Unpatched routers being used to build vast proxy army, spy on networks | Hacker News Reader

Unpatched routers being used to build vast proxy army, spy on networks

arstechnica.com

105 pointsrbanffy46 comments

I finally convinced myself of building an opnsense wifi router after years of procrastination. I want to take back control of my network, or at least monitor it properly.

What are the most interesting network analysis tools I should look into? I'm talking more about high-level visualisations. For example, I'd be interested in keeping a list of every device that's ever connected to my network, and maybe get alerts upon detecting it. Or map requests/connections in real-time/historically on a globe in HTML5. Just some fun stuff to actually get a sense of what's going on in my network.

Any recommendations?

carpie.net has a great set of videos on using a Raspberry Pi as your own home network DHCP/DNS. I set it up relatively quickly and I definitely have a greater sense of control over my home network.

How do you deal with the combined USB/Ethernet 100MB/s bus cap?

Probably by not having 100 MB/s of DHCP and DNS traffic at home.

Some of us can't pull that much data over our uplink...

This was fixed in the newer Pis: https://libre.computer/2018/03/21/raspberry-pi-3-model-b-rev...

I would still recommend the Turris Omnia [1], even though I fought it a little too much and moved to Ubiquiti.

Basically you want a fast machine with a good switch, running something like OpenWRT. You may also want to play around with OPNsense [2] in a VM.

1: https://omnia.turris.cz/en/

2: https://opnsense.org/

I have used ntopng w/nprobe as collector of netflow data in both work environments and at home. If you have any educational affiliation there's a good chance you can get a pro and Enterprise license for free for both products that renews annually. The community edition is somewhat limited in what it can do but is worth taking a look at.

https://www.ntop.org/products/traffic-analysis/ntop/

mitmproxy is what you need. I've installed it on a Raspberry Pi that then acts as a hotspot. mitmproxy allows me to see every bit of data that is being put on the wire. All telemetry, pings, contacts, and more being transmitted home (respective of encryption). A transparent proxy is essential if you want to deep drive into what the apps on your network are actually doing.

Do you happen to know what added latency one can expect from using one of those? (Apologies if my brief googling was off-point and this is a well answered question)

Did a little googling and couldn’t find any benchmarks but the new v4 release claims a 4x improvement in speed.

https://mitmproxy.org/posts/releases/mitmproxy4/

So for people like myself who don't know much about this stuff, I was wondering what we can learn to figure out if the routers we are using are compromised in any way. On a similar tangent, is there any way we can detect any editing being done by an ISP? Like how and where they might be inserting headers into our traffic for example.

Just curious where to start in this exercise.

I guess the preferred way to discover if your router is compromised would be by network analysis... And you would need to plug it into some other computer for that, what just shifts the problem to the other computer.

I guess you can gain some confidence that it isn't compromised, but can never be sure.

About edit being done by the ISP, once you fix on a not all powerful adversary (not the NSA), it's easy to get some machine it couldn't have tainted.

That doesn't sound like a way that would be preferred by any home user. How about starting with a list of affected routers?

Well, you are going with a completely different question than the one I got. And rereading the GP, I don't know which is correct, so, well maybe.

Maybe haveibeenpwned can start to check IP addresses against these global scans when you visit their site.

For non-technical people, or people who just don't know much about this kind of thing, I would suggest just reviewing what the latest firmware version is, and updating if there are new versions. Also, review release history, if available. If your router is getting less than 2 or 3 updates a year, assume there are unfixed bugs or security issues.

For this specific issue? It only affects Mikrotik routers, and the vulnerability has been patched. So if you aren't using Mikrotik, or if you are and have the latest firmware, you're good.

>For non-technical people, or people who just don't know much about this kind of thing, I would suggest just reviewing what the latest firmware version is, and updating if there are new versions.

I think you vastly overestimate how much technical knowledge non-technical people have. A huge swath of non-technical people that use computers won't even know which component the router is, let alone know how to log into the UI and check the firmware.

