13 ms·

Did a weak WiFi password lead police to our door?

162 points by bananapear 5y ago

foobar33333 5y ago
This is a pretty nasty situation that could happen to anyone. It might not have even been the wifi password. Any malware could have set up a vpn and done the same thing. Of course it's important to stop real crime but there has to be some improvements here. At the very least they could have collected the passwords for the devices and dumped the storage to be investigated later rather than leaving these people without their essential devices for 3 months.
- azalemeth 5y ago
  It's worth noting that if they didn't hand over the passwords they're automatically liable for an offence whose punishment is two years in gaol, and all the police need to prove is that it is likely that they did know them. One of the quotes of the article describes the husband getting what is presumably an admin key from work for a Windows laptop -- if the crown wanted to, that alone would be enough to utterly throw him under the bus. I honestly have an irrational fear of this happening to me. It's a great way for a malicious actor to utterly wreck someone's life. I tunnel all outbound traffic over a supposedly privacy-preserving (or at least non-UK) VPN, but honestly, this is the dystopian stuff of my nightmares. And I don't know why!
  - alibarber 5y ago
    How do you tunnel your traffic though? Unless you can be sure it's forcing everything on your wifi network through it, then that wouldn't offer any protection to someone else using it without the tunnel, as is assumed to happen in this case.
    - slimsag 5y ago
      A lot of WiFi routers actually support plugging in VPN details in the router software itself, it's not complex at all[0] even for your average consumer. [0] https://www.expressvpn.com/vpn-software/vpn-router#recommended-routers https://www.expressvpn.com/vpn-software/vpn-router#recommend...
      - rnotaro 5y ago
        I believe you're over estimating the skills of the average consumer. The average consumer usually don't even know how to access their router' web interface.
    - azalemeth 5y ago
      As the other poster here says, I just configure it at the network level: my default gateway is a single-board computer set up to act as a router and intercept and rebind DNS. It's not hard, seamlessly works, and is quite fast via wireguard. My VPN provider also provides a reverse port to provide convenient ssh tunneling into the SBC "bastion host" which I have configured to use a random port, changing IP addresses, and only accept certificate-based authentication.
- andyjh 5y ago
  My first thought was that it's more likely something like this than a bad actor on their wifi: https://en.wikipedia.org/wiki/Hola_%28VPN%29 https://en.wikipedia.org/wiki/Hola_%28VPN%29 Anyone with that browser extension installed on any device on their network is making themselves an open VPN exit for millions of random people.
- ixfo 5y ago
  Collecting passwords and dumping the storage is likely all they did. 3 months is fairly prompt for any kind of "cyber" in the UK to even get a brief look at, due to huge processing backlogs in the overworked departments whose job it is to deal with it. I'd suspect that what happened here is they thought they had an easy win, went through the motions, determined fairly rapidly from interviews etc it wasn't actually a viable lead, and didn't pursue further. But the machinery is set in motion by the initial conversation, for fear of prompt deletion if the storage is left with the would-be perp.
bserge 5y ago
Those routers don't have particularly bad default passwords iirc, 12-14 random chars, which is better than the vast majority of user-set passwords. I don't remember if it uses WPS 1.0 (why is there even a 2.0 of this horrible "feature"?), that would be the easiest way to access any router. Why would the would-be hacker need access to the router settings? I can't think of anything worth changing there, these routers don't have any extra features. The usual illicit use is to point an antenna at a router and use it from afar (well, no more than 100-300m, line of sight and preferably no obstructions). In which case it makes more sense to just get a prepaid SIM card, set up a phone as a VPN in a location far from you and route traffic through it. It's not more complicated than bruteforcing a WPS PIN or WPA2 password. That is, if you can't just get a VPN without using any ID.
- Orphis 5y ago
  I remember stories of the default password being a weak hash of the SSID. And when those are "ISPNAME-4DIGITS", it's not too hard to collect them all. Sometimes, they can be retrieved from the MAC address as well. So it's just the illusion of security for most.
  - serf 5y ago
    verizon just recently stopped defaulting the wep key to a very simple hash derived from the ssid and mac.[0][1] [0]: https://www.xkyle.com/verizon-fios-wireless-key-calculator/ https://www.xkyle.com/verizon-fios-wireless-key-calculator/ [1]: https://aruljohn.com/fios/ https://aruljohn.com/fios/
    - yrro 5y ago
      Verizon CPE still uses WEP?!!?
      - serf 5y ago
        I don't know about elsewhere , but Frontier took over FiOS management in some regions and continued to push those same APs for a long while.
exporectomy 5y ago
> "They took everything: our desktop computer, both our laptops, our mobile phones, a laptop I had borrowed, even old mobile phones that were lying around in drawers," Worth considering when making backups. A burglary, fire, virus or hacker won't do this but the police may take your offsite backups and your onsite ones and your computer with the credentials to your online backup service.
