context omitted.

Oh, please, no-one would fall for that! FY2018_salary_data.xls.exe, on the other hand... :P

It wasn't uncommon to see hot_new_song.mp3.exe back in the gnutella heyday.

It's still reasonably common to see hot_new_movie.mp4.exe or have an encrypted mp4 with a install_this_codec.exe beside it.

Re: Found hooked up to my router

#154
post #7

How is this thing intercepting all his Facebook and bank traffic?

I don't think it is. Here's another thread which may be for the same thing or something similar. https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour... It's apparently a "rent a Facebook account" scam. (The roommate apparently also provided his Facebook credentials.)

Ok, so it looks from that like the Pi is there to act as a VPN endpoint of sorts to allow the operators to use the recruit’s Facebook account undetected by FB’s geolocation security. From which it would appear they then run some sort of high-volume affiliate marketing scam.

Re: Found hooked up to my router

#155
post #53

One comment in that thread[1] gives a full explanation of what such a Raspberry Pi device hooked up to the router can do: forward all the network traffic, replace router's stock firmware with its own, install software on the network connected devices via known vulnerabilities, spoof websites by acting as custom DNS server. In my opinion, it looks like "a Pi-hole[2], but for phishing". [1] https://www.reddit.com/r/wha…

I still don't understand how this device could steal login details. Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

For example you can go to my http://website.com now the normal website has a HTTPS redirect on home page. Your router replaces that page and disables the redirect. Now is up to you to notice you're on a http connection.

If you think is rare, I can tell you some fortune 500 FX and stocks trading have this vulnerability a year ago (didn't checked again).

Re: Found hooked up to my router

#156
post #78

If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.

This is how stuxnet got into the Natanz facility I think. They left a usb stick in the parking lot. Someone picked it up, plugged it in.

My understanding is that stuxnet got out of Natanz, by mistake. The world was never supposed to see that code. It was planted inside the Natanz secure perimeter.

Re: Found hooked up to my router

#157
post #91
post #88

Earlier quoted context omitted.

How many users do you know of who manually check hashes on downloaded executables? And of course the user is going to ignore the untrusted source warning on an executable they intentionally downloaded and are trying to run.

I think what he means is that it seems like a lot of trouble to hack someone who is not necessarily hackworthy? Like what kind of things would you expect to gain from someone who would be as computer illiterate as to allow all that to come to fruition?

I work on a software company. You would be amazed to know how many manager types, earning 6 figures, who are absolutely naive with regards to security. Those are prime targets for this kind of exploit.

Re: Found hooked up to my router

#158

In the days when USB sticks were more common it was an easy tactic for someone to drop one in a company parking lot labeled “salary data” and with almost certainty that thing would get plugged into a device on the corporate network. The biggest security vulnerability in most cases is still users doing dumb things.

Have USB sticks stopped being common...? I'd guess there are a dozen or two around my house right now.

Re: Found hooked up to my router

#159

Earlier quoted context omitted.

you still have to install the proxy certs

Pick your favorite windows 0-day and use it to only install a cert and nothing else that would tip off AV software.

Are Windows 0-days really that common? I thought they were usually saved for really serious attacks, e.g. from state-sponsored actors, not scams on the level of "pay some random person $15 a month to attach a mysterious device to their router".

Re: Found hooked up to my router

#160

I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).

https://news.ycombinator.com/item?id=18090419
Post reply on HN