9 ms·

Want to use my wifi?

94 points by TheJH_ 13y ago

mschuster91 13y ago
Just for teh lulz, you could do ARP-spoofing on public wifi's too, and achieve the same effect wthout having the trouble of setting up a hotspot. I admit of having spoofed a Burger King public WiFi and replacing all img-tag sources with Goatse. Priceless reactions everywhere ;)
- TheJH_ 13y ago
  True, and that might also give you access to more traffic than just a random open wifi because people expect a wifi there and look for it.
- lotsofcows 13y ago
  I like BT OpenZone in the UK. It seems everyone has connected to one of these at some point so you just create an ad hoc wireless connection with the same SSID and most modern smartphones automatically connect and start trying to download mail and facebook updates.
IgorPartola 13y ago
Using a browser in incognito mode does none of the sort. You can still enter your password into it and it can be stolen just as easily. The true solution is to only browse over HTTPS, connect to a VPN or not use untrusted networks. Note that if I can spoof an IP address, I can send you bogus DNS replies, and send you to a web server that impersonates Google/Facebook/etc. but does not require HTTPS (unless they use the strict security header). In this case you do not get a warning, just the absence of a tiny green icon.
- malandrew 13y ago
  How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? I've never set it up and was curious what others have done to make it as invisible as possible.
  - culturestate 13y ago
    If you're on a Mac, it's nearly plug-and-play — I use a small menubar app called sidestep[1] that automatically tunnels over SSH, but there are also a few (Viscosity comes to mind) that work in a similar fashion with OpenVPN. There may be similar bits available for Windows, but I haven't looked into it there in some time. 1. https://github.com/chetan51/sidestep https://github.com/chetan51/sidestep
    - tcas 13y ago
      Haven't used sidestep, but sshuttle [1] is a nice command line utility that does the same, just not automatically. Much easier than setting up a VPN server. [1] https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
      - icebraining 13y ago
        It's easier (and I'm a fan as well), but setting up an OpenVPN server with pre-shared key is very easy too. It's essentially a matter of apt-getting openvpn and writing a three line config file: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html http://openvpn.net/index.php/open-source/documentation/misce...
        culturestate 13y ago
        One of the advantages of using SSH is that it almost always works, even in environments (think China) that actively block detected VPN connections. SSH running on port 443 looks a lot like HTTPS.
      - IgorPartola 13y ago
        Beware: http://serverfault.com/questions/337791/if-i-am-using-ssh-for-a-socks-proxy-do-dns-connections-go-through-it http://serverfault.com/questions/337791/if-i-am-using-ssh-fo... In short, if I can hijack your DNS queries, I can do evil things to you even if I cannot directly MITM your HTTP/HTTPS traffic.
- tlrobinson 13y ago
  I assumed the author meant you should only use incognito mode AND only browse public (non-login) sites or HTTPS sites.
  - IgorPartola 13y ago
    Heh, well what's the fun in that? Plus their remarks make it seem that it can somehow prevent passwords from being seen which is what got me to comment in the first place.
    - jzzskijj 13y ago
      You're not following: "If you have saved your login data on any plain-HTTP site that the attacker knows of, he can use his JS shell in the news site to load the site with the login form in an iframe, then inject another JS shell into the iframe and use that to read the password that the browser fills in." As far as I know incognito mode wont autofill those saved credentials. I think that was the point how incognito mode prevents this kind of attack. In this attack the user doesn't have to access those HTTP sites with stored credentials by themselves while being connected to the evil network, because the injected script does that for you behind the scenes.
      - IgorPartola 13y ago
        You are right, I wasn't. However, the solution to this is to not use passwords with plain-HTTP sites. Incognito mode will prevent a small surface of drive-by attacks, but the bigger problem if plaintext passwords in cleartext on the wire are also terrible.
- toadi 13y ago
  Using chrome or Firefox will give you a big fat warning when you strip the https with a man in the middle attack for google and facebook.
  - dspillett 13y ago