- neolog 5y ago
  What are the backup options for this situation?
  - kstenerud 5y ago
    Anything offsite.
  - foobar33333 5y ago
    Append only backups. With some services you can get it so you can only create a backup every X days and it is impossible to delete backups before they expire.
  - philjohn 5y ago
    Backblaze?
    - exporectomy 5y ago
      They delete it after 6 months if you don't connect, which would happen if the police had it. You also might not be able to log in without your phone for 2FA or your password manage for the password. I guess storing backups on a device that's the property of somebody else would be a way. I'm guessing they won't go seizing non-suspects' property.
bloqs 5y ago
This stinks of IPV4 collision/exaustion and the NCA somehow basing this purely on an IP address
- figassis 5y ago
  My question exactly. Could the ISP not have simply reallocated the ipv4 lease so that they could maybe get a history of router macs associated with that IP?
kstenerud 5y ago
I suspect that the future of online crime will use bystander computers to do their dirty work. It would actually be quite simple to do: - Infect the computer via the normal means - Connect to a CNC relay and await instructions - Receive instructions and perform the deed The most important aspect would be to use a non-persistent compromise so that it leaves no trace when the police arrive and unplug the computer to bring it in for forensic analysis. With the trail ending at this computer and no sign of infection, they have their perp; case closed. Criminal organizations could even offer a SAAS solution - a kind of "crime as a service", where they rent you the infrastructure of ephemeral compromised machines to use.
- pjc50 5y ago
  This already happens with botnets. It's just that the nonces are a lot less organized.
- gnfargbl 5y ago
  > Criminal organizations could even offer a SAAS solution - a kind of "crime as a service", where they rent you the infrastructure of ephemeral compromised machines to use. There is already an entire industry offering "residential proxies," which are relays with the functional characteristics you describe. The difference is that the machines providing the relay are (typically) co-opted by adware etc, rather than being overtly compromised. I believe there may also be some operators who actually own the relay nodes.
  - daniellarusso 5y ago
    Quick google search found this one: https://oxylabs.io/products/residential-proxy-pool https://oxylabs.io/products/residential-proxy-pool
- pentae 5y ago
  You just described a botnet, which have been around for about 20 years
- jeroenhd 5y ago
  Back when Netflix was a US exclusive, I've tried the Hola proxy addon. Hola basically turned/turned your computer into a proxy and, in exchange, let(x) you use other people's computer as a proxy. That's all pretty great when it comes to foreign Netflix, but it's also an easy way to get other people convicted for posting child porn. I don't think there's a lot of security going on on that network. And you don't even need a special criminal organisation to abuse such a system, you have actual normal, civilian users!
cute_boi 5y ago
Is UK police so dumb that they suspect people solely based on ipv4? A malware can always attack a computer and set up vpn etc. There can be many thing so UK police please stop your nonsense. Do they even realize how much tragedy those innocent people had to face due to their silliness?
- pilif 5y ago
  > Is UK police so dumb that they suspect people solely based on ipv4? It’s not dumb. It’s very practical. Very easy conviction and it entirely turns the burden of proof over to the accused who now have to prove their innocence which is much harder to do especially as they probably lack the resources to do so. If success is measured in amount of convictions and/or arrests, going with just the IP address is the easiest road to success. Articles like this are incredibly important to make it clear to judges that an IP address is not sufficient evidence. This is not common knowledge yet
  - exhilaration 5y ago
    On might consider disabling the WiFi password entirely so there's plausible deniability if this happens. Pitch it as a public service. Maybe set up a separate router or VLAN and cap the bandwidth.
    - hhvn 5y ago
      Then you would have to prove that it's someone who used the service not you. The burden of proof is not on the accusor.
    - fnord77 5y ago
      has this ever been tested in court?
    - foobar33333 5y ago
      Sure, but you still end up with all of your devices seized for months and data dumped while you explain that you run an unprotected wifi router.
tomxor 5y ago
This is due to the UK's new "Internet Connected Records IP" act (from the infamous snoopers charter that passed in 2016). I'm holding Theresa May directly responsible for this family's hellish experience. Previous HN: https://news.ycombinator.com/item?id=26430266 https://news.ycombinator.com/item?id=26430266 The most complete solution I can think of to recommend to people to protect themselves from this insane law is to route all traffic over a VPN at the router. Otherwise you have to be worried about every single device that connects to your router - and you will just end up looking like a jerk when you don't let your friends use your internet out of fear of malware.
- raldi 5y ago
  The act introduced a new power that, among many other things, could force ISPs – upon being ordered to do so by a senior judge – into logging the Internet Connection Records (ICR) of all their customers for up to 12 months (e.g. the IP addresses of the servers you’ve visited and when), which can be accessed without a warrant and occurs regardless of whether or not you’re suspected of a crime.
