7 ms·

Lesson: Put a password on your router.

by joecode 16y ago

CytokineStorm 16y ago
Or even better, change the default IP address for the admin login. This attack relies on a bunch of hidden iframes loading IPs that are common default addresses of the admin login page.
- nkassis 16y ago
  Let's assume the users is on 192.168.50.0/24 can his attack figure that out?
  - woodall 16y ago
    The attack/code he showed cannot, but what you can do it write different iframes. Here is an example: a+'.'+b+'.'+c+'.'+d where a=192 b=168 c=0-255 b=0-255 Of course this could be any private network address range[1]. Next you would use document.write or .innertext to make these iframes. Personally I wouldn't stop at the first one. I would log all the frames that loaded into an array and from there test them further. I would also get the users IP address and tack on :80, :8080, :21, ect and see what I am presented with- web torrent frontends, ftp servers, ect. [1] http://en.wikipedia.org/wiki/Private_network http://en.wikipedia.org/wiki/Private_network
    - bnchdrff 16y ago
      This will take forever, and also make the user's browser unresponsive. for(var c=0;i<255;i++) { for (var d=0;j<255;j++) { document.write('<iframe height="1" width="1" src="http://192.168 http://192.168. + c + '.' + d + '" id="' + i + '.' + j + '" name="' + c + '.' + d + '"></iframe>'); } } <iframe> portscans, wow. For a massively-deployed hack like Samy's, it makes plenty of sense to just check the small handful of major-brand wifi routers.
      - woodall 16y ago
        I totally agree. You should only be checking for routers that have known vulnerabilities, but was not the initial question.
  - deleted 16y ago
    [deleted]
- marcinw 16y ago
  How's that better? That's like changing the port SSH listens on to 2222 even though root's password is "root".
  - carussell 16y ago
    Twice I've had routers notify me that 192.168.0.1 is in use by another network service and automatically remap its own services to 10.0.0.x. One of these times was due to a DSL modem's web administration being on 192.168.0.1.
- deleted 16y ago
  [deleted]
sounddust 16y ago
That doesn't necessarily solve the problem. The attack needs to login to some routers to extract the MAC address, but others provide it willingly without login (I believe DD-WRT does this on the default logged-out status page, for example, although I can't check at the moment).

Lesson: Put a password on your router.

by joecode 16y ago

Lesson: Put a password on your router.

Or even better, change the default IP address for the admin login. This attack relies on a bunch of hidden iframes loading IPs that are common default addresses of the admin login page.

nkassis 16y ago
Let's assume the users is on 192.168.50.0/24 can his attack figure that out?
- woodall 16y ago
  The attack/code he showed cannot, but what you can do it write different iframes. Here is an example: a+'.'+b+'.'+c+'.'+d where a=192 b=168 c=0-255 b=0-255 Of course this could be any private network address range[1]. Next you would use document.write or .innertext to make these iframes. Personally I wouldn't stop at the first one. I would log all the frames that loaded into an array and from there test them further. I would also get the users IP address and tack on :80, :8080, :21, ect and see what I am presented with- web torrent frontends, ftp servers, ect. [1] http://en.wikipedia.org/wiki/Private_network http://en.wikipedia.org/wiki/Private_network
  - bnchdrff 16y ago
    This will take forever, and also make the user's browser unresponsive. for(var c=0;i<255;i++) { for (var d=0;j<255;j++) { document.write('<iframe height="1" width="1" src="http://192.168 http://192.168. + c + '.' + d + '" id="' + i + '.' + j + '" name="' + c + '.' + d + '"></iframe>'); } } <iframe> portscans, wow. For a massively-deployed hack like Samy's, it makes plenty of sense to just check the small handful of major-brand wifi routers.
    - woodall 16y ago
      I totally agree. You should only be checking for routers that have known vulnerabilities, but was not the initial question.
- deleted 16y ago
  [deleted]
marcinw 16y ago
How's that better? That's like changing the port SSH listens on to 2222 even though root's password is "root".
- carussell 16y ago
  Twice I've had routers notify me that 192.168.0.1 is in use by another network service and automatically remap its own services to 10.0.0.x. One of these times was due to a DSL modem's web administration being on 192.168.0.1.
deleted 16y ago
[deleted]

sounddust 16y ago

That doesn't necessarily solve the problem. The attack needs to login to some routers to extract the MAC address, but others provide it willingly without login (I believe DD-WRT does this on the default logged-out status page, for example, although I can't check at the moment).