4 ms·

Yeah, I have no idea how it could accomplish what is alleged. Just lots of very bad no good end of world comments. Have none of these people ever used public wi

Yeah, I have no idea how it could accomplish what is alleged. Just lots of very bad no good end of world comments. Have none of these people ever used public wifi?

ghaff 8y ago
It's clearly not good to have an unknown but presumptively malicious in some way, shape, or form computer on your home network. And I would be cautious about uploading the device's file system and strongly consider changing various passwords. But, yeah, it's not like the computer suddenly has root access to everything else on the network.
dstjean 8y ago
To name a few: - ARP Poisoning - DNS Poisoning - LM Hashes gathering - Packet Sniffing - Packet Interception (and modification)
PhantomGremlin 8y ago
Have none of these people ever used public wifi? This situation is totally totally unlike public wifi! When I connect to public wifi, the attack surface into my laptop is the external interface of the latest MacOS, with firewall on. Perhaps there are exploits against that, but they're not common. The Mac does have pf, but I'm sure it's a way out of date version! :) OTOH, "this thing" on the inside of a router/firewall has complete unrestricted access to the LAN. At my house I have (and I just checked) 35 active IPs behind my firewall. It's not hard to get to that number for 4 people: iPhones, TiVos, laptops, desktops, access points, printers, gaming consoles. I confess I don't secure my LAN computers very well. I have, e.g. 3 letter passwords. That's simply to keep my kids from accidentally going where they shouldn't be. I'm not alone in my lax security. I do occasionally peruse exit traffic and check firewall logs, which probably puts me somewhere in the most secure 1% of "typical" households. And even if I were totally paranoid, what can I do about the Internet of shit? Am I supposed to strictly segment everything? At what point does prudence and caution drift into paranoia?
- ryandrake 8y ago
  My rule of thumb is: if i have root on the device, it can go behind my private LAN firewall. If I don’t have root, but the device requires Internet, it goes in the guest network which gets throttled and has no access to my LAN. I also scrutinize outbound more on this network. If I don’t have root and it doesn’t need Internet? It stays airgapped.
  - xoa 8y ago
    Decent rules of thumb, though even with root I'd base it more on whether the device really needs general access or not. Speaking of which, a corollary I use is: if an IOT device requires internet access it's automatically bad and I won't even consider it. If they want to offer some built-in but fully optional "access away from home" that wants to use their cloud that's fine, I can just block that anyway and use VPN. If it wants to access one specific address for updates (though you don't have to) or as an optional passive information feed I can see that. But anything IOT that depends on remote resources for its core functionality is right out. That eliminates a surprising number of IOT devices, but given the flood of crap I think that's no bad thing. These days being able to have something be LAN only with zero service tie-ins seems a decent low pass filter to narrow down choices before diving any deeper.
- xoa 8y ago
  >And even if I were totally paranoid, what can I do about the Internet of shit? Am I supposed to strictly segment everything? Frankly yes, or at least it should be in the back of your mind when you inevitably need to upgrade some gear down the road anyway and thus the marginal cost is lower. People on HN talking about Ubiquiti probably sounds like a broken record at this point and there are certainly other providers and solutions, but you should recognize that solid centralized management and VLAN functionality and the like now has fairly good SoHo options at SoHo pricing too. You don't need to run right out and buy stuff, particularly since 802.11ax looks like it'll be a much more significant general upgrade then anything since the original AC with its focus on more efficient utilization rather then theoreticals. But when you do, you should be getting something that lets you trivially soft-segment your network at will. At the least shoving IOT, any VoIP, and any cameras onto their own VLANs separate from your main systems is a good idea (not just for security but it can help performance too for VoIP, if you ever use it). At this point particularly with IOT I'd consider that a minimum required feature for any network gear to even be on the list for an upgrade. >At what point does prudence and caution drift into paranoia? At the point where hacks aren't trivially automatable for drive by and the difficulty of anything more is higher then the value of getting your stuff. When it comes to IOT though that point is regrettably a long long LONG way off, the security practices in that space are so utterly abysmal even before the typical practice of no updates ever comes in, assuming it's not actively backdoored. And of course this isn't just about you, IOT botnets are a threat to the whole net. There certainly can be histrionics around this stuff that aren't justified, but I don't think basic segmentation, firewalling, pi-hole, and (if you must have your IOT on the public net though really you should consider using a VPN instead please) strict IP whitelist access or at least rate limits are unreasonable at all. Certainly not for the HN crowd. We can do our parts at least for our own benefit, and maybe[0] even help keep a few coworkers/family/friends/neighbors from contributing their uplinks to DDOSing our stuff too. 0: I genuinely mean "maybe" there, I know very well the payless thankless time sink it can be to take on any sort of IT work after hours. Depends on what family and friends are like. Still, sometimes though fairly low commitment/high return tips are available, or some simple trade of skills, an afternoon helping set up a better network for an afternoon of them helping with something.