- latexr 5y ago
  A VPN isn’t a solution, it’s a workaround. A solution would be to change the law. Pressure your law makers and your fellow voters. It’s worrying that every time there’s a problematic internet law, the response is “use a VPN”. I even saw that suggestion where it would be downright useless—the European law to require upload filters. If the recommendation is always to use VPNs and otherwise keep quiet, those in power can calmly strip you of every right and ban VPNs at the end. What do you do then?
  - ancarda 5y ago
    [deleted]
    - aurelianito 5y ago
      They legally ban them. If you are catched using one you go to jail.
ytch 5y ago
On the other hand, what if I setup a password-less Wifi without logging, encrypt all my devices, then do malicious with my home network. Can I claim they cannot arrest me since everyone might use my Wifi?
- kawsper 5y ago
  You can get a 2 year trip to prison for contempt of court if you refuse to decrypt your devices for the court. > The Regulation of Investigatory Powers Act 2000 (RIPA), Part III, activated by ministerial order in October 2007,[20] requires persons to supply decrypted information and/or keys to government representatives with a court order. Failure to disclose carries a maximum penalty of two years in jail https://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom https://en.wikipedia.org/wiki/Key_disclosure_law#United_King... You can read the full law here: https://www.legislation.gov.uk/ukpga/2000/23/part/III https://www.legislation.gov.uk/ukpga/2000/23/part/III
- patrakov 5y ago
  In Russia this is explicitly illegal (even if you give all device passwords to the police) - you must identify all people who have access to your network, i.e. not let unidentified people in, or go to jail if there is a possibility for strangers to connect, even if nobody actually connected.
xorcist 5y ago
While plausible, it's very likely not worth the bother to crack this couple's wifi passphrase. For all this work it leak the attacker's general geographic area anyway. More likely is that the ISP messed up their logs, or that they were incomplete. That happens more often than they would like to admit.
- tomxor 5y ago
  This is a real concern, especially in the age of carrier grade NAT. Vodafone (the families ISP), is a mobile ISP which dynamically pass IPs around like hot potatos - their monitoring solutions need to be far more sophisticated to keep accurate records... this feels a bit like the start of another Royal Mail "the computer is right" scenario but at a larger scale.
  - worldofmatthew 5y ago
    Not just that, the default logging for almost all server software does not log ports or have second by second accurate timestamps. Often making it only possible to track down someone using a less popular website as the data will be too noisy without information on top websites.
- geek_at 5y ago
  Something similar (but not relating to CSAM) happened to me (though not the ISPs fault). I was on IRC and someone I have talked to a few times sent me a official looking link to the website of a local political party and it was a sub-folder that had indexing enabled and that's where they stored their backups. The dude then got in and published all usernames and hashed passwords on pastebin. He was using a VPN at the time, I wasn't.. The police took all my devices and kept them for a year until charges were dropped. Not a fun time. I wrote about it here -> https://blog.haschek.at/2015-that-not-so-awesome-time-the-police https://blog.haschek.at/2015-that-not-so-awesome-time-the-po...
  - sumedh 5y ago
    You should submit that link as a new post.
Nextgrid 5y ago
I would not expect this to be a local attack via wifi. Internet is so cheap/free nowadays, why would you go through the trouble to crack someone’s wifi instead of using a public one + VPN or Tor? I believe this was a remote attack. Either on their computers, phones or router. Consumer-grade network equipment is notoriously insecure and Vodafone has absolutely zero expertise let alone incentive to do anything about it - they just buy these routers wholesale from China for a couple bucks a piece and call it a day.
- waihtis 5y ago
  Public has considerable risk too, with a chance of having yourself physically leaving a trace into a security camera (especially in the UK) That said you’re completely right on the state of ISP router security
aritmo 5y ago
How about suing the ISP for lax security relating to the home router?
isaacremuant 5y ago
This is not a tech security issue. This is a government issue. Having the power of nearly destroying your life for suspecting you of a crime. Society so caught up in guilty until proven innocent. Justice wasn't swift either. They disrupted their life and this couple is expected to bear all the costs of the govs wrong action. It's not about finding ways to keep yourself safe so that the gov can't accuse you of something and destroy you (see swatting), it's about the gov not being able to destroy you with such ease.
UweSchmidt 5y ago
So, to what device should one "upgrade to"? Would it help much to have a hardware firewall at home or hide the wifi?
- Nextgrid 5y ago
  Use the ISP-provided router as a modem in bridge mode (so it's essentially invisible from the network) and put an enterprise-grade router behind it that you keep up to date and disable any unneeded services (so no web interface, telnet, SSH, etc - at least not on the public-facing interface). This obviously isn't immune to a zero-day, but at this point you'd be more secure than 99% of the rest of the people so any attacker will just move on (why bother breaking into this router when you have an exploit that will net you hundreds of other ones with much less effort?)