    Only if you explicitly go to https://<site> https://<site> - if you type <site> directly into the address bar you might end up at http://<site> http://<site> which usually redirects you to https://<site> https://<site> - but if you are on a compromised network you could get an incorrect response for the address of <site> from the DNS request and therefore go to a server that servces http://<site> http://<site> with a redirect to https://<something-very-similar-to-site> https://<something-very-similar-to-site>. If you are not paying close attention you might just assume the green highlight in the relevant part of the address bar means all is well, where you are in fact accessing something you were not expecting but which looks like what you were expecting long enough to collect some useful details (such as your account credentials) from you. While I can't get a cert signed for facebook.com (at least not without very expensive bribes or other human factors engineering) but I could get one for faceboolc.com easily enough and if you aren't looking closely that might fool the eye. It wouldn't catch everyone, anyone going direct to https://<site> https://<site> would be warned as you suggest, but it could catch some out.
davidbanham 13y ago
These attacks could be given longevity by using a cache manifest.
pocketstar 13y ago
Using a VPN would protect you against all of this right?
- cenhyperion 13y ago
  Assuming you can trust the VPN and the encryption is good it should.
malandrew 13y ago
Is it possible to use the browser in https only mode, or at least have it force launch any https sites in a new incognito mode window so that you know it's http-only. Furthermore, it would be nice if you could disable all text inputs on http-only windows. I know that I would be more likely to contact a site owner asking for https if it screamed at me everytime it happened. It's time to ditch http for all but rare use cases, because almost 2014.
- jiri 13y ago
  Yes, you can configure most browser to use proxy. So, I think, you can set the none proxy (or valid) for https and some invalid proxy ip for http, so you cannot connect to any http server.
- noinsight 13y ago
  Get the "HTTPS Everywhere" addon for Firefox, or, apparently, Chrome now.
  - hnha 13y ago
    that "only" uses a list of known https domains to force the browser to use them. It does not magically enable "https everywhere".
chrissnell 13y ago
I've been thinking about the possibility of injecting a JavaScript bitcoin miner into every page loaded through my access point. Imagine the possibilities for an open AP that's located in a very public place, like Times Square, or near a busy Starbucks (where access is slow and unreliable). If you really wanted to take this to the evil next level, you'd just break one (or several) WPA keys on nearby APs and have your rouge injector AP act as both an open AP (to unsuspecting users) and a client (using cracked keys) to other APs, thus avoiding having to actually buy internet access for this spot. You'd essentially just need to find a place to hide and power your evil AP.
- MichaelGG 13y ago
  Is that even remotely lucrative? As I understand, even a $300 GPU is orders of magnitude more powerful than any CPU miner, let alone a JavaScript based one. And even a single GPU isn't remotely competitive these days compared to the GPU farms and now ASIC setups. So you'd need to inject JS into, I dunno, a million, devices to make anything worthwhile.
  - dave1010uk 13y ago
    You could probably use WebCL, Flash or Silverlight to use the user's GPU. A quick Google shows this has been done with WebCL already: http://webcl.nokiaresearch.com/jsoclbm/ http://webcl.nokiaresearch.com/jsoclbm/
    - MichaelGG 13y ago
      There's a neat hardware comparison here: https://en.bitcoin.it/wiki/Mining_hardware_comparison https://en.bitcoin.it/wiki/Mining_hardware_comparison Seems like ASICs are measured in the thousands to tens or hundreds of thousands of MHashes/sec. Whereas powerful GPUs drawing ~1000 Watts don't even break 1000MH/sec. High-end laptop GPUs seem to be in the 10s of MH/sec, a quad-core Atom shows 2MH/sec, and the Galaxy SII comes in at 1.3. The vast majority of devices connecting to public APs are not going to be high-power systems. Not to mention the time they'll spend connected is unlikely to be 24/7. Even if it was, mining will probably drain batteries pretty quickly. Plus power-saving is likely to be on for mobile devices and reduce peak perf. And if it's just injecting JS, then backgrounded tabs should get much less CPU time. And WebGL/etc. are unlikely to be running in background tabs. If you assume a device stays connected and open for 1/4 a day, and stays for 3 days on average, and gives you 1MH/sec (seems optimistic, all things considered), 1 million devices compromised a month gives you ~$300 a month. If the assumption is that you can persistently own a machine, then you'd need less machines. But that's going beyond simple JS injection on HTML pages. I used this calculator: http://www.alloscomp.com/bitcoin/calculator http://www.alloscomp.com/bitcoin/calculator
