9 ms·

How to exploit home routers for anonymity

199 points by DanMcInerney 12y ago

bluedino 12y ago
So basically this Shodan service scans the web, indexing devices such as IP cameras and routers. You can then search their database by device type or model, and then try the default user/passwords on these devices and create a VPN account for your own use? I wonder how many botnets use this technique instead of randomly scanning, whether it's their own implementation/database or using a service such as this. Also an interesting business model, "I've got the addresses of 10,000 XYZ routers, model 1234, for $50.00"
- peterwwillis 12y ago
  Botnets typically just infect a site and do drive-by exploiting of the client. Then they don't need a proxy and they get to siphon user information. Proxies/VPNs are only useful for things like C&C servers.
user24 12y ago
This submission just links to the homepage. here is the permalink: http://danmcinerney.org/how-to-exploit-home-routers-for-anonymity/ http://danmcinerney.org/how-to-exploit-home-routers-for-anon... perhaps a mod can update the URL.
- dabent 12y ago
  For what it's worth, the other articles on the home page look pretty interesting as well.
MrClean 12y ago
Ah. Great. Anonymity in the identity-theft way.
- AnthonyMouse 12y ago
  This is, incidentally, the reason why government-resistant anonymity services need to be legal. If you don't care about stealing credit card numbers or hurting people then you don't care about breaking into some poor sucker's router. But if you're blowing the whistle on some organizational malfeasance, you won't, so you need the likes of Tor.
  - rainsford 12y ago
    I think that oversimplifies an important point. Criminals may not CARE about breaking into someone's computer or router, but that doesn't mean they're capable of doing so. Tor significantly lowers the bar for anonymity online, and there is no question in my mind that it enables criminals who wouldn't have the means to mask their identities otherwise. This is not necessarily an argument against tools like Tor, but it's a tradeoff that I think many Tor supporters are too willing to ignore.
    - vezzy-fnord 12y ago
      Criminals are humans. They will use and abuse whatever infrastructure any other person has access to for their own purposes, much like (you guessed it) any other person. Your argument is about as lazy as it is old. The only possible solutions are to make all criminals go extinct (good luck), or to take away tons of important tools away from the public, because get this, criminals might use them! How terrible.
      - rainsford 12y ago
        Nowhere did I advocate "taking away tons of important tools", in fact I specifically said my point wasn't necessarily an argument against Tor. But what I think is lazy is the way some people pretend that there are no tradeoffs involved in things like Tor and that they only benefit "the public".
    - AnthonyMouse 12y ago
      > Criminals may not CARE about breaking into someone's computer or router, but that doesn't mean they're capable of doing so. The problem with this line of reasoning is that it covers such a small number of people. The only people your argument covers are serious criminals who a) are too stupid to be able to download a simple tool to exploit routers with unpatched vulnerabilities from last year and yet b) are still competent enough to use Tor without doing anything that would reveal their identity. And that also excludes the most serious criminals because the set of people who can break into the computers of large organizations to commit crimes is essentially a superset of the set of people who can break into an unpatched consumer-level router.
hf 12y ago
The opening paragraph asserts that simply not publishing ("censoring") such concrete, recipe-like exploits of the deficiencies of our shared infrastructure "won't make practices like those outlined [in the article] disappear"[2]. I am reminded of Steve Kemp's 2014 post »Secure your rsync shares, please«[0], relating how he abandoned a project employing zmap[1] upon discovering numerous openly accessible rsync shares containing sensible information. His closing remarks echo the sentiment of the article under discussion here: "I considered not posting this, but I suspect 'bad people' already know..,"[0] What can be done? Are we reduced to just securing our friends' and families' infrastructure, all the while standing by idly while others outside of our direct sphere of influence suffer the consequences of naïvety? [0] http://blog.steve.org.uk/secure_your_rsync_shares__please_.html http://blog.steve.org.uk/secure_your_rsync_shares__please_.h... [1] A cleverly-built, fast network scanner, https://zmap.io/ https://zmap.io/ [2] http://danmcinerney.org/how-to-exploit-home-routers-for-anonymity/ http://danmcinerney.org/how-to-exploit-home-routers-for-anon...
- mcherm 12y ago
  > What can be done? Are we reduced to just securing our friends' and families' infrastructure, all the while standing by idly while others outside of our direct sphere of influence suffer the consequences of naïvety? No. We can write articles similar to this one which, instead of clearly explaining step-by-step procedures for exploiting weaknesses, clearly explain step-by-step procedures for REPAIRING weaknesses.
  - jasonkolb 12y ago