  - UweSchmidt 5y ago
    Thanks!
kfprt 5y ago
England is basically a third world country in terms of legal rights. They brought back double jeopardy! https://en.wikipedia.org/wiki/Double_jeopardy#Post-2003 https://en.wikipedia.org/wiki/Double_jeopardy#Post-2003
- LatteLazy 5y ago
  And equally shit with any sort of tech law. The couple were quite lucky. For a while there was about a 5 year backlog of computers (plus phones, ipad etc) waiting for the police to even look at. Imagine waiting 5 years to be cleared of this...
- theduder99 5y ago
  I don't really understand the concept here. Taken to the extreme: a murderer is acquitted then the next day concrete evidence is found proving their guilt 100%, do they still walk free because they can't be tried again?
  - mhuffman 5y ago
    That is correct, but the intent of the double jeopardy laws are to stop people from being perpetually retried for a crime by someone that is convinced they have the right person (ie. every cop and DA that ever lived!) and holding the threat of that over them the rest of their life even though the case has already been adjudicated. What you described is an unfortunate loophole in this concept.
    - londons_explore 5y ago
      The UK requires 'substantial' new evidence to re-try a case. So far, it seems that hasn't been widely abused in the way you suggest. A court is the one who decides if new evidence is substantial or not - simple things like 'we found 11 of his footprints in the snow, but a re-re-review of the photos actually finds 12!" wouldn't cut it...
      - Karunamon 5y ago
antattack 5y ago
Maybe UK (and everyone else) needs a law that requires anyone manufacturing an Internet-connected device to set unique passwords or force users to change the password before they can use it, like California's (SB-327).
- Anthony-G 5y ago
  From the featured article: > The government plans to ban default passwords being pre-set on devices, as part of upcoming legislation covering smart devices.
  - LocalH 5y ago
    I hope that only mean they plan to ban non-unique default passwords, rather than requiring users to set up their own password during setup. The latter is a sure-fire ticket to tons of “password” “12345678” “11111111” type passwords.
- mgerdts 5y ago
  SB-327 says: it shall be deemed a reasonable security feature under subdivision (a) if either of the following requirements are met: (1) The preprogrammed password is unique to each device manufactured. I read this as a password based on the mac address or serial number would be compliant without meeting what I think is the intent of this law.
ExodusAnon 5y ago
Most people are assuming the password was brute forced rather than it being a deauthentication attack. ISP provided routers (what the majority of people use) are so badly designed and left vulnerable it should be illegal. Heck some ISPs here still refuse to use IPv6.
Zak 5y ago
Some of the information in this article seems pretty inaccurate: > they would have to be within about 20 metres of the house Using a directional antenna, they could be substantially farther away. > to do anything particularly sinister on the home network, the hacker will need to change the router configuration That's not even remotely accurate. Uploading child abuse images to a message board as in the central story this article covers does not require configuration changes, for example. Trying exploits on other devices connected to the network doesn't either.
- londons_explore 5y ago
  Some models of router are pretty easy to run code on. You could then run code on it to give you a permanent 'bounce' IP address, which you could then use from anywhere on the globe.
- fortran77 5y ago
  Just for grins, we put the biggest "Wi-Fi" yagi we could find on a mast on top of our building (along with some other antennas). We've picked up IDs from WiFi from at least a mile away and can get solid connections to a few places with public WiFi for about half that distance. You could easily disguise a WiFi yagi inside or among TV antennas.
- LatteLazy 5y ago
  You're not wrong about the antenna, but I am confused who would do any of this for 4 images? Either parking outside or sitting 1km away with an antenna, isn't this a megatonne more work (and technical knowledge) than just downloading tor. Given that I felt it was understandable to just jump that whole question even if it is factually incorrect...
  - Zak 5y ago
    It's probably not the most effective way to go about sharing illegal content if that's the end goal, but if you want to frame someone else for uploading illegal content....
adriancr 5y ago
I wonder if it was someone (guest or otherwise) that was sharing network in exchange for money or crypto tokens and not even realizing it... I've been spammed quite a bit by friends with such applications past 6 months...
Saris 5y ago
Boy their 'security consultant' doesn't seem to know much about wifi and wifi routers.
upofadown 5y ago
So that means that anyone with access to my computer can put child porn on it and then report it? What exactly would the people involved of been guilty of if the 4 images were found on their computer?
ficklepickle 5y ago
A VPN service could have caused this issue. Plenty of them route traffic through their users internet connections. It's the easiest way to get residential IPs that won't be blocked by streaming sites.