quasque 13y ago
I wonder if this attack would also work on the http://www.gstatic.com/generate_204 http://www.gstatic.com/generate_204 page that Chrome uses to detect captive portals if you are accessing https pages.
odonnellryan 13y ago
It's pretty easy to set up a VPN on EC2. Probably not the BEST solution out there (the instances certainly aren't designed for that use) but better than nothing.
- btgeekboy 13y ago
  At $0.07/hour for 1TB/month, with <1min startup time, DigitalOcean is actually a decent host to do this with.
loser777 13y ago
Situations like these are how I justify keeping a low power 24/7 box on at home. In situations where I don't have my own (trusted) connection, I'll just ssh tunnel a SOCKS5 proxy to my home server. I only have a residential internet connection at home, but 2mbps is surprisingly snappy for casual or emergency on the go web browsing. With boxes out there (e.g. rPi) that push power consumption far south of 10W, it makes even more sense to do this now. Of course, it also doubles as an IRC idler/whatever else you can think of.
- voltagex_ 13y ago
  Yep, I have a Dreamplug with dual ethernet and an attached USB hard drive. Last I checked, the hard drive used more power than the machine itself. SSH is done through key authentication and there's an OpenVPN server if the network I'm connecting through isn't too locked down. Next trick is to do IP-over-DNS and I'll be all set where ever I am. Now if only someone would come out with a USB3-capable board with dual-gigE (I don't mind if it can only push 500Mbit each port)
  - icebraining 13y ago
    Next trick is to do IP-over-DNS and I'll be all set where ever I am. iodine[1] is a fairly easy way to set that up. I just made a tunnel.mydomain.tld subdomain, pointed the NS records at my VPS and run "iodined 10.0.0.1 tunnel.mydomain.tld" [1] http://code.kryo.se/iodine/ http://code.kryo.se/iodine/
matiasb 13y ago
Has anyone tried ICMP tunnels?
simgidacav 13y ago
> Commandline snippet poisoning Really? So would you blindly copy-paste things into your shell? Then I don't need to hijack your connections, I just put malicious pastes on the website. If you are moron enough to copy-paste the first thing you find, you are probably not reading the other users' warnings about "this answer is wrong".
- Lazare 13y ago
  The attack mentioned is to change the text when you go to copy it; that will get even people who carefully read every forum post before copying and pasting. How many people review the snippet, copy, paste it into a text editor, re-review it, copy it, and then paste it into their shell?
  - simgidacav 13y ago
    I deem your point good. I didn't realize it entirely. Still, since when I run GNU/Linux I never pasted a command line from a website into my terminal. This is just reckless. Borderline case, I understand what the example is showing me and then I apply.
  - andrewaylett 13y ago
    Ctrl-X Ctrl-E in bash will open an editor for the current command, which is executed when the editor is exited. After the potential for exploit was publicised a few months ago, I use this every time and it's really not much more effort than just pasting into the shell. As a bonus, it means I don't have to worry about embedded newlines stopping me from tweaking the command before running it.
    - TheJH_ 13y ago
      You can embed \x1b (escape) into a webpage. When you copy-and-paste that, it has the same effect as hitting ESC in the editor. So, I'd just have to make you copy "<evil command>#\x1b:wq\n" to also catch the case that you're using vim instead of directly pasting. However, I can't figure out a way to escape from nano. (Tested it with the combination chromium+xterm+vim.)
fmavituna 13y ago
Inject something like XSS Tunnel (http://labs.portcullis.co.uk/download/XSS-Tunnelling.pdf http://labs.portcullis.co.uk/download/XSS-Tunnelling.pdf that gives you a local proxy that you can point your local browser and then sends all of your traffic through the victim, so you'll see and use the website(s) with your victim's session), or BeeF - http://beefproject.com/ http://beefproject.com/ for tons of exotic XSS based exploits.

