Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.
How I Hacked a Router
21–30 of 96 posts
Re: How I Hacked a Router
#22Sweet story ... and another vote for MikroTik routers for personal use.
I'd go along with that, assuming that RouterOS is replaced by OpenWRT or FreeBSD.
Re: How I Hacked a Router
#23Earlier quoted context omitted.
Yes, they should. I'd be curious to hear more details about that. I'd also like to know what domain was used for phishing, since you would think an infosec guy would either hover over the button/link before clicking, or get suspicious when he sees his browser load a site that isn't linkedin.com before redirecting.
That's an excellent question, especially since LinkedIn publishes an SPF record specifying both the IP ranges and the second-level domain name of legitimate MXes for its mail; prior to the DNS hijack, I'm not sure how it would be possible to carry out the phishing attack without giving any hint of foul play. (I do implicitly assume such hints would've stopped the target from clicking the bogus link, but given the way…
SPF only checks the message envelope. His target's email provider may not correlate the MAIL FROM statement in the envelope with the From header inside of the message content. Some large webmail providers will use this mismatch as a cue to send a file to the spam folder.
Delivering a targeted phish requires situational awareness, but it's quite feasible to pull off something convincing.
http://blog.strategiccyber.com/2013/10/03/email-delivery-wha...
Re: How I Hacked a Router
#24Sweet story ... and another vote for MikroTik routers for personal use.
I'd go along with that, assuming that RouterOS is replaced by OpenWRT or FreeBSD.
Do you think configuring OS for your router manually would leave less chance for it to be broken? I suspect I'd leave more holes setting up all the stuff myself, than relying on MikroTik folks knowledge.
Besides, are there some step-by-step guides/checklists that would help build secure environment for your router/PC?
Re: How I Hacked a Router
#25Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.
In my experience, SPF has never lived up to it's promised and it's just one of many factors to create a spam/ham score. There are just too many SPF issues with many mail address to use SPF alone to filter an otherwise normally looking mail.
Re: How I Hacked a Router
#26Earlier quoted context omitted.
I'd go along with that, assuming that RouterOS is replaced by OpenWRT or FreeBSD.
Do you think configuring OS for your router manually would leave less chance for it to be broken? I suspect I'd leave more holes setting up all the stuff myself, than relying on MikroTik folks knowledge. Besides, are there some step-by-step guides/checklists that would help build secure environment for your router/PC?
[deleted]
Re: How I Hacked a Router
#27Interesting read. On thing i do not understand is why software updates/packages are still not cryptographically signed. It's a common thing on Linux. Notepad++ provides checksums[0] for their packages - so (i assume) they are actually aware of the problem. [0] http://sourceforge.net/p/notepad-plus/discussion/1290588
It's common on Linux because they use package managers where you only have to implement that functionality once. Every PoS app on Windows and OSX has its own update process, which mostly is just downloading and running the new setup binary.
This happens even with software where you would think the manufacturer is aware of this kind of problem. 1Password downloaded updates over HTTP for a long time, then switched to HTTPS and failed to check certificates. When they finally started to check if binaries are signed (Windows provides for that), they didn't change keys so you could downgrade to a previous version that didn't. That is just one application.
Re: How I Hacked a Router
#28Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.
I can confirm I get spam emails to my gmail inbox that fail SPF. But none of them are claiming to be from highly-visible sites like LinkedIn.
Re: How I Hacked a Router
#29One more reason to use NoScript - it would have made the CSRF significantly harder to pull off. And a reason to use an OS with a proper package manager, of course ;)
Re: How I Hacked a Router
#30Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.
Did he say he was on gmail? Maybe I didn't catch that part.
That's an interesting decision for a security-minded person to make though. Do I use gmail as they'll have broad statistical analysis of attack vectors? Or do I use my own mail server which may not have the same features, but is more secure/private in other ways?