    I think you give way too much credit to the average person. It's easy to lose sight of how scary technical things are to normal people when you're in it day in and day out, but to ask the average person to change something in their router is kind of like asking me to replace a cylinder in my car. There's a reason things like the Geek Squad are around and can charge as much as they do...
    - 0xdeadbeefbabe 12y ago
dfa0 12y ago
Another reminder to use strong, non-default credentials on something that is the edge of your network. I'm still amazed by how many people drive around leaving their cars unlocked.
- kordless 12y ago
  I leave my keys in the car sometimes when I'm running errands in my home town. I care a whole lot more about my network security at home than I do my car. It's just a car.
  - dfa0 12y ago
    The reason to secure your network is a good reason to secure your car. Your network and your car can/will be used by bad guys to do bad things. You should care.
    - MAGZine 12y ago
      somehow i'm less worried about people stealing my car when I'm driving around at 60kmph.
      - ticktocktick 12y ago
        You are part of a society in which you have an obligation to protect and preserve the safety of others through reasonable and responsible actions. I don't think that locking your car while it is parked or not leaving your keys in it while it is unattended is too much to ask. FFS.
  - js2 12y ago
    You are potentially exposing yourself to liability should your car be stolen and involved in an accident: http://courses2.cit.cornell.edu/sociallaw/student_projects/EmpiricalEvidence.htm http://courses2.cit.cornell.edu/sociallaw/student_projects/E... (IANAL, it looks like a court is not likely to find you liable, but you're still exposing yourself to the hassle of a law suit.)
  - 12y ago
abus 12y ago
Why release pre-made tools that allow anyone to cause harm? You could still explain the problem without them or show code snippets if you have to.
- vezzy-fnord 12y ago
  It's the most effective wake-up call.
- xenophonf 12y ago
  Because I don't believe you until you release the proof-of-concept. It's like saying you made some huge scientific discovery without including the data and methods to back it up.
jonaldomo 12y ago
This is a good write up Dan. Is there anything as an owner of a home router we can do to protect ourselves?
- checker 12y ago
  I'm no expert but I imagine it's a combination of keeping your router's firmware up-to-date, using a properly configured firewall, and using a strong password for your router login.
  - engtech 12y ago
    You'd think, but most consumer equipment is abandonware and the firmware isn't updated once a newer model is out.
- nissehulth 12y ago
  Make sure your router doesn't allow admin access from the outside. Make sure you have a decent admin password. Disable any built-in cloud/ftp/sharing services that you don't use or need. If you use them, make sure to use good passwords and remove any built-in/default account. Disable UPnP in the router if you don't really need it (and understand the risks).
- thejosh 12y ago
  don't let your router be able to be accessed from outside, ie disable 80/8080/22.
kordless 12y ago
It feels like we need to include anonymity in the Internet Bill of Rights: 1. I have a right to read or write public information in an anonymous way. 2. I have a right to prevent you from reading or writing MY private information in an anonymous way, even if the intent is to obtain the right to exercise #1 in the process. 3. Using someone else's infrastructure/compute/power to enable #1 without breaking #2 requires you pay for it. I would also propose my private information is available at a price. Expecting the right to anonymity by removing the rights of others in the process places an individual in cognitive dissonance. It's not a good place to be. With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while.
- devconsole 12y ago
  With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while. Your infrastructure will immediately be used to download or upload child pornography. If you're exceptionally unlucky, the FBI will come knocking and, if you're unable to provide them with a useful honeypot, you may risk legal consequences. If you're unable to prove your innocence (the request for the CP did come from your IP address, after all) then you may be very screwed. I invite the community to toss around ideas about how to protect against this. I hypothesize that it's an unsolvable problem: if you enable strong anonymity, that anonymity will immediately be used for child porn. One way to combat this would be to have some kind of credentialing, where you are able to generate credentials for the anonymous party to use. Assuming your infrastructure is set up as a Tor hidden service, then it's possible for them to use your infrastructure anonymously, and then you can revoke the credentials for individual violators. However, under that scheme, your IP address(es) are shared by every user. 4chan will immediately ban all of them as soon as it becomes clear you're a proxy, for example. It may still be worth exploring, but it needs some thought. Tor itself still doesn't have "endpoint bridges," that is, endpoints which aren't publicly listed. Meaning it's very easy to ban all of Tor, as far as I know.
  - 12y ago
bradleyland 12y ago