162 points by bananapear 5y ago

This is a pretty nasty situation that could happen to anyone. It might not have even been the wifi password. Any malware could have set up a vpn and done the same thing. Of course it's important to stop real crime but there has to be some improvements here. At the very least they could have collected the passwords for the devices and dumped the storage to be investigated later rather than leaving these people without their essential devices for 3 months.

azalemeth 5y ago
It's worth noting that if they didn't hand over the passwords they're automatically liable for an offence whose punishment is two years in gaol, and all the police need to prove is that it is likely that they did know them. One of the quotes of the article describes the husband getting what is presumably an admin key from work for a Windows laptop -- if the crown wanted to, that alone would be enough to utterly throw him under the bus. I honestly have an irrational fear of this happening to me. It's a great way for a malicious actor to utterly wreck someone's life. I tunnel all outbound traffic over a supposedly privacy-preserving (or at least non-UK) VPN, but honestly, this is the dystopian stuff of my nightmares. And I don't know why!
- alibarber 5y ago
  How do you tunnel your traffic though? Unless you can be sure it's forcing everything on your wifi network through it, then that wouldn't offer any protection to someone else using it without the tunnel, as is assumed to happen in this case.
  - slimsag 5y ago
    A lot of WiFi routers actually support plugging in VPN details in the router software itself, it's not complex at all[0] even for your average consumer. [0] https://www.expressvpn.com/vpn-software/vpn-router#recommended-routers https://www.expressvpn.com/vpn-software/vpn-router#recommend...
    - rnotaro 5y ago
      I believe you're over estimating the skills of the average consumer. The average consumer usually don't even know how to access their router' web interface.
  - azalemeth 5y ago
    As the other poster here says, I just configure it at the network level: my default gateway is a single-board computer set up to act as a router and intercept and rebind DNS. It's not hard, seamlessly works, and is quite fast via wireguard. My VPN provider also provides a reverse port to provide convenient ssh tunneling into the SBC "bastion host" which I have configured to use a random port, changing IP addresses, and only accept certificate-based authentication.
andyjh 5y ago
My first thought was that it's more likely something like this than a bad actor on their wifi: https://en.wikipedia.org/wiki/Hola_%28VPN%29 https://en.wikipedia.org/wiki/Hola_%28VPN%29 Anyone with that browser extension installed on any device on their network is making themselves an open VPN exit for millions of random people.
ixfo 5y ago
Collecting passwords and dumping the storage is likely all they did. 3 months is fairly prompt for any kind of "cyber" in the UK to even get a brief look at, due to huge processing backlogs in the overworked departments whose job it is to deal with it. I'd suspect that what happened here is they thought they had an easy win, went through the motions, determined fairly rapidly from interviews etc it wasn't actually a viable lead, and didn't pursue further. But the machinery is set in motion by the initial conversation, for fear of prompt deletion if the storage is left with the would-be perp.

bserge 5y ago

Those routers don't have particularly bad default passwords iirc, 12-14 random chars, which is better than the vast majority of user-set passwords. I don't remember if it uses WPS 1.0 (why is there even a 2.0 of this horrible "feature"?), that would be the easiest way to access any router. Why would the would-be hacker need access to the router settings? I can't think of anything worth changing there, these routers don't have any extra features. The usual illicit use is to point an antenna at a router and use it from afar (well, no more than 100-300m, line of sight and preferably no obstructions). In which case it makes more sense to just get a prepaid SIM card, set up a phone as a VPN in a location far from you and route traffic through it. It's not more complicated than bruteforcing a WPS PIN or WPA2 password. That is, if you can't just get a VPN without using any ID.

Orphis 5y ago
I remember stories of the default password being a weak hash of the SSID. And when those are "ISPNAME-4DIGITS", it's not too hard to collect them all. Sometimes, they can be retrieved from the MAC address as well. So it's just the illusion of security for most.
- serf 5y ago
  verizon just recently stopped defaulting the wep key to a very simple hash derived from the ssid and mac.[0][1] [0]: https://www.xkyle.com/verizon-fios-wireless-key-calculator/ https://www.xkyle.com/verizon-fios-wireless-key-calculator/ [1]: https://aruljohn.com/fios/ https://aruljohn.com/fios/
  - yrro 5y ago
    Verizon CPE still uses WEP?!!?
    - serf 5y ago
      I don't know about elsewhere , but Frontier took over FiOS management in some regions and continued to push those same APs for a long while.

exporectomy 5y ago

> "They took everything: our desktop computer, both our laptops, our mobile phones, a laptop I had borrowed, even old mobile phones that were lying around in drawers," Worth considering when making backups. A burglary, fire, virus or hacker won't do this but the police may take your offsite backups and your onsite ones and your computer with the credentials to your online backup service.