94 points by TheJH_ 13y ago

Just for teh lulz, you could do ARP-spoofing on public wifi's too, and achieve the same effect wthout having the trouble of setting up a hotspot. I admit of having spoofed a Burger King public WiFi and replacing all img-tag sources with Goatse. Priceless reactions everywhere ;)

TheJH_ 13y ago
True, and that might also give you access to more traffic than just a random open wifi because people expect a wifi there and look for it.
lotsofcows 13y ago
I like BT OpenZone in the UK. It seems everyone has connected to one of these at some point so you just create an ad hoc wireless connection with the same SSID and most modern smartphones automatically connect and start trying to download mail and facebook updates.

IgorPartola 13y ago

Using a browser in incognito mode does none of the sort. You can still enter your password into it and it can be stolen just as easily. The true solution is to only browse over HTTPS, connect to a VPN or not use untrusted networks. Note that if I can spoof an IP address, I can send you bogus DNS replies, and send you to a web server that impersonates Google/Facebook/etc. but does not require HTTPS (unless they use the strict security header). In this case you do not get a warning, just the absence of a tiny green icon.

malandrew 13y ago
How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? I've never set it up and was curious what others have done to make it as invisible as possible.
- culturestate 13y ago
  If you're on a Mac, it's nearly plug-and-play — I use a small menubar app called sidestep[1] that automatically tunnels over SSH, but there are also a few (Viscosity comes to mind) that work in a similar fashion with OpenVPN. There may be similar bits available for Windows, but I haven't looked into it there in some time. 1. https://github.com/chetan51/sidestep https://github.com/chetan51/sidestep
  - tcas 13y ago
    Haven't used sidestep, but sshuttle [1] is a nice command line utility that does the same, just not automatically. Much easier than setting up a VPN server. [1] https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
    - icebraining 13y ago
      It's easier (and I'm a fan as well), but setting up an OpenVPN server with pre-shared key is very easy too. It's essentially a matter of apt-getting openvpn and writing a three line config file: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html http://openvpn.net/index.php/open-source/documentation/misce...
      - culturestate 13y ago
        One of the advantages of using SSH is that it almost always works, even in environments (think China) that actively block detected VPN connections. SSH running on port 443 looks a lot like HTTPS.
    - IgorPartola 13y ago
      Beware: http://serverfault.com/questions/337791/if-i-am-using-ssh-for-a-socks-proxy-do-dns-connections-go-through-it http://serverfault.com/questions/337791/if-i-am-using-ssh-fo... In short, if I can hijack your DNS queries, I can do evil things to you even if I cannot directly MITM your HTTP/HTTPS traffic.
tlrobinson 13y ago
I assumed the author meant you should only use incognito mode AND only browse public (non-login) sites or HTTPS sites.
- IgorPartola 13y ago
  Heh, well what's the fun in that? Plus their remarks make it seem that it can somehow prevent passwords from being seen which is what got me to comment in the first place.
  - jzzskijj 13y ago
    You're not following: "If you have saved your login data on any plain-HTTP site that the attacker knows of, he can use his JS shell in the news site to load the site with the login form in an iframe, then inject another JS shell into the iframe and use that to read the password that the browser fills in." As far as I know incognito mode wont autofill those saved credentials. I think that was the point how incognito mode prevents this kind of attack. In this attack the user doesn't have to access those HTTP sites with stored credentials by themselves while being connected to the evil network, because the injected script does that for you behind the scenes.
    - IgorPartola 13y ago
      You are right, I wasn't. However, the solution to this is to not use passwords with plain-HTTP sites. Incognito mode will prevent a small surface of drive-by attacks, but the bigger problem if plaintext passwords in cleartext on the wire are also terrible.
toadi 13y ago
Using chrome or Firefox will give you a big fat warning when you strip the https with a man in the middle attack for google and facebook.
- dspillett 13y ago
  Only if you explicitly go to https://<site> https://<site> - if you type <site> directly into the address bar you might end up at http://<site> http://<site> which usually redirects you to https://<site> https://<site> - but if you are on a compromised network you could get an incorrect response for the address of <site> from the DNS request and therefore go to a server that servces http://<site> http://<site> with a redirect to https://<something-very-similar-to-site> https://<something-very-similar-to-site>. If you are not paying close attention you might just assume the green highlight in the relevant part of the address bar means all is well, where you are in fact accessing something you were not expecting but which looks like what you were expecting long enough to collect some useful details (such as your account credentials) from you. While I can't get a cert signed for facebook.com (at least not without very expensive bribes or other human factors engineering) but I could get one for faceboolc.com easily enough and if you aren't looking closely that might fool the eye. It wouldn't catch everyone, anyone going direct to https://<site> https://<site> would be warned as you suggest, but it could catch some out.

