The Internet of Compromised Things

http://blog.codinghorror.com/welcome-to-the-internet-of-compromised-things/

by jdkanani • 11 years ago

52 17 11 years ago

blog.codinghorror.com

bobajeff• 11 years ago

This is a serious problem for those of us who need to use public WiFi. The only thing standing in the way would be HTTPS but that's far from comprehensive at this point.

revelation2• 11 years ago

If your livelihood depends on a clean machine and you commonly need to use untrusted networks, you absolutely need to use a VPN.

The only problem is with the shoddy crap we call operating systems, very difficult to have them maintain radio silence until the VPN is active.

chopin• 11 years ago

How can one maintain radio silence until a VPN tunnel over a WiFi is set up?

tim3332• 11 years ago

You can use Hotspot Shield https://en.wikipedia.org/wiki/Hotspot_Shield

I've generally found it ok. They can serve annoying ads if you use the free service.

pdkl95• 11 years ago

It might be useful to use Upside-Down-Ternet[1] as an educational tool when explaining this kind of attack to non-technical audiences.

[1] http://www.ex-parrot.com/pete/upside-down-ternet.html

rentnorove• 11 years ago

On how HTTPS sites are compromised:

Compromised router answers DNS req for *.google.com to 3rd party with faked HTTPS cert, you download malware Chrome. Game over.

So this is a DNS mitm? Doesn't it still require the faked cert to be signed by a trusted root CA?

falcolas• 11 years ago

Yes. Thankfully, that's never happened to Google yet.

The worst part is that we don't know that it's happened until someone figures out that they're being MITM'ed.

simpsond• 11 years ago

I am trying to confirm that cox does this with google. The cert is funky and doesn't match what I see from other connections. All hosts from nslookup are cox hosts, etc.

omgmypztxqma• 11 years ago

Some thoughts:

Lots of people think nothing of a bounce from an HTTPS download link to an HTTP-only download link, and will happily ignore even flagrant warnings...

Root CA's have been compromised in the past, and will be again. I expect 0-day root CAs are up for sale somewhere as I type. It's not like the so-called "good guys" can't physically demand access to private keys, or big businesses can't out-right buy root trust (ex, "We need to do this on our private network - we'll never put it on the Internet, really. Here's a lot of money."). The root system is only as strong as it's weakest policies, and it's about as leaky as a steamer basket.

Even if an attacker can't get a directly useful signature, she can take control of a server already in possession of a valid cert, merely for hosting purposes (if Ubiquiti can be scammed, so can Google, as can you or I). This can be an inside job, or a one-off breach - all it takes is one click or breach of trust. (The DNS MITM tricks that work for the download can also be used to get between 2 parties higher up the trust heirarchy.)

And, of course, it is also always possible to buy a fresh, perfectly valid cert for a domain that looks close enough to pass the user test, or - quite alarmingly - one with UTF characters that combine to display in the address bar identically - or close enough - to the domain being impersonated.

That's just what comes to my mind immediately.

It's amazing any of it works at all, and arguably it doesn't. If you haven't be breached, it's probably because you haven't been targeted,

notacoward• 11 years ago

That's one of the reasons I'm on a VPN right now. I'm at a rental place, and the owner is reasonably competent technically (ex-DEC engineer - we have some good chats), but I still don't trust that his router is 100% safe. Come to think of it, I don't trust that mine is. Maybe I should start using a VPN even while I'm at home. Unfortunately, this can introduce a few problems of its own.

(1) You have to trust the VPN provider. Not a big problem in this case, but worth mentioning.

(2) If you have to be on your work VPN as well, you're going to have a bad time. Being only on the work VPN often isn't an option, as a lot of personal use might run into blocks and/or violate the company's policy on use of their resources.

(3) Some sites block VPNs, either intentionally or unintentionally. Just yesterday I noticed that Tumblr is blocking most (but not all) of my VPN's connection points. It's probably just an overzealous anti-DOS system rather than a deliberate block, but the effect is the same.

We really do need a better solution here. Jeff's right that home routers are a huge vulnerability. DNS and BGP hijinks are too effective and well known to leave them unaddressed any longer, and there are other issues that need to be solved as well.

revelation2• 11 years ago

You can eliminate 1 by self-hosting your VPN and possibly 2 with some configuration magic to have the work stuff accessible from your own VPN.

3 is actually a bit of a problem, AWS IP ranges are notorious for being widely banned.

Sven7• 11 years ago

ISP's could be doing a better job of looking for/blocking out these shaddy DNS servers. Until that happens, workaround is to setup all devices to not rely on router provided DNS.

Decade• 11 years ago

Blocking DNS servers gets into the tricky business of common carrier status, and also actually knowing which DNS servers really are shady and which are just hijacked. Because if you block a server that’s sending shady results, you could block a legitimate service.

If you don’t trust router-provided DNS, then you really shouldn’t trust the unencrypted DNS traffic that goes through your router, either. The current defense against that is to run your own recursive DNSSEC-validating DNS server. Most domains are not DNS signed, though, and most clients do not distinguish DNSSEC results, so this is sort of hollow advice.

agl• 11 years ago

The claim about HTTPS not being sufficient for downloading Chrome (or anything else) is incorrect. The page cites https://cryptostorm.org/viewtopic.php?f=67&t=8713 for this, but that's a long page of nonsense.

Most likely what's happening is that HTTP resource loads are being manipulated; thus it appears to affect all browsers. Also possible is that the end-machine has been compromised some other way and the malware is attacking local programs.

As far as a user is concerned, the difference is irrelevant, but we'll never get a grip on problems if even technical pages are fear mongering.

marcusae313• 11 years ago

VPN addresses a different issue not the one discussed in the article. If your router is compromised, then the encryption on the local network is useless, including that which is used to encrypt the VPN tunnel.

ikeboy• 11 years ago

Why? Encryption of VPN is enforced on the OS level, not the router level.

tim3332• 11 years ago

Never access anything but HTTPS websites. If it isn't available over HTTPS, don't go there!

I thought it was funny that that comment is on a http:// website.

The Internet of Compromised Things

Related Stories