neolog 5y ago
What are the backup options for this situation?
- kstenerud 5y ago
  Anything offsite.
- foobar33333 5y ago
  Append only backups. With some services you can get it so you can only create a backup every X days and it is impossible to delete backups before they expire.
- philjohn 5y ago
  Backblaze?
  - exporectomy 5y ago
    They delete it after 6 months if you don't connect, which would happen if the police had it. You also might not be able to log in without your phone for 2FA or your password manage for the password. I guess storing backups on a device that's the property of somebody else would be a way. I'm guessing they won't go seizing non-suspects' property.

bloqs 5y ago

This stinks of IPV4 collision/exaustion and the NCA somehow basing this purely on an IP address

figassis 5y ago
My question exactly. Could the ISP not have simply reallocated the ipv4 lease so that they could maybe get a history of router macs associated with that IP?

kstenerud 5y ago

I suspect that the future of online crime will use bystander computers to do their dirty work. It would actually be quite simple to do: - Infect the computer via the normal means - Connect to a CNC relay and await instructions - Receive instructions and perform the deed The most important aspect would be to use a non-persistent compromise so that it leaves no trace when the police arrive and unplug the computer to bring it in for forensic analysis. With the trail ending at this computer and no sign of infection, they have their perp; case closed. Criminal organizations could even offer a SAAS solution - a kind of "crime as a service", where they rent you the infrastructure of ephemeral compromised machines to use.

pjc50 5y ago
This already happens with botnets. It's just that the nonces are a lot less organized.
gnfargbl 5y ago
> Criminal organizations could even offer a SAAS solution - a kind of "crime as a service", where they rent you the infrastructure of ephemeral compromised machines to use. There is already an entire industry offering "residential proxies," which are relays with the functional characteristics you describe. The difference is that the machines providing the relay are (typically) co-opted by adware etc, rather than being overtly compromised. I believe there may also be some operators who actually own the relay nodes.
- daniellarusso 5y ago
  Quick google search found this one: https://oxylabs.io/products/residential-proxy-pool https://oxylabs.io/products/residential-proxy-pool
pentae 5y ago
You just described a botnet, which have been around for about 20 years
jeroenhd 5y ago
Back when Netflix was a US exclusive, I've tried the Hola proxy addon. Hola basically turned/turned your computer into a proxy and, in exchange, let(x) you use other people's computer as a proxy. That's all pretty great when it comes to foreign Netflix, but it's also an easy way to get other people convicted for posting child porn. I don't think there's a lot of security going on on that network. And you don't even need a special criminal organisation to abuse such a system, you have actual normal, civilian users!

cute_boi 5y ago

Is UK police so dumb that they suspect people solely based on ipv4? A malware can always attack a computer and set up vpn etc. There can be many thing so UK police please stop your nonsense. Do they even realize how much tragedy those innocent people had to face due to their silliness?

pilif 5y ago
> Is UK police so dumb that they suspect people solely based on ipv4? It’s not dumb. It’s very practical. Very easy conviction and it entirely turns the burden of proof over to the accused who now have to prove their innocence which is much harder to do especially as they probably lack the resources to do so. If success is measured in amount of convictions and/or arrests, going with just the IP address is the easiest road to success. Articles like this are incredibly important to make it clear to judges that an IP address is not sufficient evidence. This is not common knowledge yet
- exhilaration 5y ago
  On might consider disabling the WiFi password entirely so there's plausible deniability if this happens. Pitch it as a public service. Maybe set up a separate router or VLAN and cap the bandwidth.
  - hhvn 5y ago
    Then you would have to prove that it's someone who used the service not you. The burden of proof is not on the accusor.
  - fnord77 5y ago
    has this ever been tested in court?
  - foobar33333 5y ago
    Sure, but you still end up with all of your devices seized for months and data dumped while you explain that you run an unprotected wifi router.

tomxor 5y ago

This is due to the UK's new "Internet Connected Records IP" act (from the infamous snoopers charter that passed in 2016). I'm holding Theresa May directly responsible for this family's hellish experience. Previous HN: https://news.ycombinator.com/item?id=26430266 https://news.ycombinator.com/item?id=26430266 The most complete solution I can think of to recommend to people to protect themselves from this insane law is to route all traffic over a VPN at the router. Otherwise you have to be worried about every single device that connects to your router - and you will just end up looking like a jerk when you don't let your friends use your internet out of fear of malware.