davidbanham 13y ago

These attacks could be given longevity by using a cache manifest.

pocketstar 13y ago

Using a VPN would protect you against all of this right?

cenhyperion 13y ago
Assuming you can trust the VPN and the encryption is good it should.

malandrew 13y ago

Is it possible to use the browser in https only mode, or at least have it force launch any https sites in a new incognito mode window so that you know it's http-only. Furthermore, it would be nice if you could disable all text inputs on http-only windows. I know that I would be more likely to contact a site owner asking for https if it screamed at me everytime it happened. It's time to ditch http for all but rare use cases, because almost 2014.

jiri 13y ago
Yes, you can configure most browser to use proxy. So, I think, you can set the none proxy (or valid) for https and some invalid proxy ip for http, so you cannot connect to any http server.
noinsight 13y ago
Get the "HTTPS Everywhere" addon for Firefox, or, apparently, Chrome now.
- hnha 13y ago
  that "only" uses a list of known https domains to force the browser to use them. It does not magically enable "https everywhere".

chrissnell 13y ago

I've been thinking about the possibility of injecting a JavaScript bitcoin miner into every page loaded through my access point. Imagine the possibilities for an open AP that's located in a very public place, like Times Square, or near a busy Starbucks (where access is slow and unreliable). If you really wanted to take this to the evil next level, you'd just break one (or several) WPA keys on nearby APs and have your rouge injector AP act as both an open AP (to unsuspecting users) and a client (using cracked keys) to other APs, thus avoiding having to actually buy internet access for this spot. You'd essentially just need to find a place to hide and power your evil AP.

MichaelGG 13y ago
Is that even remotely lucrative? As I understand, even a $300 GPU is orders of magnitude more powerful than any CPU miner, let alone a JavaScript based one. And even a single GPU isn't remotely competitive these days compared to the GPU farms and now ASIC setups. So you'd need to inject JS into, I dunno, a million, devices to make anything worthwhile.
- dave1010uk 13y ago
  You could probably use WebCL, Flash or Silverlight to use the user's GPU. A quick Google shows this has been done with WebCL already: http://webcl.nokiaresearch.com/jsoclbm/ http://webcl.nokiaresearch.com/jsoclbm/
  - MichaelGG 13y ago
    There's a neat hardware comparison here: https://en.bitcoin.it/wiki/Mining_hardware_comparison https://en.bitcoin.it/wiki/Mining_hardware_comparison Seems like ASICs are measured in the thousands to tens or hundreds of thousands of MHashes/sec. Whereas powerful GPUs drawing ~1000 Watts don't even break 1000MH/sec. High-end laptop GPUs seem to be in the 10s of MH/sec, a quad-core Atom shows 2MH/sec, and the Galaxy SII comes in at 1.3. The vast majority of devices connecting to public APs are not going to be high-power systems. Not to mention the time they'll spend connected is unlikely to be 24/7. Even if it was, mining will probably drain batteries pretty quickly. Plus power-saving is likely to be on for mobile devices and reduce peak perf. And if it's just injecting JS, then backgrounded tabs should get much less CPU time. And WebGL/etc. are unlikely to be running in background tabs. If you assume a device stays connected and open for 1/4 a day, and stays for 3 days on average, and gives you 1MH/sec (seems optimistic, all things considered), 1 million devices compromised a month gives you ~$300 a month. If the assumption is that you can persistently own a machine, then you'd need less machines. But that's going beyond simple JS injection on HTML pages. I used this calculator: http://www.alloscomp.com/bitcoin/calculator http://www.alloscomp.com/bitcoin/calculator

quasque 13y ago

I wonder if this attack would also work on the http://www.gstatic.com/generate_204 http://www.gstatic.com/generate_204 page that Chrome uses to detect captive portals if you are accessing https pages.

