5 ms·

Spies Jumped from One Network to Another via Wi-Fi in an Unprecedented Hack

140 points by impish9208 2y ago

Faelian2 2y ago
An explanation of the attack by the company doing the investigation: https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/ https://www.volexity.com/blog/2024/11/22/the-nearest-neighbo...
madaxe_again 2y ago
This isn’t entirely novel. I did some grey verging on black hat work a few years back. Target was in a place that putting boots on the ground would have been a challenge, and highly conspicuous. We targeted the tenant a floor below them. Got in through a networked fax machine. Hijacked an AP, used that to bruteforce our way in upstairs. I think I might have been working for Russian intelligence, retrospectively. The whole “briefcase full of cash” bit should have been a hint, but it was interesting work, and the dudes we were targeting (a PMC) were no angels.
- kelsey98765431 2y ago
  Careful buddy, if you worked for who you think then the NDA is STRONGLY enforceable by some guys breaking into your house in the middle of the night... stay frosty
  - madaxe_again 2y ago
    Oh, I speak freely as they would have a very hard time finding me these days, and I already pissed them off almightily on my way out the door with a bag of misbegotten loot, and that was a few years ago, and my brains have yet to be ventilated.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
brudgers 2y ago
If your threat model includes nation states, you are outgunned. A nation state can probably buy the building across the street if that's the value of hacking your system. Of course there are almost certainly cheaper options,but that's the level of time and budget you are up against...teams of motivated and well resourced experienced professionals working against you full time.
- medo-bear 2y ago
  > If your threat model includes nation states, you are outgunned it is quite plausible that the target was a nation state sponsored entity, so fair game? its not like they did this to a local fish n chips shop
- mr_mitm 2y ago
  Maybe so, but in this case they made it easy for them [1]: > Upon examining those logs, Volexity found that in January and February, password-spray attacks had been carried out against this service and three accounts had been successfully compromised by an attacker. > ... > The Enterprise Wi-Fi network, however, did not require MFA and only required a user's valid domain username and password to authenticate > ... > While the Guest Wi-Fi network had been believed to be completely isolated from the corporate wired network, where the high-value targeted data resided, there was one system that was accessible from both the Wi-Fi network and the corporate wired network. Bad passwords, no certificate based network authentication or MFA, bad network separation. Basic stuff. [1] https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/ https://www.volexity.com/blog/2024/11/22/the-nearest-neighbo... (This should have been the referenced page IMHO.)
  - myworkinisgood 2y ago
    Have you seen how much people struggle with getting on wifi when you include just include certificates, not even MFA on such security things?
    - mr_mitm 2y ago
transpute 2y ago
WiFi security can be improved by per-device passwords, https://github.com/spr-networks/super https://github.com/spr-networks/super
- telgareith 2y ago
  Or just enable "WPA-enterprise" and have it rotate keys. Then you not only have device certificates, you also have per user authentication. And if somebody missed it- rotating keys. They can change faster than they can be cracked. Then you can also layer VPNs ontop of that... All of which are standard, well known, and proven solutions. What does that repo offer? With 400 stars, I doubt anybody has given it serious attention.
  - sigmoid10 2y ago
    You make it sound like you just have to flip a switch in your router's settings to enable it, but that is very far from the truth. For that to work you need a RADIUS server to handle credentials, a certificate authority if you want any useful kind of authenticity checks, a process for distributing said certificates and finally you need to configure all your access points. This is something that companies can (and should) have, but for home users it is overkill. Since this repo specifically targets home users, I suspect there is a place for this among enthusiasts who can't or don't want to go all the way on their home network.
    - rurban 2y ago
      No radius server needed, the builtin kernel module for wifi access points can do that easily.
      - BenjiWiebe 2y ago
        Do you mean hostapd? I'm not aware of any builtin kernel/modules doing AP stuff.
        2y ago
LorenDB 2y ago
https://archive.ph/cKrq8 https://archive.ph/cKrq8
malux85 2y ago
[flagged]
sharpshadow 2y ago
“Microsoft warned of a vulnerability in Windows' print spooler” How much I hated just seeing this process. Print related tasks should never run when not needed.
baybal2 2y ago
[dead]
Missanna 2y ago
[flagged]

