Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Hacked a Router

disconnected.io

Post reply on HN
Print view View original

31–40 of 96 posts

Re: How I Hacked a Router

#31

Post by thaumaturgy »

siliconc0w wrote: post #21

Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.

Well, I was all set to explain that SPF only checks the envelope sender, not the from: address header that is displayed to the user.

Then I decided to test it, and in fact Gmail does seem to be doing more than that. I ran a two-line script as root from my mail server to send a message with an envelope-sender from my domain (which has a basic SPF txt record in its DNS) and a from: header from LinkedIn, and Gmail spit it back at my return address a moment later saying that it smelled like spam. So, good for Gmail!

But, I don't think this is common behavior, and the article doesn't actually say that the target has a Gmail account.

Re: How I Hacked a Router

#32

Post by krick »

thaumaturgy wrote: post #31
siliconc0w wrote: post #21

Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.

Well, I was all set to explain that SPF only checks the envelope sender, not the from: address header that is displayed to the user. Then I decided to test it, and in fact Gmail does seem to be doing more than that. I ran a two-line script as root from my mail server to send a message with an envelope-sender from my domain (which has a basic SPF txt record in its DNS) and a from: header from LinkedIn, and Gmail spit…

> But, I don't think this is common behavior

It pretty much is. The actual settings vary between different mail providers and this is actually more complicated than checking header against sender IP. So everything is possible, but that mail-sending part needs more explanation anyway.

Re: How I Hacked a Router

#33

Post by jlgaddis »

krick wrote: post #24
jlgaddis wrote: post #22

Earlier quoted context omitted.

I'd go along with that, assuming that RouterOS is replaced by OpenWRT or FreeBSD.

Do you think configuring OS for your router manually would leave less chance for it to be broken? I suspect I'd leave more holes setting up all the stuff myself, than relying on MikroTik folks knowledge. Besides, are there some step-by-step guides/checklists that would help build secure environment for your router/PC?

I should probably say that I have a dislike of (and am biased against) MikroTik because of their disregard of the GPL. For the price, though, I think the hardware is generally pretty decent.

Anyway, I don't feel real confident in the security of the RouterOS software although I don't have any hard or articulable reasons for that. It's just a "gut feeling", I suppose.

I do have much more confidence in both OpenWRT and FreeBSD. If you're just using the device as a home router/firewall, you don't really need many (if any) daemons running and exposed so the attack surface is pretty minimalized. My own router at home came with RouterOS on it (although it's not MikroTik hardware) but I replaced it with OpenBSD.

Re: How I Hacked a Router

#34

Post by jwcrux »

thaumaturgy wrote: post #31
siliconc0w wrote: post #21

Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.

Well, I was all set to explain that SPF only checks the envelope sender, not the from: address header that is displayed to the user. Then I decided to test it, and in fact Gmail does seem to be doing more than that. I ran a two-line script as root from my mail server to send a message with an envelope-sender from my domain (which has a basic SPF txt record in its DNS) and a from: header from LinkedIn, and Gmail spit…

Sure - SPF may very well only check the envelope sender, but isn't that usually plenty? If you can't spoof the Linkedin envelope sender, and the mail goes to SPAM, who cares if the From: address is spoofed? The user likely won't see it anyway.

Re: How I Hacked a Router

#35

Post by kalleboo »

revelation wrote: post #27
ushi wrote: post #2

Interesting read. On thing i do not understand is why software updates/packages are still not cryptographically signed. It's a common thing on Linux. Notepad++ provides checksums[0] for their packages - so (i assume) they are actually aware of the problem. [0] http://sourceforge.net/p/notepad-plus/discussion/1290588

It's common on Linux because they use package managers where you only have to implement that functionality once. Every PoS app on Windows and OSX has its own update process, which mostly is just downloading and running the new setup binary. This happens even with software where you would think the manufacturer is aware of this kind of problem. 1Password downloaded updates over HTTP for a long time, then switched to H…

> Every PoS app on Windows and OSX has its own update process, which mostly is just downloading and running the new setup binary.

Most OS X apps use either the Mac App Store, which signs everything, or Sparkle[0], which last time I used it made it really hard to use it without signing things. It's only stuff from big vendors like Adobe and Microsoft who do custom stuff you can't really trust.

[0] http://sparkle.andymatuschak.org

Re: How I Hacked a Router

#36

Post by thaumaturgy »

jwcrux wrote: post #34
thaumaturgy wrote: post #31

Earlier quoted context omitted.

Well, I was all set to explain that SPF only checks the envelope sender, not the from: address header that is displayed to the user. Then I decided to test it, and in fact Gmail does seem to be doing more than that. I ran a two-line script as root from my mail server to send a message with an envelope-sender from my domain (which has a basic SPF txt record in its DNS) and a from: header from LinkedIn, and Gmail spit…

Sure - SPF may very well only check the envelope sender, but isn't that usually plenty? If you can't spoof the Linkedin envelope sender, and the mail goes to SPAM, who cares if the From: address is spoofed? The user likely won't see it anyway.

Anybody that can run sendmail as root (or use an alternate program, or compile their own) can spoof the envelope sender.

Re: How I Hacked a Router

#37

Post by jwcrux »

thaumaturgy wrote: post #36
jwcrux wrote: post #34

Earlier quoted context omitted.

Sure - SPF may very well only check the envelope sender, but isn't that usually plenty? If you can't spoof the Linkedin envelope sender, and the mail goes to SPAM, who cares if the From: address is spoofed? The user likely won't see it anyway.

Anybody that can run sendmail as root (or use an alternate program, or compile their own) can spoof the envelope sender.

Ah, gotcha. You're saying that you sent an email with a valid envelope sender from your domain, with only a spoofed From: address, and gmail sent it back. If so, nice!

Re: How I Hacked a Router

#40

Post by afro88 »

revelation wrote: post #39
siliconc0w wrote: post #21

Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.

The mail was just the CSRF attack vector, anyway. Could've just sent him a random short link over IM..

... that he wouldn't have clicked because who clicks random links over IM
Post reply on HN