odonnellryan 13y ago

It's pretty easy to set up a VPN on EC2. Probably not the BEST solution out there (the instances certainly aren't designed for that use) but better than nothing.

btgeekboy 13y ago
At $0.07/hour for 1TB/month, with <1min startup time, DigitalOcean is actually a decent host to do this with.

loser777 13y ago

Situations like these are how I justify keeping a low power 24/7 box on at home. In situations where I don't have my own (trusted) connection, I'll just ssh tunnel a SOCKS5 proxy to my home server. I only have a residential internet connection at home, but 2mbps is surprisingly snappy for casual or emergency on the go web browsing. With boxes out there (e.g. rPi) that push power consumption far south of 10W, it makes even more sense to do this now. Of course, it also doubles as an IRC idler/whatever else you can think of.

voltagex_ 13y ago
Yep, I have a Dreamplug with dual ethernet and an attached USB hard drive. Last I checked, the hard drive used more power than the machine itself. SSH is done through key authentication and there's an OpenVPN server if the network I'm connecting through isn't too locked down. Next trick is to do IP-over-DNS and I'll be all set where ever I am. Now if only someone would come out with a USB3-capable board with dual-gigE (I don't mind if it can only push 500Mbit each port)
- icebraining 13y ago
  Next trick is to do IP-over-DNS and I'll be all set where ever I am. iodine[1] is a fairly easy way to set that up. I just made a tunnel.mydomain.tld subdomain, pointed the NS records at my VPS and run "iodined 10.0.0.1 tunnel.mydomain.tld" [1] http://code.kryo.se/iodine/ http://code.kryo.se/iodine/

matiasb 13y ago

Has anyone tried ICMP tunnels?

simgidacav 13y ago

> Commandline snippet poisoning Really? So would you blindly copy-paste things into your shell? Then I don't need to hijack your connections, I just put malicious pastes on the website. If you are moron enough to copy-paste the first thing you find, you are probably not reading the other users' warnings about "this answer is wrong".

Lazare 13y ago
The attack mentioned is to change the text when you go to copy it; that will get even people who carefully read every forum post before copying and pasting. How many people review the snippet, copy, paste it into a text editor, re-review it, copy it, and then paste it into their shell?
- simgidacav 13y ago
  I deem your point good. I didn't realize it entirely. Still, since when I run GNU/Linux I never pasted a command line from a website into my terminal. This is just reckless. Borderline case, I understand what the example is showing me and then I apply.
- andrewaylett 13y ago
  Ctrl-X Ctrl-E in bash will open an editor for the current command, which is executed when the editor is exited. After the potential for exploit was publicised a few months ago, I use this every time and it's really not much more effort than just pasting into the shell. As a bonus, it means I don't have to worry about embedded newlines stopping me from tweaking the command before running it.
  - TheJH_ 13y ago
    You can embed \x1b (escape) into a webpage. When you copy-and-paste that, it has the same effect as hitting ESC in the editor. So, I'd just have to make you copy "<evil command>#\x1b:wq\n" to also catch the case that you're using vim instead of directly pasting. However, I can't figure out a way to escape from nano. (Tested it with the combination chromium+xterm+vim.)

fmavituna 13y ago

Inject something like XSS Tunnel (http://labs.portcullis.co.uk/download/XSS-Tunnelling.pdf http://labs.portcullis.co.uk/download/XSS-Tunnelling.pdf that gives you a local proxy that you can point your local browser and then sends all of your traffic through the victim, so you'll see and use the website(s) with your victim's session), or BeeF - http://beefproject.com/ http://beefproject.com/ for tons of exotic XSS based exploits.