Probably worth pointing out that one should remain aware of their local laws when carrying out such activities as the ones outlined in this HOW TO. Because you're blindly hitting hosts and attempting logins, you don't know whose infrastructure you're probing. If you accidentally knock on the wrong door, the simple act of attempting a log in can cause issues for you (legal and otherwise). I'm trying to avoid sounding like Chicken Little here, but this article makes these actions very accessible. If you're someone who is just getting started toying with networks and security, it's likely that you haven't thought through what can happen if something you try actually works. Nmap has a great page that discusses the ins-and-outs of the civil and legal issues involved with port scanning (a related activity). However, keep in mind that the guide linked here goes well beyond port scanning in to actually attempting, and presumably, gaining access to someone else's network. While the legality of port scanning is ambiguous, accessing someone else's network is not. If you land on the wrong guy's lawn, you can end up in a very expensive, and potentially dangerous place. http://nmap.org/book/legal-issues.html http://nmap.org/book/legal-issues.html
- 0xdeadbeefbabe 12y ago
  Of course you can ignore all that if you are attacking from Nigeria. Laws are exciting and important (especially good ones like Newton's laws of motion), but laws could improve too: If someone gets caught doing this they probably ought to do community service working on some bug bounty program instead of going to jail.
  - Nanzikambe 12y ago
    I love this impression that if you're connecting from <insert somewhere in Africa>, laws don't apply. I'd wager nobody that's ever actually lived anywhere in 3rd world bandies it about. True, you're less likely to actually be convicted, but the months/years waiting for trail is guaranteed to be worse than your actual sentence elsewhere, if not fatal.
    - domdip 12y ago
      The parent specifically mentioned Nigeria. Africa is not a country, and his comment may not apply to say, South Africa or Morocco. You're the one generalizing about 3rd world countries, not him. If you think LLE or even the FBI is going to open the diplomatic channels necessary to pursue someone in Nigeria over access to a consumer-grade router, you're kidding yourself. For all practical purposes, these laws do not in fact apply there.
dtwwtd 12y ago
A couple years back there was a similar presentation at Defcon that used routers that exposed UPNP to the public internet. I've linked the talk below: http://defcon.org/html/links/dc-archives/dc-19-archive.html#Garcia http://defcon.org/html/links/dc-archives/dc-19-archive.html#...
deleted 12y ago
[deleted]
timtadh 12y ago
Stuff like this is why I built my own router (I recommend the ALIX series http://pcengines.ch/alix.htm http://pcengines.ch/alix.htm). High quality hardware and you don't have to worry about the software because you control all of it. Right down to the BIOS if you want to.
- devconsole 12y ago
  How would you verify on demand that the BIOS isn't compromised?
  - timtadh 12y ago
    I don't know about "on demand" but PCEngines will give the source for the BIOS and has an older version posted to the site. http://pcengines.ch/tinybios.htm http://pcengines.ch/tinybios.htm
    - devconsole 12y ago
      What I mean is, how would we verify the BIOS firmware matches what that source code should produce? If it's possible for us to make our own builds (i.e. there's no cryptographic signing for the BIOS binaries) then an adversary can insert a backdoor into the source code, make their own build, and then remotely flash your hardware with it. Or does flashing the hardware require some kind of manual operation, like holding down a button for 30 seconds?
  - lurkinggrue 12y ago
    Could be the processors as well, better to forge the chips by hand to be sure.
notastartup 12y ago
seems like google is saying it's a malware site where's the cached version
noonespecial 12y ago
The nice thing about this is that you don’t have to wonder whether or not your VPN provider is saving logs or not, you are in control of that. If you take over a single router, a provider does indeed have logs of both the inbound you used to reach the router, and the outbound traffic you create from it. Simple timing logging will show its you and if its "their" router, they'll (at least theoretically) be able to decrypt your traffic too. (And that's assuming it wasn't a great big tasty honey-pot to begin with, pooh-bear) If you must do this, bounce between a few... and if you must do this, just use tor already.
- wmf 12y ago
  In this case the VPN "provider" is the router itself and since you owned it you can eliminate logs. The ISP may have flow-level logs but those are so voluminous that they probably aren't kept long.
  - ZoF 12y ago
    The parent comment was(pretty clearly) referring to what you're calling "flow-level logs"... Quite obviously you can delete the router's logs(it's mentioned in the article and by the parent comment); the ISP's traffic logs on the other hand? > those are so voluminous that they probably aren't kept long. Bold assertion.
bananas 12y ago
If you fancy going out, this works pretty well. I tried it on my router: http://www.nickkusters.com/Services/Thomson-SpeedTouch http://www.nickkusters.com/Services/Thomson-SpeedTouch Yes - default WiFi passwords for a big chunk of the routers in Europe are pretty easy to calculate.

