Big Brother gets some new toys

nightrace · Mar 22, 2011

Developed by Edith Cowan University academic and researcher Patryk Szewczyk, the Broadband Router Evidence Acquisition Kit, or BREAK, is able to acquire configuration data and static information from ADSL routers.

In a separate project, ECU academic and researcher Peter Hannay has developed software that uses the location data of individuals from websites such as Facebook, Twitter or Flickr, to determine their location information. This allows the data to establish where people are at specific times of the day as well as create long-term behavioural data.
Click to expand...

http://www.theaustralian.com.au/aus...e-in-legal-cases/story-e6frgakx-1226025587340

caspian · Mar 22, 2011

I would assume that if you are using a VPN and have geolocation disabled in Firefox their approach would be ineffective.

I no more · Mar 22, 2011

caspian said:

I would assume that if you are using a VPN and have geolocation disabled in Firefox their approach would be ineffective.
Click to expand...

What does this thing even do?

I really don't know what kind of earth-shattering information can be pulled from a router.

Searching_ _ _ · Mar 22, 2011

However, the threats presented hereafter show that a simple and effortless method may disrupt or terminate an entire network connection to the rest of the world (Chang 2002). Denial of service attack A Denial of Service (DoS) attack targets routers in a ‘reflector’ or ‘direct’ mode and may halt the connection between the router and the Internet Service Provider (ISP). Most recently ADSL routers are predominately becoming victim to ‘reflector’ based attacks. The attacker transmits numerous synchronisation requests to router ‘A’ with a preset static source IP address of the soon to be compromised, router ‘B’. Router ‘A’ responds to these numerous requests and sends the numerous acknowledgement packets to router ‘B’. Eventually two routers have had their resources consumed as the SYN and ACK packets are constantly transmitted. Alternatively ‘direct’ attacks also consume the router’s resources by flooding it with numerous Transmission Control Protocol (TCP), Internet Control Message Protocol (ICMP), or User Datagram Packets (UDP) sent directly from the attacker. In this instance, the source IP address is spoofed each time hence leaving half open connections on the targeted router. Due to the resource limitations of the router the device may halt and hence require a power-cycle reboot (Chang 2002).
...
Research has shown (Stamm et al. 2006) that this security technique can be compromised when an unsuspecting individual accesses a webpage and permits a malicious Java Applet to load. Once the malware is loaded onto a workstation, it begins to ping the other hosts on the subnet in an attempt to discover the location of the gateway/router. After a number of attempts the malware should discover the gateway by detecting which IP address is hosting a web configuration management system. Specific images used in the web configuration management system are unique to each router and hence the make and model of the router may be detected by the type of images retrieved from the default gateway. Once the router type is known, the malware may manipulate configuration settings, alters DNS addresses, enables port forwarding and remote management to a specific IP address, and disables Network Address Translation (NAT) (Stamm et al. 2006).
...
Routers are similar in computational power to the computer of the mid 1990’s. Hence, BotMasters are able to abuse the processor cycle and memory resources of both a workstation and a router to undertake a range of tasks including, cracking complex password or encryption schemes. DNS hacking The Domain Name Server (DNS) is a dynamic address in most instances is allocated ISP to the router. However, the DNS may be easily changed manually by a non-technical individual through the router’s web management interface. A compromised ADSL router, configured with a malicious DNS may have all of its traffic forwarded to a bogus DNS server (Heron 2007).
...
Collectively an ADSL router is an embedded system compromising of a processor, memory and embedded software. A single programming error may cause numerous faults to consumers. Acre (2003) discusses that the research department at Core Security Technologies discovered a stack and heap buffer overflow error within many embedded systems. More specifically this error targets routers and may allow an attacker to bypass all authentication techniques thus acquiring effortless access to the router.
...
Tsow (2006) argues that the reason embedded systems and more specifically embedded software are being targeted within routers is that virus and malware detectors are unable to scan embedded software. More specifically the firmware can be compiled with a static malicious DNS server address. The newly compiled malicious firmware may be uploaded to the router prior to sale. Unless a forensic examination is made, scanning the router’s operating system for malicious code or processor activity in not available. Numerous router firmware images are open-source, permitting an attacker to experiment with the software to discover flaws and weaknesses prior to launching an attack (Tsow 2006). Unlike a computer with a new operating system upgrade from Windows XP to Windows Vista, a highly skilled hacker changing the firmware on a router without authorisation should see no difference to the consumer (Tsow 2006).
Click to expand...

http://www.slideshare.net/techdude/adsl-router-forensics-part-1-an-introduction-to-a-new-source

I tried to locate a PDF or White paper on BREAK but no luck yet.
Would be nice to see what it can do.

Log in or Sign up

Big Brother gets some new toys

nightrace Registered Member

caspian Registered Member

I no more Registered Member

Searching_ _ _ Registered Member

Log in or Sign up

Big Brother gets some new toys

nightrace Registered Member

caspian Registered Member

I no more Registered Member

Searching_ _ _ Registered Member

Useful Searches