This is sadly true. When it comes to computer security most of humanity is incredibly vulnerable. It's all so confusing for them. Sometimes the URL bar in their browser is a URL, sometimes it's the search phrase they typed and there's no URL. Many can't tell you the difference (still in 2018 this blows my mind) the difference between their web browser and the internet. I actually had a discussion with someone yesterday where they told me they didn't download a document they just previewed it... FROM THEIR DOWNLOADS FOLDER. They thought quick viewing the doc in their OS's preview function was not the same as full blown opening it an app which was akin to "downloading it". I had to explain that the bits were in fact on their computer, downloaded.

It's easy for us to point the finger and say people need to invest in their own personal understanding of this stuff. To some extent I agree but I also want my CPA to spend his free time learning more about the tax code and my finances, not patching his router. Overall computer security needs a reset. For all the complaints of "walled gardens" and "lock in" etc... most folks' iPhone is the closest they'll ever get to a secure computer. That's a shame.

I'm surprised that neither here, nor in the article 2 days ago, I can find a list of affected routers. Or even a tip on how should I check if my Mikrotik is affected / has been pwnd by either of those attacks.

In hopefully unrelated story, my Mikrotik and/or my ISP has been acting up in the past hour; I've lost the ability to resolve many .com domains for ~30 minutes, even though I have Google's NS configured set up as the first two on the router. Manual queries (Mikrotik: resolve somedomain.com server 8.8.8.8 / Local: nslookup - 8.8.8.8) resolved correctly; it's just defaults that couldn't. Sad to admit this, but I have no clue what's going on -.-

Most models can be affected. Check if your first firewall rule sends to the built in proxy. See https://www.google.ca/amp/blog.netlab.360.com/7500-mikrotik-... in particular check if the webproxy and/or socks service are enabled.

Seems I'm fine with that, for now. Thanks.

Past edit window, but update on the DNS issue: it seems to have been a coincidence after all.

Apparently, ISP's NS stopped resolving a lot of .com domains, and it must have poisoned my router's cache. After disabling DNS peering (to avoid ISP's NS injecting itself) and flushing cache, the problem seems to be resolved.

Related, from 2 days ago - https://news.ycombinator.com/item?id=17908028

After the last one of these articles, I finally flashed my router with OpenWRT, and it's been pretty nice so far. Best feature: Installed `adblock` package, and now I get DNS-level ad blocking, which is simply fantastic. Works on all clients (including mobile) and significantly faster than blocking in browser.

> significantly faster than blocking in browser.

Also significantly less effective.

It’s nice for devices/cases where you cannot have an adblocker in your browser. It is unnecessary otherwise.

Yep, that's true, not fully effective but:

- Nice for TVs and other devices where you can't control the apps

- Or even in phones or tablets, if you don't have root access , you can block lots of ads in browser or even in apps

- Also, you can reduce the quantity of CPU used by ad blockers on your devices (again, essentially, phones and tablets).

- Also nice for visitors in your network ;)

A nice alternative which allows you to keep using your router's own software or routers not compatible with open source software is PI-HOLE (https://pi-hole.net). Provides the same DNS level blocking with a lot more information and features.

I've been thinking of getting a Pi-Hole for a while, but also have a router running OpenWRT. Are there any advantages/disadvantages to using a Pi-Hole vs. using an AdBlock package on the router?

Off the top of my head the Adblock might use up CPU cycles on the router, which could cause slower throughput and shorten the lifespan of your router.

You get a lot more info from Pi-Hole about what IPs and URLs your devices are accessing. Lots of good information outside the ad blocking realm - which devices are phoning home and where and how often is just one example.

I used an adblock package in pfSense but not OpenWRT. The issues I had with pfSense's package was it wasn't nearly as configurable as pi-hole and it used up a bit too many resources on the Soekris 5505 box. I had to uninstall it because it took too many resources.

I ended up installing Docker on my laptop, grabbing the Pi-Hole container, and configuring my laptop to use the docker container as the DNS server.