199 points by DanMcInerney 12y ago

So basically this Shodan service scans the web, indexing devices such as IP cameras and routers. You can then search their database by device type or model, and then try the default user/passwords on these devices and create a VPN account for your own use? I wonder how many botnets use this technique instead of randomly scanning, whether it's their own implementation/database or using a service such as this. Also an interesting business model, "I've got the addresses of 10,000 XYZ routers, model 1234, for $50.00"

peterwwillis 12y ago
Botnets typically just infect a site and do drive-by exploiting of the client. Then they don't need a proxy and they get to siphon user information. Proxies/VPNs are only useful for things like C&C servers.

user24 12y ago

This submission just links to the homepage. here is the permalink: http://danmcinerney.org/how-to-exploit-home-routers-for-anonymity/ http://danmcinerney.org/how-to-exploit-home-routers-for-anon... perhaps a mod can update the URL.

dabent 12y ago
For what it's worth, the other articles on the home page look pretty interesting as well.

MrClean 12y ago

Ah. Great. Anonymity in the identity-theft way.

AnthonyMouse 12y ago
This is, incidentally, the reason why government-resistant anonymity services need to be legal. If you don't care about stealing credit card numbers or hurting people then you don't care about breaking into some poor sucker's router. But if you're blowing the whistle on some organizational malfeasance, you won't, so you need the likes of Tor.
- rainsford 12y ago
  I think that oversimplifies an important point. Criminals may not CARE about breaking into someone's computer or router, but that doesn't mean they're capable of doing so. Tor significantly lowers the bar for anonymity online, and there is no question in my mind that it enables criminals who wouldn't have the means to mask their identities otherwise. This is not necessarily an argument against tools like Tor, but it's a tradeoff that I think many Tor supporters are too willing to ignore.
  - vezzy-fnord 12y ago
    Criminals are humans. They will use and abuse whatever infrastructure any other person has access to for their own purposes, much like (you guessed it) any other person. Your argument is about as lazy as it is old. The only possible solutions are to make all criminals go extinct (good luck), or to take away tons of important tools away from the public, because get this, criminals might use them! How terrible.
    - rainsford 12y ago
      Nowhere did I advocate "taking away tons of important tools", in fact I specifically said my point wasn't necessarily an argument against Tor. But what I think is lazy is the way some people pretend that there are no tradeoffs involved in things like Tor and that they only benefit "the public".
  - AnthonyMouse 12y ago
    > Criminals may not CARE about breaking into someone's computer or router, but that doesn't mean they're capable of doing so. The problem with this line of reasoning is that it covers such a small number of people. The only people your argument covers are serious criminals who a) are too stupid to be able to download a simple tool to exploit routers with unpatched vulnerabilities from last year and yet b) are still competent enough to use Tor without doing anything that would reveal their identity. And that also excludes the most serious criminals because the set of people who can break into the computers of large organizations to commit crimes is essentially a superset of the set of people who can break into an unpatched consumer-level router.

