Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Want to use my wifi?

thejh.net

Post reply on HN
Print view View original

31–40 of 57 posts

Re: Want to use my wifi?

#31

Post by philwelch »

MichaelGG wrote: post #16
chrissnell wrote: post #14

I've been thinking about the possibility of injecting a JavaScript bitcoin miner into every page loaded through my access point. Imagine the possibilities for an open AP that's located in a very public place, like Times Square, or near a busy Starbucks (where access is slow and unreliable). If you really wanted to take this to the evil next level, you'd just break one (or several) WPA keys on nearby APs and have your…

Is that even remotely lucrative? As I understand, even a $300 GPU is orders of magnitude more powerful than any CPU miner, let alone a JavaScript based one. And even a single GPU isn't remotely competitive these days compared to the GPU farms and now ASIC setups. So you'd need to inject JS into, I dunno, a million, devices to make anything worthwhile.

Stealing is lucrative, not because it's an efficient use of available resources, but because it allows the thief to profit at the expense of others.

Re: Want to use my wifi?

#32

Post by culturestate »

icebraining wrote: post #26
tcas wrote: post #13

Earlier quoted context omitted.

Haven't used sidestep, but sshuttle [1] is a nice command line utility that does the same, just not automatically. Much easier than setting up a VPN server. [1] https://github.com/apenwarr/sshuttle

It's easier (and I'm a fan as well), but setting up an OpenVPN server with pre-shared key is very easy too. It's essentially a matter of apt-getting openvpn and writing a three line config file: http://openvpn.net/index.php/open-source/documentation/misce...

One of the advantages of using SSH is that it almost always works, even in environments (think China) that actively block detected VPN connections. SSH running on port 443 looks a lot like HTTPS.

Re: Want to use my wifi?

#33

Post by _delirium »

philwelch wrote: post #31
MichaelGG wrote: post #16

Earlier quoted context omitted.

Is that even remotely lucrative? As I understand, even a $300 GPU is orders of magnitude more powerful than any CPU miner, let alone a JavaScript based one. And even a single GPU isn't remotely competitive these days compared to the GPU farms and now ASIC setups. So you'd need to inject JS into, I dunno, a million, devices to make anything worthwhile.

Stealing is lucrative, not because it's an efficient use of available resources, but because it allows the thief to profit at the expense of others.

It still has to add up to something significant if you want to make real money at it; stealing a few pennies here and there is not that lucrative. A typical recent-gen CPU mining bitcoins full-time is worth about $0.02/month. If you assume your AP is in a busy enough location that you can average 100 people connected, you'll manage to nab $2 of people's CPU time each month. To get anything significant it seems like you'd have to actually compromise the machines long-term, not just inject some JS into pages as they're browsing.

Re: Want to use my wifi?

#34

Post by simgidacav »

> Commandline snippet poisoning

Really? So would you blindly copy-paste things into your shell? Then I don't need to hijack your connections, I just put malicious pastes on the website.

If you are moron enough to copy-paste the first thing you find, you are probably not reading the other users' warnings about "this answer is wrong".

Re: Want to use my wifi?

#35

Post by Lazare »

simgidacav wrote: post #34

> Commandline snippet poisoning Really? So would you blindly copy-paste things into your shell? Then I don't need to hijack your connections, I just put malicious pastes on the website. If you are moron enough to copy-paste the first thing you find, you are probably not reading the other users' warnings about "this answer is wrong".

The attack mentioned is to change the text when you go to copy it; that will get even people who carefully read every forum post before copying and pasting.

How many people review the snippet, copy, paste it into a text editor, re-review it, copy it, and then paste it into their shell?

Re: Want to use my wifi?

#36

Post by simgidacav »

Lazare wrote: post #35
simgidacav wrote: post #34

> Commandline snippet poisoning Really? So would you blindly copy-paste things into your shell? Then I don't need to hijack your connections, I just put malicious pastes on the website. If you are moron enough to copy-paste the first thing you find, you are probably not reading the other users' warnings about "this answer is wrong".

The attack mentioned is to change the text when you go to copy it; that will get even people who carefully read every forum post before copying and pasting. How many people review the snippet, copy, paste it into a text editor, re -review it, copy it, and then paste it into their shell?

I deem your point good. I didn't realize it entirely.

Still, since when I run GNU/Linux I never pasted a command line from a website into my terminal. This is just reckless. Borderline case, I understand what the example is showing me and then I apply.

Re: Want to use my wifi?

#37

Post by fmavituna »

Inject something like XSS Tunnel (http://labs.portcullis.co.uk/download/XSS-Tunnelling.pdf that gives you a local proxy that you can point your local browser and then sends all of your traffic through the victim, so you'll see and use the website(s) with your victim's session), or BeeF - http://beefproject.com/ for tons of exotic XSS based exploits.

Re: Want to use my wifi?

#38

Post by lotsofcows »

username42 wrote: post #29
malandrew wrote: post #9

Earlier quoted context omitted.

How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? I've never set it up and was curious what others have done to make it as invisible as possible.

I do not know for VPN, I use ssh. It is very simple and does not require any system administration right. Install a proxy (squid) on your Amazon EC2. Install putty if you are on windows and launch it with port forward using the option -L: putty -L 3128:127.0.0.1:3128 user@host Add the option --proxy-server=127.0.0.1:3128 on you chrome shortcut and that's it.

That'll tunnel your http traffic which is a good start but it's worth checking out ssh -D for an easy SOCKS proxy.

Re: Want to use my wifi?

#39

Post by lotsofcows »

mschuster91 wrote: post #2

Just for teh lulz, you could do ARP-spoofing on public wifi's too, and achieve the same effect wthout having the trouble of setting up a hotspot. I admit of having spoofed a Burger King public WiFi and replacing all img-tag sources with Goatse. Priceless reactions everywhere ;)

I like BT OpenZone in the UK. It seems everyone has connected to one of these at some point so you just create an ad hoc wireless connection with the same SSID and most modern smartphones automatically connect and start trying to download mail and facebook updates.

Re: Want to use my wifi?

#40

Post by andrewaylett »

Lazare wrote: post #35
simgidacav wrote: post #34

> Commandline snippet poisoning Really? So would you blindly copy-paste things into your shell? Then I don't need to hijack your connections, I just put malicious pastes on the website. If you are moron enough to copy-paste the first thing you find, you are probably not reading the other users' warnings about "this answer is wrong".

The attack mentioned is to change the text when you go to copy it; that will get even people who carefully read every forum post before copying and pasting. How many people review the snippet, copy, paste it into a text editor, re -review it, copy it, and then paste it into their shell?

Ctrl-X Ctrl-E in bash will open an editor for the current command, which is executed when the editor is exited. After the potential for exploit was publicised a few months ago, I use this every time and it's really not much more effort than just pasting into the shell. As a bonus, it means I don't have to worry about embedded newlines stopping me from tweaking the command before running it.
Post reply on HN