raldi 5y ago
The act introduced a new power that, among many other things, could force ISPs – upon being ordered to do so by a senior judge – into logging the Internet Connection Records (ICR) of all their customers for up to 12 months (e.g. the IP addresses of the servers you’ve visited and when), which can be accessed without a warrant and occurs regardless of whether or not you’re suspected of a crime.
latexr 5y ago
A VPN isn’t a solution, it’s a workaround. A solution would be to change the law. Pressure your law makers and your fellow voters. It’s worrying that every time there’s a problematic internet law, the response is “use a VPN”. I even saw that suggestion where it would be downright useless—the European law to require upload filters. If the recommendation is always to use VPNs and otherwise keep quiet, those in power can calmly strip you of every right and ban VPNs at the end. What do you do then?
- ancarda 5y ago
  [deleted]
  - aurelianito 5y ago
    They legally ban them. If you are catched using one you go to jail.

ytch 5y ago

On the other hand, what if I setup a password-less Wifi without logging, encrypt all my devices, then do malicious with my home network. Can I claim they cannot arrest me since everyone might use my Wifi?

kawsper 5y ago
You can get a 2 year trip to prison for contempt of court if you refuse to decrypt your devices for the court. > The Regulation of Investigatory Powers Act 2000 (RIPA), Part III, activated by ministerial order in October 2007,[20] requires persons to supply decrypted information and/or keys to government representatives with a court order. Failure to disclose carries a maximum penalty of two years in jail https://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom https://en.wikipedia.org/wiki/Key_disclosure_law#United_King... You can read the full law here: https://www.legislation.gov.uk/ukpga/2000/23/part/III https://www.legislation.gov.uk/ukpga/2000/23/part/III
patrakov 5y ago
In Russia this is explicitly illegal (even if you give all device passwords to the police) - you must identify all people who have access to your network, i.e. not let unidentified people in, or go to jail if there is a possibility for strangers to connect, even if nobody actually connected.

xorcist 5y ago

While plausible, it's very likely not worth the bother to crack this couple's wifi passphrase. For all this work it leak the attacker's general geographic area anyway. More likely is that the ISP messed up their logs, or that they were incomplete. That happens more often than they would like to admit.

tomxor 5y ago
This is a real concern, especially in the age of carrier grade NAT. Vodafone (the families ISP), is a mobile ISP which dynamically pass IPs around like hot potatos - their monitoring solutions need to be far more sophisticated to keep accurate records... this feels a bit like the start of another Royal Mail "the computer is right" scenario but at a larger scale.
- worldofmatthew 5y ago
  Not just that, the default logging for almost all server software does not log ports or have second by second accurate timestamps. Often making it only possible to track down someone using a less popular website as the data will be too noisy without information on top websites.
geek_at 5y ago
Something similar (but not relating to CSAM) happened to me (though not the ISPs fault). I was on IRC and someone I have talked to a few times sent me a official looking link to the website of a local political party and it was a sub-folder that had indexing enabled and that's where they stored their backups. The dude then got in and published all usernames and hashed passwords on pastebin. He was using a VPN at the time, I wasn't.. The police took all my devices and kept them for a year until charges were dropped. Not a fun time. I wrote about it here -> https://blog.haschek.at/2015-that-not-so-awesome-time-the-police https://blog.haschek.at/2015-that-not-so-awesome-time-the-po...
- sumedh 5y ago
  You should submit that link as a new post.

Nextgrid 5y ago

I would not expect this to be a local attack via wifi. Internet is so cheap/free nowadays, why would you go through the trouble to crack someone’s wifi instead of using a public one + VPN or Tor? I believe this was a remote attack. Either on their computers, phones or router. Consumer-grade network equipment is notoriously insecure and Vodafone has absolutely zero expertise let alone incentive to do anything about it - they just buy these routers wholesale from China for a couple bucks a piece and call it a day.

waihtis 5y ago
Public has considerable risk too, with a chance of having yourself physically leaving a trace into a security camera (especially in the UK) That said you’re completely right on the state of ISP router security

aritmo 5y ago

How about suing the ISP for lax security relating to the home router?

isaacremuant 5y ago

This is not a tech security issue. This is a government issue. Having the power of nearly destroying your life for suspecting you of a crime. Society so caught up in guilty until proven innocent. Justice wasn't swift either. They disrupted their life and this couple is expected to bear all the costs of the govs wrong action. It's not about finding ways to keep yourself safe so that the gov can't accuse you of something and destroy you (see swatting), it's about the gov not being able to destroy you with such ease.

UweSchmidt 5y ago

So, to what device should one "upgrade to"? Would it help much to have a hardware firewall at home or hide the wifi?

