NSA Prefers Hacking Routers and Switches

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Why bother with PCs when you can go for the low hanging fruit instead?

The NSA runs a massive, full-time hacking operation targeting foreign systems, the latest leaks from Edward Snowden show. But unlike conventional cybercriminals, the agency is less interested in hacking PCs and Macs. Instead, America’s spooks have their eyes on the internet routers and switches that form the basic infrastructure of the net, and are largely overlooked as security vulnerabilities.
Click to expand...
 
Routers are powerful enough now that you can take one over and no one will feel the performance hit. Its the same stuff we all thought all along when we were putting DD-WRT on our routers to expand functionality. If we can do it, so can the NSA.
 
Yes, and this still works because people are idiots and companies still don't care.

Those of us that actually care about security are STILL complaining that HTTPS and S/MIME aren't default features that take work to disable. The two most common internet tasks, web and email, SHOULD be secure by default. Period. (Side note, [H] should really at least allow HTTPS...)

Hell even if we don't have user to user email encryption gaining any traction there should at LEAST be required TLS for any decent public SMTP server to protect all inbound messages in transport, but on my unscientific observations NONE of the big ones require it and hell most are just in the last couple years getting around to supporting it. At least GMail universally seems to be supporting TLS now http://www.brentrjones.com/2010/12/03/gmail-and-google-apps-tls-broken/... but what's the point if some MITM router can just modify the response in transit so that it downgrades to cleartext and no server cert chain is verified and nothing is encrypted (at least until DANE's TLSA DNS stuff is properly supported, which might be never at this rate) http://www.postfix.org/TLS_README.html#client_tls_may ...

Oh and DNSSEC NEEDS to be deployed everywhere years ago and technologies like OpenDNS's DNSCrypt need to gain some serious traction as well...

Can't we just roll out IPSec across the web while we're at it too? Gaining access to a router SHOULD by design be boring as all hell watching traffic, but that doesn't seem to be the case :(. Even if developers don't consider the NSA evil (I don't know why they don't, but clearly they don't by their actions) for sitting on routers (which we've ALL known for years), they should at least consider OTHER hackers (say China, blackhats, etc) evil and thus work to defend against it...

The worst part about all this crap is that NONE of it is new. We have the technology, just no one wants to put there foot down and force something and it's saddening.
 
This so explains why my router initiated an ARP poisoning attack on my connected devices.
 
Spire3660 said:
Routers are powerful enough now that you can take one over and no one will feel the performance hit. Its the same stuff we all thought all along when we were putting DD-WRT on our routers to expand functionality. If we can do it, so can the NSA.
Click to expand...

Umm, not those kind of routers and switches man. Think more like ISP level.
 
so you cannot talk openly about free of speech any more?

People now a day get in trouble for telling the truth. Freedom cant defend itself.
 
tazeat said:
Yes, and this still works because people are idiots and companies still don't care.

Those of us that actually care about security are STILL complaining that HTTPS and S/MIME aren't default features that take work to disable. The two most common internet tasks, web and email, SHOULD be secure by default. Period. (Side note, [H] should really at least allow HTTPS...)

Hell even if we don't have user to user email encryption gaining any traction there should at LEAST be required TLS for any decent public SMTP server to protect all inbound messages in transport, but on my unscientific observations NONE of the big ones require it and hell most are just in the last couple years getting around to supporting it. At least GMail universally seems to be supporting TLS now http://www.brentrjones.com/2010/12/03/gmail-and-google-apps-tls-broken/... but what's the point if some MITM router can just modify the response in transit so that it downgrades to cleartext and no server cert chain is verified and nothing is encrypted (at least until DANE's TLSA DNS stuff is properly supported, which might be never at this rate) http://www.postfix.org/TLS_README.html#client_tls_may ...

Oh and DNSSEC NEEDS to be deployed everywhere years ago and technologies like OpenDNS's DNSCrypt need to gain some serious traction as well...

Can't we just roll out IPSec across the web while we're at it too? Gaining access to a router SHOULD by design be boring as all hell watching traffic, but that doesn't seem to be the case :(. Even if developers don't consider the NSA evil (I don't know why they don't, but clearly they don't by their actions) for sitting on routers (which we've ALL known for years), they should at least consider OTHER hackers (say China, blackhats, etc) evil and thus work to defend against it...

The worst part about all this crap is that NONE of it is new. We have the technology, just no one wants to put there foot down and force something and it's saddening.
Click to expand...

Totally with you on this one. If developers take action there is no reason we cannot secure our infrastructure a little bit from. It make really sick to listen to other peoples private conversation and data. Really Sick.
 
Great. I'm assuming we can add Cisco and a few others to the list of companies cooperating with the NSA.
 
Why hack XXXX computers when you can simply hack the router they are using to communicate on...I thought it was obvious they had been do this for quite sometime.
 
We have the technology, just no one wants to put there foot down and force something and it's saddening.
Click to expand...

Actually there is a glimmer of hope so to speak but it's less of a "put there foot down" and more of a "I'll give you that if you agree to do this".

Just last week or so, there was an article about the Gov. suggesting they "insure" companies against civil legal action for damages if they get hacked/etc if those companies conform to Federal IA Compliance Standards.

I am not completely in favor because I think it will have an inverse effect on getting companies to correct vulnerabilities in their software. In other words, by the Government rules on IA Compliance, if a scan picks up on a vulnerability but the vendor responsible hasn't fixed it yet, then the vulnerability is noted but the system is deemed compliant. So there is still a big hole and there is no pressure on the vendor to fix it because everyone is currently protected from legal reprisal.

Where is the stick that goes with the carrot?
 
Im thinking this will only accelerate the transition to open networking hardware (think Open Compute Project, BigSwitch, etc), white-box hardware with open source operating systems. This is the only way to truly keep them out of the networks, and frankly I am surprised that foreign entities have not jumped on this stuff hard care for this very reason.
 
Im thinking this will only accelerate the transition to open networking hardware (think Open Compute Project, BigSwitch, etc), white-box hardware with open source operating systems. This is the only way to truly keep them out of the networks, and frankly I am surprised that foreign entities have not jumped on this stuff hard care for this very reason.
Click to expand...

You can't keep them out cause you can't buy them off. The pockets are too deep, the incentives too great, and that's if they do it in a quiet but official way. They always have the backup, pay off the right stooge.
 
lcpiper said:
You can't keep them out cause you can't buy them off. The pockets are too deep, the incentives too great, and that's if they do it in a quiet but official way. They always have the backup, pay off the right stooge.
Click to expand...

They would just buy off the isp further up the chain...or hack it:)
 
Ponder said:
They would just buy off the isp further up the chain...or hack it:)
Click to expand...

Someone, somewhere will always be running that insecure hop. Once the packet goes out who can guarantee where it goes or how it comes back. End-to-end encryption is the only way.
 
You must log in or register to reply here.
Back
Top