Yeah, I have no idea how it could accomplish what is alleged. Just lots of very bad no good end of world comments. Have none of these people ever used public wifi?

ghaff 8y ago

It's clearly not good to have an unknown but presumptively malicious in some way, shape, or form computer on your home network. And I would be cautious about uploading the device's file system and strongly consider changing various passwords. But, yeah, it's not like the computer suddenly has root access to everything else on the network.

dstjean 8y ago

To name a few: - ARP Poisoning - DNS Poisoning - LM Hashes gathering - Packet Sniffing - Packet Interception (and modification)

PhantomGremlin 8y ago

Have none of these people ever used public wifi? This situation is totally totally unlike public wifi! When I connect to public wifi, the attack surface into my laptop is the external interface of the latest MacOS, with firewall on. Perhaps there are exploits against that, but they're not common. The Mac does have pf, but I'm sure it's a way out of date version! :) OTOH, "this thing" on the inside of a router/firewall has complete unrestricted access to the LAN. At my house I have (and I just checked) 35 active IPs behind my firewall. It's not hard to get to that number for 4 people: iPhones, TiVos, laptops, desktops, access points, printers, gaming consoles. I confess I don't secure my LAN computers very well. I have, e.g. 3 letter passwords. That's simply to keep my kids from accidentally going where they shouldn't be. I'm not alone in my lax security. I do occasionally peruse exit traffic and check firewall logs, which probably puts me somewhere in the most secure 1% of "typical" households. And even if I were totally paranoid, what can I do about the Internet of shit? Am I supposed to strictly segment everything? At what point does prudence and caution drift into paranoia?

ryandrake 8y ago
My rule of thumb is: if i have root on the device, it can go behind my private LAN firewall. If I don’t have root, but the device requires Internet, it goes in the guest network which gets throttled and has no access to my LAN. I also scrutinize outbound more on this network. If I don’t have root and it doesn’t need Internet? It stays airgapped.
- xoa 8y ago
  Decent rules of thumb, though even with root I'd base it more on whether the device really needs general access or not. Speaking of which, a corollary I use is: if an IOT device requires internet access it's automatically bad and I won't even consider it. If they want to offer some built-in but fully optional "access away from home" that wants to use their cloud that's fine, I can just block that anyway and use VPN. If it wants to access one specific address for updates (though you don't have to) or as an optional passive information feed I can see that. But anything IOT that depends on remote resources for its core functionality is right out. That eliminates a surprising number of IOT devices, but given the flood of crap I think that's no bad thing. These days being able to have something be LAN only with zero service tie-ins seems a decent low pass filter to narrow down choices before diving any deeper.
xoa 8y ago
>And even if I were totally paranoid, what can I do about the Internet of shit? Am I supposed to strictly segment everything? Frankly yes, or at least it should be in the back of your mind when you inevitably need to upgrade some gear down the road anyway and thus the marginal cost is lower. People on HN talking about Ubiquiti probably sounds like a broken record at this point and there are certainly other providers and solutions, but you should recognize that solid centralized management and VLAN functionality and the like now has fairly good SoHo options at SoHo pricing too. You don't need to run right out and buy stuff, particularly since 802.11ax looks like it'll be a much more significant general upgrade then anything since the original AC with its focus on more efficient utilization rather then theoreticals. But when you do, you should be getting something that lets you trivially soft-segment your network at will. At the least shoving IOT, any VoIP, and any cameras onto their own VLANs separate from your main systems is a good idea (not just for security but it can help performance too for VoIP, if you ever use it). At this point particularly with IOT I'd consider that a minimum required feature for any network gear to even be on the list for an upgrade. >At what point does prudence and caution drift into paranoia? At the point where hacks aren't trivially automatable for drive by and the difficulty of anything more is higher then the value of getting your stuff. When it comes to IOT though that point is regrettably a long long LONG way off, the security practices in that space are so utterly abysmal even before the typical practice of no updates ever comes in, assuming it's not actively backdoored. And of course this isn't just about you, IOT botnets are a threat to the whole net. There certainly can be histrionics around this stuff that aren't justified, but I don't think basic segmentation, firewalling, pi-hole, and (if you must have your IOT on the public net though really you should consider using a VPN instead please) strict IP whitelist access or at least rate limits are unreasonable at all. Certainly not for the HN crowd. We can do our parts at least for our own benefit, and maybe[0] even help keep a few coworkers/family/friends/neighbors from contributing their uplinks to DDOSing our stuff too. 0: I genuinely mean "maybe" there, I know very well the payless thankless time sink it can be to take on any sort of IT work after hours. Depends on what family and friends are like. Still, sometimes though fairly low commitment/high return tips are available, or some simple trade of skills, an afternoon helping set up a better network for an afternoon of them helping with something.