hf 12y ago

The opening paragraph asserts that simply not publishing ("censoring") such concrete, recipe-like exploits of the deficiencies of our shared infrastructure "won't make practices like those outlined [in the article] disappear"[2]. I am reminded of Steve Kemp's 2014 post »Secure your rsync shares, please«[0], relating how he abandoned a project employing zmap[1] upon discovering numerous openly accessible rsync shares containing sensible information. His closing remarks echo the sentiment of the article under discussion here: "I considered not posting this, but I suspect 'bad people' already know..,"[0] What can be done? Are we reduced to just securing our friends' and families' infrastructure, all the while standing by idly while others outside of our direct sphere of influence suffer the consequences of naïvety? [0] http://blog.steve.org.uk/secure_your_rsync_shares__please_.html http://blog.steve.org.uk/secure_your_rsync_shares__please_.h... [1] A cleverly-built, fast network scanner, https://zmap.io/ https://zmap.io/ [2] http://danmcinerney.org/how-to-exploit-home-routers-for-anonymity/ http://danmcinerney.org/how-to-exploit-home-routers-for-anon...

mcherm 12y ago
> What can be done? Are we reduced to just securing our friends' and families' infrastructure, all the while standing by idly while others outside of our direct sphere of influence suffer the consequences of naïvety? No. We can write articles similar to this one which, instead of clearly explaining step-by-step procedures for exploiting weaknesses, clearly explain step-by-step procedures for REPAIRING weaknesses.
- jasonkolb 12y ago
  I think you give way too much credit to the average person. It's easy to lose sight of how scary technical things are to normal people when you're in it day in and day out, but to ask the average person to change something in their router is kind of like asking me to replace a cylinder in my car. There's a reason things like the Geek Squad are around and can charge as much as they do...
  - 0xdeadbeefbabe 12y ago

dfa0 12y ago

Another reminder to use strong, non-default credentials on something that is the edge of your network. I'm still amazed by how many people drive around leaving their cars unlocked.

kordless 12y ago
I leave my keys in the car sometimes when I'm running errands in my home town. I care a whole lot more about my network security at home than I do my car. It's just a car.
- dfa0 12y ago
  The reason to secure your network is a good reason to secure your car. Your network and your car can/will be used by bad guys to do bad things. You should care.
  - MAGZine 12y ago
    somehow i'm less worried about people stealing my car when I'm driving around at 60kmph.
    - ticktocktick 12y ago
      You are part of a society in which you have an obligation to protect and preserve the safety of others through reasonable and responsible actions. I don't think that locking your car while it is parked or not leaving your keys in it while it is unattended is too much to ask. FFS.
- js2 12y ago
  You are potentially exposing yourself to liability should your car be stolen and involved in an accident: http://courses2.cit.cornell.edu/sociallaw/student_projects/EmpiricalEvidence.htm http://courses2.cit.cornell.edu/sociallaw/student_projects/E... (IANAL, it looks like a court is not likely to find you liable, but you're still exposing yourself to the hassle of a law suit.)
- 12y ago

abus 12y ago

Why release pre-made tools that allow anyone to cause harm? You could still explain the problem without them or show code snippets if you have to.

