Hacker News

points by rekoil 1 day ago | 0 comments

It's pretty easy to compromise things like McDonalds or Starbucks WiFi hotspots though, just setup a Pineapple with the right SSIDs and a 5G modem, funnel your target domains through your mitmproxy via the DHCP DNS server you're providing, and that's basically it.

I agree it's not PHP2Shell, but its certainly not being "way overblown" here.

[–] 1718627440 1 day ago

Why would these public network would allow guest hosts to communicate with each other?

[–] HiJon89 1 day ago

I think they're saying you create your own malicious wifi network and people will unintentionally connect to it. This network specifies your malicious DNS server via DHCP, and everything looks secure to the client. I think the main issue with this in practice is that all the major browsers have been updated to not trust these certs.

[–] rekoil 1 day ago

So you target some host like ssh.dev.azure.com, find all the hooks in the proper repo the client is trying to access, make a new commit that puts your persistence payload in one of them that you expect will be executed soon, this script can additionally "correct" the git state when it finally runs, and moves its persistence to some more appropriate location.

Users will be none-the-wiser because they're not accessing these hosts through a web browser, and you net a few more compromised hosts in your inventory.

[–] commandersaki 1 day ago

Yeah also got to be lucky that the users are using https and not ssh. You're very limited in what you can mitm, you'll be trivially detected by patched devices (though maybe not acted on because nobody is the wiser), but then you'll need to serve objects with common/conflicting hashes -- fixing up that state synchronisation (what you call "correct") to then do nefarious things is not trivial at all. Extremely difficult to pull off successfully for git anyways or to do it in stealth.

[–] rekoil 1 day ago

Ahhh, true, SSH isn't the same certs, my bad... well, both Github and Azure DevOps default to HTTPS-based cloning anyway...

[–] ctippett 1 day ago

They wouldn't. A device like the Pineapple broadcasts its own copycat wireless signal and tricks unsuspecting clients to connect to it thinking it's the real one.

Edit: Holy moly we all jumped on this comment at the same time didn't we.

[–] jfyi 1 day ago

> Holy moly we all jumped on this comment at the same time didn't we.

It's good to see push back against this narrative that is trying to develop that this isn't any kind of big deal.

This has been every machine on the internet compromised for at least 12 hours and probably some that are not going to ever get patched.

[–] rekoil 1 day ago

> probably some that are not going to ever get patched

This is a HUGE deal for embedded devices, we can now mitm HTTPS traffic on lots of embedded devices running Linux produced between 2018 and now.

[–] jon-wood 1 day ago

They don't need to, a Pineapple (or anything else that can run a wireless access point, you could do this with a laptop) just needs to advertise the expected SSID and do so with a stronger signal than the official ones for people's devices to connect to it instead of the actual network.

[–] jrmg 1 day ago

It’s extremely common to see other Macs pop up in the ‘network’ panel in Finder in the independent coffee shops around me. I imagine they’re just signing up for a business plan and using the routers the ISP gives them with a custom SSID and password.

[–] SXX 1 day ago

You dont interact with anyone. You just set your own hotspot and people will connect to it.