So far this has worked very well. Wherever I go, I have pihole running in the background. I can access the web interface and do everything I could do on the rasp pi-hole, without the extra hardware. It does take a minute or two to start up in the background after logging in though.

Anyone here used Plume[0]? A friend of mine recently suggested it, and it sounds interesting but also... a bit scary. I suspect it has a centralized attack point (get into the Plume infrastructure, and you can probably automatically roll a virus out to all Plume routers in the world).

[0] https://www.plume.com/

I read their entire website and still have no idea what precisely Plume is or what they're selling.

"What makes Plume different from my traditional Wi-Fi router or extender?

Single router Wi-Fi systems can give you the speed you need as long as you’re close enough to the router. Wi-Fi extenders or repeaters can improve coverage, but are often complicated, unreliable, and degrade performance. Plume is a cloud coordinated Wi-Fi system that replaces your current router and gives you stable and consistent Wi-Fi coverage and speed in every room within your home using blazing fast tri-band SuperPods coupled with auto-channel hop technology."

If I understand this word salad correctly, it's a router which uses a cloud service to auto-configure itself.

More accurately a mesh router system which uses a cloud service to auto-configure itself.

Mmm. Love some word salad with mesh dressing.

In the end, it's just hardware with some online configurator which will most likely render the whole system unusable if the online service shuts down.

Great for anyone that doesn't stop to think for a minute how dumb this idea is.

Plume got a pretty icy reception here when they launched their subscription-based pricing model: https://news.ycombinator.com/item?id=17293078

If you really need a mesh (you probably don't), there are other solutions. If you know at least a little about home networking and WiFi, just setup a Unifi system and be done with it.

Let me first say that I am not a super network dude. I know enough to be dangerous.

The newer story @ Ars has some updated stats and thoughts: https://arstechnica.com/features/2018/06/exclusive-plumes-ne...

Part of the improvement is the hardware. The latency improvement is awesome, for example. But part of it seems to legitimately be the optimization that their software is doing re: signal strength, which backhaul to use, auto updates, the level of customer support, and other stuff.

I don't know how it compares, but it seems it may be better than people were initially thinking.

I thought that Linux is secure against viruses, because it has a sane security model, unlike Windows which is insecure no matter what.

All software is vulnerable to a lot of kind of attacks, especially when outdated.

Linux, the kernel, and NT, the kernel, are mostly secure. People manage to build insecure things on top of each.

Well, that's perhaps reductionist a bit too far to be a useful statement. There are other things outside the kernel that are important too, and design decisions that matter to user space.

Things like OLE can be said in retrospect wasn't a good idea security wise. Autorun kept delivering for more than a decade. Perhaps GDI could do with a security model. That sort of things makes it unnecessarily difficult to secure the system.

The reason we don't hear about Windows router botnets is because nobody bothers building those boxes in the first place. You put your Windows box behind a small Linux box in order to connect it to the Internet, not the other way around.

Quite a few are placed behind small BSD boxes rather than Linux. But yeah, internet facing Windows routers aren't exactly common. Certainly not without spending a good bit of time in group policy editor turning off almost everything.

Yep though there’s problems on the *nix side too, e.g. X11 does not have a great security model. But it’s also unlikely to be running on a router.

Both are probably perfectly secure, as long as you disable the FPU, speculative execution, SMT...

Processors themselves are insecure. There is no hope this war can be won.

The short answer is that Windows has had a “sane” security model since Vista.

The better answer is the enemy has changed.

In the past, security focused on multiple users of the same machine. Users should be safeguarded from each other. Applications are installed system wide by a knowledgeable sysadmin and can be trusted.

But this threat model was completely dated. Today, most machines have 1 user. But the applications are either cheaply written with no respect for other applications, or are actively harming the user by stealing his data, and the average user is his own sysadmin but really doesn't want to do the job or knows how. Additionally, DRM means the machine tries to defend itself from its owner, preferring multinationals instead.

The windows XP and standard unix security model defend against the old threat model. Android, iPhone and Vista + defend against the new model.

Reply on news.ycombinator.com