vezzy-fnord 12y ago
It's the most effective wake-up call.
xenophonf 12y ago
Because I don't believe you until you release the proof-of-concept. It's like saying you made some huge scientific discovery without including the data and methods to back it up.

jonaldomo 12y ago

This is a good write up Dan. Is there anything as an owner of a home router we can do to protect ourselves?

checker 12y ago
I'm no expert but I imagine it's a combination of keeping your router's firmware up-to-date, using a properly configured firewall, and using a strong password for your router login.
- engtech 12y ago
  You'd think, but most consumer equipment is abandonware and the firmware isn't updated once a newer model is out.
nissehulth 12y ago
Make sure your router doesn't allow admin access from the outside. Make sure you have a decent admin password. Disable any built-in cloud/ftp/sharing services that you don't use or need. If you use them, make sure to use good passwords and remove any built-in/default account. Disable UPnP in the router if you don't really need it (and understand the risks).
thejosh 12y ago
don't let your router be able to be accessed from outside, ie disable 80/8080/22.

kordless 12y ago

It feels like we need to include anonymity in the Internet Bill of Rights: 1. I have a right to read or write public information in an anonymous way. 2. I have a right to prevent you from reading or writing MY private information in an anonymous way, even if the intent is to obtain the right to exercise #1 in the process. 3. Using someone else's infrastructure/compute/power to enable #1 without breaking #2 requires you pay for it. I would also propose my private information is available at a price. Expecting the right to anonymity by removing the rights of others in the process places an individual in cognitive dissonance. It's not a good place to be. With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while.

devconsole 12y ago
With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while. Your infrastructure will immediately be used to download or upload child pornography. If you're exceptionally unlucky, the FBI will come knocking and, if you're unable to provide them with a useful honeypot, you may risk legal consequences. If you're unable to prove your innocence (the request for the CP did come from your IP address, after all) then you may be very screwed. I invite the community to toss around ideas about how to protect against this. I hypothesize that it's an unsolvable problem: if you enable strong anonymity, that anonymity will immediately be used for child porn. One way to combat this would be to have some kind of credentialing, where you are able to generate credentials for the anonymous party to use. Assuming your infrastructure is set up as a Tor hidden service, then it's possible for them to use your infrastructure anonymously, and then you can revoke the credentials for individual violators. However, under that scheme, your IP address(es) are shared by every user. 4chan will immediately ban all of them as soon as it becomes clear you're a proxy, for example. It may still be worth exploring, but it needs some thought. Tor itself still doesn't have "endpoint bridges," that is, endpoints which aren't publicly listed. Meaning it's very easy to ban all of Tor, as far as I know.
- 12y ago

bradleyland 12y ago

Probably worth pointing out that one should remain aware of their local laws when carrying out such activities as the ones outlined in this HOW TO. Because you're blindly hitting hosts and attempting logins, you don't know whose infrastructure you're probing. If you accidentally knock on the wrong door, the simple act of attempting a log in can cause issues for you (legal and otherwise). I'm trying to avoid sounding like Chicken Little here, but this article makes these actions very accessible. If you're someone who is just getting started toying with networks and security, it's likely that you haven't thought through what can happen if something you try actually works. Nmap has a great page that discusses the ins-and-outs of the civil and legal issues involved with port scanning (a related activity). However, keep in mind that the guide linked here goes well beyond port scanning in to actually attempting, and presumably, gaining access to someone else's network. While the legality of port scanning is ambiguous, accessing someone else's network is not. If you land on the wrong guy's lawn, you can end up in a very expensive, and potentially dangerous place. http://nmap.org/book/legal-issues.html http://nmap.org/book/legal-issues.html