140 points by impish9208 2y ago

An explanation of the attack by the company doing the investigation: https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/ https://www.volexity.com/blog/2024/11/22/the-nearest-neighbo...

madaxe_again 2y ago

This isn’t entirely novel. I did some grey verging on black hat work a few years back. Target was in a place that putting boots on the ground would have been a challenge, and highly conspicuous. We targeted the tenant a floor below them. Got in through a networked fax machine. Hijacked an AP, used that to bruteforce our way in upstairs. I think I might have been working for Russian intelligence, retrospectively. The whole “briefcase full of cash” bit should have been a hint, but it was interesting work, and the dudes we were targeting (a PMC) were no angels.

kelsey98765431 2y ago
Careful buddy, if you worked for who you think then the NDA is STRONGLY enforceable by some guys breaking into your house in the middle of the night... stay frosty
- madaxe_again 2y ago
  Oh, I speak freely as they would have a very hard time finding me these days, and I already pissed them off almightily on my way out the door with a bag of misbegotten loot, and that was a few years ago, and my brains have yet to be ventilated.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

brudgers 2y ago

If your threat model includes nation states, you are outgunned. A nation state can probably buy the building across the street if that's the value of hacking your system. Of course there are almost certainly cheaper options,but that's the level of time and budget you are up against...teams of motivated and well resourced experienced professionals working against you full time.

medo-bear 2y ago
> If your threat model includes nation states, you are outgunned it is quite plausible that the target was a nation state sponsored entity, so fair game? its not like they did this to a local fish n chips shop
mr_mitm 2y ago
Maybe so, but in this case they made it easy for them [1]: > Upon examining those logs, Volexity found that in January and February, password-spray attacks had been carried out against this service and three accounts had been successfully compromised by an attacker. > ... > The Enterprise Wi-Fi network, however, did not require MFA and only required a user's valid domain username and password to authenticate > ... > While the Guest Wi-Fi network had been believed to be completely isolated from the corporate wired network, where the high-value targeted data resided, there was one system that was accessible from both the Wi-Fi network and the corporate wired network. Bad passwords, no certificate based network authentication or MFA, bad network separation. Basic stuff. [1] https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/ https://www.volexity.com/blog/2024/11/22/the-nearest-neighbo... (This should have been the referenced page IMHO.)
- myworkinisgood 2y ago
  Have you seen how much people struggle with getting on wifi when you include just include certificates, not even MFA on such security things?
  - mr_mitm 2y ago

transpute 2y ago

WiFi security can be improved by per-device passwords, https://github.com/spr-networks/super https://github.com/spr-networks/super

telgareith 2y ago
Or just enable "WPA-enterprise" and have it rotate keys. Then you not only have device certificates, you also have per user authentication. And if somebody missed it- rotating keys. They can change faster than they can be cracked. Then you can also layer VPNs ontop of that... All of which are standard, well known, and proven solutions. What does that repo offer? With 400 stars, I doubt anybody has given it serious attention.
- sigmoid10 2y ago
  You make it sound like you just have to flip a switch in your router's settings to enable it, but that is very far from the truth. For that to work you need a RADIUS server to handle credentials, a certificate authority if you want any useful kind of authenticity checks, a process for distributing said certificates and finally you need to configure all your access points. This is something that companies can (and should) have, but for home users it is overkill. Since this repo specifically targets home users, I suspect there is a place for this among enthusiasts who can't or don't want to go all the way on their home network.
  - rurban 2y ago
    No radius server needed, the builtin kernel module for wifi access points can do that easily.
    - BenjiWiebe 2y ago
      Do you mean hostapd? I'm not aware of any builtin kernel/modules doing AP stuff.
      - 2y ago

LorenDB 2y ago

https://archive.ph/cKrq8 https://archive.ph/cKrq8

malux85 2y ago

[flagged]

sharpshadow 2y ago

“Microsoft warned of a vulnerability in Windows' print spooler” How much I hated just seeing this process. Print related tasks should never run when not needed.

baybal2 2y ago

[dead]

Missanna 2y ago

[flagged]