5 ms·

I can see how the backdoor allows access to the router and makes the router itself part of the botnet. But where do they get... > This backdoor would allow

I can see how the backdoor allows access to the router and makes the router itself part of the botnet. But where do they get... > This backdoor would allow an attacker the ability to remotely control not only the routers, but also any devices connected to that network. How do you gain "control" of a device (presumably a PC) merely by having access to the router it is connected to? Is it just that we're assuming that a typical home network will be a soft target of PC's? What about windows defender firewall, and all that stuff?

knicholes 6y ago
I have the same question. Maybe if there's a process running with an open port on the network and has a known vulnerability, then someone can gain access to the system once they're on the network?
- colechristensen 6y ago
  If you can control the router you can inject vulnerabilities into normal traffic.
goatinaboat 6y ago
How do you gain "control" of a device (presumably a PC) merely by having access to the router it is connected to? ARP spoofing, DNS spoofing, UPnP...
deleted 6y ago
[deleted]
colechristensen 6y ago
The base assumption should always be that your network is breached and your devices vulnerable. With so much poorly supported “smart” devices on the market, a great deal of your life is easily compromised once somebody is inside your network. There’s no great promise that your PC is secure unless you’re rather well brushed up on security best practices.
javajosh 6y ago
It's safe to assume that whoever undermined these routers has access to a grab bag of exploits that they are free to attempt at will, and without any detection, for all time, because they own your router. I like to think I "run a tight ship" security-wise, but if a state-run botnet owned my router, I don't think it would take long for them to find a weakness and get a foothold into my PC, and it would, in general, be pretty hard for me to know about it happening since I rely on the router to tell me about network activity! (Personally, the best way to accomplish that goal in would be to require the owner to install an app to complete the router installation. The old, unpatched Android phones Wal-Mart shoppers use are generally easy to exploit I imagine. Although I expect that your app could ask for total control over the phone and all data sources, and people will just answer yes because they want their thing to work, and Wal Mart wouldn't sell it if it wasn't safe.)
glitchc 6y ago
In addition to other posters, firewall rules in Windows are far more permissive for internal networks than external ones. So if you have a setup where your laptop can RDP into your desktop with minimal credentials, someone gaining control of the router can access your desktop as well. If you do practice good security and require a username/password for the RDP session, the router can still spy on that traffic for the malicious remote. In addition, the remote can issue Remote Assistance requests. More nefariously, if your PC is not on the latest patch, which most PCs aren't, an exploit could be used to install a RAT or ransomware or equivalent. Are you using a NAS that is open to every machine on the internal network? If so, the remote will have a field day with your backups and shared data. In short, once the remote has gained access to your internal network, many types of attacks become possible.
- heleninboodler 6y ago
  > If you do practice good security and require a username/password for the RDP session, the router can still spy on that traffic for the malicious remote Wow, Microsoft added TLS to RDP way back in Windows Vista (cite: I worked on it), and they apparently still don't have it required by default, based on some blog posts I see from 2019 explaining how to force it on. That's shameful.
  - gruez 6y ago
    >Wow, Microsoft added TLS to RDP way back in Windows Vista (cite: I worked on it) Since you seem to be an expert on this, can you explain how exactly it's implemented? When connecting to a remote machine, the sequence of events goes something like this: 1. enter ip, click "connect" 2. login prompt shows up 3. enter username/password, click "ok" 4. self signed certificate warning shows up, asks me to accept/reject the certificate 5. after accepting the certificate, the connection succeeds and I can see the other machine. This sequence of events makes me think that the password authentication step isn't done over TLS at all, or is done over TLS but is vulnerable to MITM attacks. Can you confirm/deny whether this is accurate?
    - heleninboodler 6y ago
olufnaese 6y ago
I wonder how likely it is that fresh Linux installations are vulnerable in this way.
maerF0x0 6y ago
Existing exploits aside, controlling network access for your devices is a form of control too. One could, for example, deny all windows updates... then just wait for patch day and a new live exploit... Another thing is one could deny access to something you want to harm, such as walmart.com or whatever (in favor of ali baba)

knicholes 6y ago

I have the same question. Maybe if there's a process running with an open port on the network and has a known vulnerability, then someone can gain access to the system once they're on the network?

colechristensen 6y ago
If you can control the router you can inject vulnerabilities into normal traffic.

goatinaboat 6y ago

How do you gain "control" of a device (presumably a PC) merely by having access to the router it is connected to? ARP spoofing, DNS spoofing, UPnP...

deleted 6y ago

[deleted]

colechristensen 6y ago

The base assumption should always be that your network is breached and your devices vulnerable. With so much poorly supported “smart” devices on the market, a great deal of your life is easily compromised once somebody is inside your network. There’s no great promise that your PC is secure unless you’re rather well brushed up on security best practices.

javajosh 6y ago

It's safe to assume that whoever undermined these routers has access to a grab bag of exploits that they are free to attempt at will, and without any detection, for all time, because they own your router. I like to think I "run a tight ship" security-wise, but if a state-run botnet owned my router, I don't think it would take long for them to find a weakness and get a foothold into my PC, and it would, in general, be pretty hard for me to know about it happening since I rely on the router to tell me about network activity! (Personally, the best way to accomplish that goal in would be to require the owner to install an app to complete the router installation. The old, unpatched Android phones Wal-Mart shoppers use are generally easy to exploit I imagine. Although I expect that your app could ask for total control over the phone and all data sources, and people will just answer yes because they want their thing to work, and Wal Mart wouldn't sell it if it wasn't safe.)

glitchc 6y ago

In addition to other posters, firewall rules in Windows are far more permissive for internal networks than external ones. So if you have a setup where your laptop can RDP into your desktop with minimal credentials, someone gaining control of the router can access your desktop as well. If you do practice good security and require a username/password for the RDP session, the router can still spy on that traffic for the malicious remote. In addition, the remote can issue Remote Assistance requests. More nefariously, if your PC is not on the latest patch, which most PCs aren't, an exploit could be used to install a RAT or ransomware or equivalent. Are you using a NAS that is open to every machine on the internal network? If so, the remote will have a field day with your backups and shared data. In short, once the remote has gained access to your internal network, many types of attacks become possible.

heleninboodler 6y ago
> If you do practice good security and require a username/password for the RDP session, the router can still spy on that traffic for the malicious remote Wow, Microsoft added TLS to RDP way back in Windows Vista (cite: I worked on it), and they apparently still don't have it required by default, based on some blog posts I see from 2019 explaining how to force it on. That's shameful.
- gruez 6y ago
  >Wow, Microsoft added TLS to RDP way back in Windows Vista (cite: I worked on it) Since you seem to be an expert on this, can you explain how exactly it's implemented? When connecting to a remote machine, the sequence of events goes something like this: 1. enter ip, click "connect" 2. login prompt shows up 3. enter username/password, click "ok" 4. self signed certificate warning shows up, asks me to accept/reject the certificate 5. after accepting the certificate, the connection succeeds and I can see the other machine. This sequence of events makes me think that the password authentication step isn't done over TLS at all, or is done over TLS but is vulnerable to MITM attacks. Can you confirm/deny whether this is accurate?
  - heleninboodler 6y ago

olufnaese 6y ago

I wonder how likely it is that fresh Linux installations are vulnerable in this way.

maerF0x0 6y ago

Existing exploits aside, controlling network access for your devices is a form of control too. One could, for example, deny all windows updates... then just wait for patch day and a new live exploit... Another thing is one could deny access to something you want to harm, such as walmart.com or whatever (in favor of ali baba)