Most of whatever their router sees, their ISP sees as well.
So I understand they are upset, but the panic is not warranted.
Found hooked up to my router
261–270 of 358 posts
Re: Found hooked up to my router
#262Earlier quoted context omitted.
That's shocking. I know people are dopey, but 50%? I'd have guessed 20% at most.
Never underestimate the distribution of stupid. I worked at a hardware / software company where management distributed USB drives as a reward for something or other. The USB drives weren't even in blister packs they were just loose in plastic envelopes. I threw mine out, and wrote a complaint.
Especially when stupid is an observable attribute in the industry.
Time and time again the technology industry has failed to consider security as a serious issue, never mind develop systems that are robust and transparent.
We don't have botnets, booby-trapped mail attachments, script-hackable servers, USB drives that can carry a viral payload, and all the rest because users are stupid, but because the industry's default culture is to think of security as an esoteric side issue, and not a non-negotiable critical feature in all IT systems.
Re: Found hooked up to my router
#263Earlier quoted context omitted.
It's probably not this attack but any WiFi device can probably be used to key log you. https://threatpost.com/keystroke-recognition-uses-wi-fi-sign...
This is legitimately astonishing.
It's not great.
Some areas of IT are in guarded rooms, with walls of a certain thickness, filtered power, external RF signals killed, and airgapped except for specific patterns for transfering between external systems.
You probably just want to buy a yubikey and accept a lot of computing is built on a house of cards with respects to trust.
https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
Re: Found hooked up to my router
#264Earlier quoted context omitted.
The box controls the DNS; majorwebsite.com points to any sever the attacker likes. The only defense is HSTS/certificate-pinning, for sites previously visited with that browser & device (it’s a TOFU security model). HN has HSTS, but not Reddit, or my credit union, or my local pizza place, or Kaiser Permanente, etc. etc. etc. EDIT: I believe e.g. Chrome and Firefox bake in some major certificates, which would also like…
That's assuming the box can generate certificates trusted by the target machines - there's a reason the CN field exists.
The X.500 series Common Name is a weird thing to fixate on here. It's an arbitrary free text "name". The only reason it's even sometimes useful in the modern era is that the CAB BRs say it has to match one of the SANs so it will probably be a DNS name. But even there good luck, it took until 2016 or so to get the last stragglers to obey that rule properly without "misunderstanding" it and unlike SANs it isn't defined to be DNS A-labels so it may have arbitrary Unicode text.
Most browsers stopped even looking at CN or only do so for people's crappy home grown private CAs
Anyway, what makes certs trustworthy isn't the CN, it's a chain of two or more digital signatures leading to a trusted root. And the CN in that root, while it had to be truthful when written, may be twenty years old, so it's nonsense now.
Re: Found hooked up to my router
#265Earlier quoted context omitted.
In general it's best practice to leave unused ports on managed switches in an admin down/shut state until something you know is connected. Or live, but in a quarantine VLAN. Your idea, however, is not totally uncommon to have a raspbery pi sized device at an offsite location, specifically not plugged into any sort of UPS, which is monitored by various alerting systems. In addition to the alerts that one should get du…
My college used to do similar. If you did not register your MAC address, you would be DHCP assigned into a walled-garden IP block. We found we could run an IP scanner on the authorized subnet (from a computer with a whitelisted MAC), and find the unused IPs, and just set those statically for 'visitors'. No need to register any more MAC addresses.
Out of curiosity, you couldn’t just guess them based on knowing a couple? Or do people assigning them in some fashion that isn’t consecutive within the block?
Re: Found hooked up to my router
#266Earlier quoted context omitted.
If you had never visited the site, how would modern security practices have prevented the attack? HSTS is useless in this case isn't it?
Many sites can be included as HSTS only in Chrome itself, so it wouldn't be entirely useless. https://hstspreload.org
Anyone can preload their domain in Chrome, Firefox and others that share the preload list. I'm not sure what vulnerabilities are left after your site has been preloaded.
Re: Found hooked up to my router
#267Earlier quoted context omitted.
Test how many SSL connections go the extra mile and secure themselves against Man in the Middle attacks. You'll be surprised.
All of them, since that's an explicit design goal of SSL/TLS?
If a user wants their free wifi enough they'll be happy to click through those pesky warnings that the root cert is not trusted. They'll probably not think anything of it if it loads as normal, even with a big angry red cross. The speed at which users rip though Windows UAC warnings is astonishing.
Re: Found hooked up to my router
#268Earlier quoted context omitted.
I’d like to know which CA would issue an EV cert for a site like that - so I can remove them from my cert stores.
CA's are fully automated, they won't review or check for phishing lookalikes. Maybe reactively if it's being reported, but, should they operate as the internet police? What if it's a legitimate bank that has the same name (with an accent) and isn't beholden to the same trademark in their country?
EV can't be (shouldn't be) fully automated, but:
+ It may seem like it is if your organisation gets a bunch of EV certs with the same organisation info under some bulk deal. The issuer only does the expensive manual EV steps once per period, if you're Google in January then (the thinking goes) you are still Google in June. This saves them money so it enables them to offer pretty good deals for lots of EV certs.
+ Good EV providers streamline the manual stuff in countries like the US that have their government records online. A call centre employee can do the searches, pull up contact details and phone your Head Office or whoever to confirm in minutes not hours. However this also means they won't necessarily pick up on subtle clues like why is this outfit named Myba N K ? Oh! That's My Bank but with misleading capitalisation and spacing.
+ White hats toying with EV discovered that outfits like D&B relied on in the business community to verify identity are... Not very reliable. If D&B says the Head Office is at 632 Wall Street that might be because somebody filled out a web form, not because D&B agents even checked 632 Wall Street exists let alone that the company has offices there...
Re: Found hooked up to my router
#269Can someone post the image here? I have blocked reddit on my phone.
Re: Found hooked up to my router
#270Earlier quoted context omitted.
Anecdotally, I heard of a toy radio control quadcopter belonging to western military personnel in Afghanistan that turned out to be trying to phone home to ${badguy} when they plugged it into a laptop to charge. This stuff is everywhere, and has been for years.
This is why I keep a large supply of "USB Condoms" (little dongles that short circuit the data, and allow charging/power only)
A previous employer would buy modified motherboards with the data traces removed/cut.