0xdeadbeefbabe 12y ago
Of course you can ignore all that if you are attacking from Nigeria. Laws are exciting and important (especially good ones like Newton's laws of motion), but laws could improve too: If someone gets caught doing this they probably ought to do community service working on some bug bounty program instead of going to jail.
- Nanzikambe 12y ago
  I love this impression that if you're connecting from <insert somewhere in Africa>, laws don't apply. I'd wager nobody that's ever actually lived anywhere in 3rd world bandies it about. True, you're less likely to actually be convicted, but the months/years waiting for trail is guaranteed to be worse than your actual sentence elsewhere, if not fatal.
  - domdip 12y ago
    The parent specifically mentioned Nigeria. Africa is not a country, and his comment may not apply to say, South Africa or Morocco. You're the one generalizing about 3rd world countries, not him. If you think LLE or even the FBI is going to open the diplomatic channels necessary to pursue someone in Nigeria over access to a consumer-grade router, you're kidding yourself. For all practical purposes, these laws do not in fact apply there.

dtwwtd 12y ago

A couple years back there was a similar presentation at Defcon that used routers that exposed UPNP to the public internet. I've linked the talk below: http://defcon.org/html/links/dc-archives/dc-19-archive.html#Garcia http://defcon.org/html/links/dc-archives/dc-19-archive.html#...

deleted 12y ago

[deleted]

timtadh 12y ago

Stuff like this is why I built my own router (I recommend the ALIX series http://pcengines.ch/alix.htm http://pcengines.ch/alix.htm). High quality hardware and you don't have to worry about the software because you control all of it. Right down to the BIOS if you want to.

devconsole 12y ago
How would you verify on demand that the BIOS isn't compromised?
- timtadh 12y ago
  I don't know about "on demand" but PCEngines will give the source for the BIOS and has an older version posted to the site. http://pcengines.ch/tinybios.htm http://pcengines.ch/tinybios.htm
  - devconsole 12y ago
    What I mean is, how would we verify the BIOS firmware matches what that source code should produce? If it's possible for us to make our own builds (i.e. there's no cryptographic signing for the BIOS binaries) then an adversary can insert a backdoor into the source code, make their own build, and then remotely flash your hardware with it. Or does flashing the hardware require some kind of manual operation, like holding down a button for 30 seconds?
- lurkinggrue 12y ago
  Could be the processors as well, better to forge the chips by hand to be sure.

notastartup 12y ago

seems like google is saying it's a malware site where's the cached version

noonespecial 12y ago

The nice thing about this is that you don’t have to wonder whether or not your VPN provider is saving logs or not, you are in control of that. If you take over a single router, a provider does indeed have logs of both the inbound you used to reach the router, and the outbound traffic you create from it. Simple timing logging will show its you and if its "their" router, they'll (at least theoretically) be able to decrypt your traffic too. (And that's assuming it wasn't a great big tasty honey-pot to begin with, pooh-bear) If you must do this, bounce between a few... and if you must do this, just use tor already.

wmf 12y ago
In this case the VPN "provider" is the router itself and since you owned it you can eliminate logs. The ISP may have flow-level logs but those are so voluminous that they probably aren't kept long.
- ZoF 12y ago
  The parent comment was(pretty clearly) referring to what you're calling "flow-level logs"... Quite obviously you can delete the router's logs(it's mentioned in the article and by the parent comment); the ISP's traffic logs on the other hand? > those are so voluminous that they probably aren't kept long. Bold assertion.

bananas 12y ago

If you fancy going out, this works pretty well. I tried it on my router: http://www.nickkusters.com/Services/Thomson-SpeedTouch http://www.nickkusters.com/Services/Thomson-SpeedTouch Yes - default WiFi passwords for a big chunk of the routers in Europe are pretty easy to calculate.