Nextgrid 5y ago
Use the ISP-provided router as a modem in bridge mode (so it's essentially invisible from the network) and put an enterprise-grade router behind it that you keep up to date and disable any unneeded services (so no web interface, telnet, SSH, etc - at least not on the public-facing interface). This obviously isn't immune to a zero-day, but at this point you'd be more secure than 99% of the rest of the people so any attacker will just move on (why bother breaking into this router when you have an exploit that will net you hundreds of other ones with much less effort?)
- UweSchmidt 5y ago
  Thanks!

kfprt 5y ago

England is basically a third world country in terms of legal rights. They brought back double jeopardy! https://en.wikipedia.org/wiki/Double_jeopardy#Post-2003 https://en.wikipedia.org/wiki/Double_jeopardy#Post-2003

LatteLazy 5y ago
And equally shit with any sort of tech law. The couple were quite lucky. For a while there was about a 5 year backlog of computers (plus phones, ipad etc) waiting for the police to even look at. Imagine waiting 5 years to be cleared of this...
theduder99 5y ago
I don't really understand the concept here. Taken to the extreme: a murderer is acquitted then the next day concrete evidence is found proving their guilt 100%, do they still walk free because they can't be tried again?
- mhuffman 5y ago
  That is correct, but the intent of the double jeopardy laws are to stop people from being perpetually retried for a crime by someone that is convinced they have the right person (ie. every cop and DA that ever lived!) and holding the threat of that over them the rest of their life even though the case has already been adjudicated. What you described is an unfortunate loophole in this concept.
  - londons_explore 5y ago
    The UK requires 'substantial' new evidence to re-try a case. So far, it seems that hasn't been widely abused in the way you suggest. A court is the one who decides if new evidence is substantial or not - simple things like 'we found 11 of his footprints in the snow, but a re-re-review of the photos actually finds 12!" wouldn't cut it...
    - Karunamon 5y ago

antattack 5y ago

Maybe UK (and everyone else) needs a law that requires anyone manufacturing an Internet-connected device to set unique passwords or force users to change the password before they can use it, like California's (SB-327).

Anthony-G 5y ago
From the featured article: > The government plans to ban default passwords being pre-set on devices, as part of upcoming legislation covering smart devices.
- LocalH 5y ago
  I hope that only mean they plan to ban non-unique default passwords, rather than requiring users to set up their own password during setup. The latter is a sure-fire ticket to tons of “password” “12345678” “11111111” type passwords.
mgerdts 5y ago
SB-327 says: it shall be deemed a reasonable security feature under subdivision (a) if either of the following requirements are met: (1) The preprogrammed password is unique to each device manufactured. I read this as a password based on the mac address or serial number would be compliant without meeting what I think is the intent of this law.

ExodusAnon 5y ago

Most people are assuming the password was brute forced rather than it being a deauthentication attack. ISP provided routers (what the majority of people use) are so badly designed and left vulnerable it should be illegal. Heck some ISPs here still refuse to use IPv6.

Zak 5y ago

Some of the information in this article seems pretty inaccurate: > they would have to be within about 20 metres of the house Using a directional antenna, they could be substantially farther away. > to do anything particularly sinister on the home network, the hacker will need to change the router configuration That's not even remotely accurate. Uploading child abuse images to a message board as in the central story this article covers does not require configuration changes, for example. Trying exploits on other devices connected to the network doesn't either.

londons_explore 5y ago
Some models of router are pretty easy to run code on. You could then run code on it to give you a permanent 'bounce' IP address, which you could then use from anywhere on the globe.
fortran77 5y ago
Just for grins, we put the biggest "Wi-Fi" yagi we could find on a mast on top of our building (along with some other antennas). We've picked up IDs from WiFi from at least a mile away and can get solid connections to a few places with public WiFi for about half that distance. You could easily disguise a WiFi yagi inside or among TV antennas.
LatteLazy 5y ago
You're not wrong about the antenna, but I am confused who would do any of this for 4 images? Either parking outside or sitting 1km away with an antenna, isn't this a megatonne more work (and technical knowledge) than just downloading tor. Given that I felt it was understandable to just jump that whole question even if it is factually incorrect...
- Zak 5y ago
  It's probably not the most effective way to go about sharing illegal content if that's the end goal, but if you want to frame someone else for uploading illegal content....

adriancr 5y ago

I wonder if it was someone (guest or otherwise) that was sharing network in exchange for money or crypto tokens and not even realizing it... I've been spammed quite a bit by friends with such applications past 6 months...

Saris 5y ago

Boy their 'security consultant' doesn't seem to know much about wifi and wifi routers.

upofadown 5y ago

So that means that anyone with access to my computer can put child porn on it and then report it? What exactly would the people involved of been guilty of if the 4 images were found on their computer?

ficklepickle 5y ago

A VPN service could have caused this issue. Plenty of them route traffic through their users internet connections. It's the easiest way to get residential IPs that won't be blocked by streaming sites.