Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

291–300 of 358 posts

Re: Found hooked up to my router

#291

Post by lllr_finger »

LeonM wrote: post #273
DoubleGlazing wrote: post #252

Earlier quoted context omitted.

I was at a financial software firm that dealt with USB security issues by filling the USB sockets with epoxy. The keyboard and mouse could not be removed from their USB sockets as they were held in place with a metal collar bolted to the case. Simple and effective, although it destroyed any resale value of the PCs.

Do businesses (other than super small startups) actually sell their old hardware? Genuinely curious.

Yep, look on eBay for sellers that specialize in refurbishing them. It's a great way to get something like an older Thinkpad for really cheap. Perfect for a Linux laptop that doesn't need the latest and greatest.

Re: Found hooked up to my router

#292

Post by hunter2_ »

hguant wrote: post #186
amckinlay wrote: post #115

Earlier quoted context omitted.

I still don't understand how this device could steal login details. Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

>Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Yes, everything SHOULD be like this. I should be able to trust my neighbors and leave my doors unlocked as well, and I should be able to have faith in my elected officials. And yet... The other issue is that you can connect to a website that implements HTTPS correctly, and still be borked if that site does…

Perfectly valid cert how? Assuming no theft of a chase private key.

Re: Found hooked up to my router

#293

Post by tonyb »

Is a disk image of one of these available anywhere?

I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server.

Plugging a device into your network doesn't make it magically see all the traffic. It would have to be doing ARP spoofing, DHCP hijacking, or hacking the router config/firmware. Is it possible that it is doing some or all of those things -- sure. But why? That could all be done via a malicious client executable that would give you access to the network and much more and is much more discrete than a physical box, so why would someone go through the trouble of shipping out a box + paying the recipient? The more simple explanation is the sender of the device is doing nefarious actions on the internet and needs a bunch of IPs for cheap so when they get blocked they can just move on to the next IP.

Would I put one of these on my home network - hell no. But if one of my friends tells me they had one plugged into their network I wouldn't immediately assume that their entire digital life was compromised. I would tell them to unplug it though.

Re: Found hooked up to my router

#294

Post by mike-cardwell »

rjmunro wrote: post #277
mike-cardwell wrote: post #237

Earlier quoted context omitted.

If the site is non-SSL, then there's nothing stopping somebody in control of the network from replacing all "password" fields with plain "text" fields, and then applying a custom font to them so every character entered is displayed as a "•"

That's basically what a password field already is. That would make no difference to anything - the password would be sent over the network in exactly the same way either way.

No. The point of switching out a password field for a text field is to prevent the browser from warning about the existence of a password field on a non-HTTPs secured page. This is a well known, and old trick.

Re: Found hooked up to my router

#295

Post by deaps »

hunter2_ wrote: post #289
tomsmeding wrote: post #276

Earlier quoted context omitted.

If the user hasn't visited the subdomain evil.chase.com yet, a http downgrade attack ( https://news.ycombinator.com/item?id=18090419 ) would maybe work.

That's not a downgrade, but a lack of upgrade. A few comments back said https://evil but it would have to instead be http://evil assuming no rogue root cert is installed. And requires that if the user had visited chase.com, that chase.com not have includeSubdomains in their HSTS header.

So to prevent a downgrade attack before a first connection is made, not only does the domain need to "includeSubdomains" - and have a valid lifetime (maybe of at least 31536000 seconds, or 1 year [this may just be a government standard]), but they'd also have to send the preload directive in their HSTS header and have been preloaded by that browser platform. If the domain is not preloaded, that first connection is required to get the HSTS information to the client in the Strict-Transport-Security header.

Re: Found hooked up to my router

#296

Post by deaps »

nielsole wrote: post #173
implying wrote: post #162

Earlier quoted context omitted.

This is why certificate pinning and modern web security practices are so important. On a well configured site, this attack would fail.

If you had never visited the site, how would modern security practices have prevented the attack? HSTS is useless in this case isn't it?

No. If the domain (and its subdomains) are preloaded - then a first visit is not required. The HSTS requirement is then baked into a list supported by modern browsers such as Firefox and Chrome.

Re: Found hooked up to my router

#297

Post by deaps »

Avamander wrote: post #266
hrrsn wrote: post #179

Earlier quoted context omitted.

Many sites can be included as HSTS only in Chrome itself, so it wouldn't be entirely useless. https://hstspreload.org

Anyone can preload their domain in Chrome, Firefox and others that share the preload list. I'm not sure what vulnerabilities are left after your site has been preloaded.

The only vulnerability left would be, as mentioned above, a client installing a browser that doesn't support HSTS.

Re: Found hooked up to my router

#299

Post by deaps »

deytempo wrote: post #274
wepple wrote: post #169

Earlier quoted context omitted.

Well for starters, if you’re curiously plugging it in, you’re going to mount it aren’t you? Second, it can emulate an HID keyboard device and type keystrokes faster than you can react and pull it out, at which point it’s far too late - it’s pulled a secondary payload down or mounted a USB mass storage device and you’re owned.

You got me at the emulate a keyboard thing. Now I’m thinking that you shouldn’t plug strange keyboards or mice in because they could have an onboard payload. The crash cart at a data center is kind of a dumb idea in a way except the place is full of cameras usually

You're absolutely correct.

You know those little desk fans that come with a USB now and also an adapter to plug into the electrical outlet. I don't plug those into my laptops ever - who knows if there's a payload on them.

I will say this. I currently work, and have worked at, a few secret and top secret facilities - and the number of people I see plugging those (and similar) devices into their laptops is scary.

Re: Found hooked up to my router

#300

Post by _verandaguy »

thegeomaster wrote: post #230
dirkt wrote: post #222

Earlier quoted context omitted.

Test how many SSL connections go the extra mile and secure themselves against Man in the Middle attacks. You'll be surprised.

All of them, since that's an explicit design goal of SSL/TLS?

https:// with no extra options is still very much prone to downgrade/stripping attacks, and first-time connections to an https:// site are particularly vulnerable since a lot of the extra hardening options (HSTS in particular) can be nullified through TOFU.
Post reply on HN