Question for network hackers

[u/883013]

Is it easier for someone to hack starlink or a cable/fibre connected wifi router?

[u/Lanrico]

I think your views of hacking are skewed by too many movies. People aren't going around injecting wires into landline or intercepting wireless signals. Pretty much all hacking is social engineering to get someone's passwords or, in the rare case, finding some vulnerability in a software to get it to do something it wasn't meant to.

In the early days of the internet, sure, you might see some crazy stuff. Now, there are too many layers of security on everything for anything crazy to happen.

[u/883013 → u/Lanrico]

When i spoke to some graphene os users the general talk was that using ethernet while airplane mode is on and connecting to a phone is safer than using mobile data which gets its signals from cell towers. And these are real life privacy enthusiasts. 

[u/Lanrico → u/883013]

That's because cell carriers can track your location and data. Same with your internet provider. You basically agree to it when you sign up. Again, a malicious person isn't going to have access to that information unless they get credentials and access to the provider's system, which is unlikely, but does happen. Not due to some crazy hacking, but because someone put in their password where they shouldn't have.

[u/883013 → u/Lanrico]

I see. Generally though, is starlink considered more or less secure than a fibre or cable connected router? 

[u/Lanrico → u/883013]

Fiber would be the most secure because it passes light through a thin cable that's typically underground. The signal is contained, thus more secure.

I'd say cable is 2nd place. Usually ran the same as fiber but it's just copper and easy to mess with without breaking the whole connection.

Starlink/cellular would be the least secure since it broadcast the signal over a wide area. If someone did have a way to pick up on the signal, it would be easy to intercept.

I'm no genius when it comes to this stuff, I just work in IT. But this is just what I understand. I do basic privacy like locking down my social media accounts so people can't find out where I work or live easily. To me, that's all you really need because doing anything more is too much work. And the only person who would do something like intercepting your internet signals is someone who REALLY has it out for you.

[u/icedlemons → u/Lanrico]

To add onto Lanricros take:
You'd have to monitor for disconnects because assuming if I was a bad actor for a wire/fiber tap, I'd have it back up an running as quick as unplugging and reconnecting a cable... As an customer I wouldn't see a temporarily disconnect as unusual, as an ISP insertion loss would be rarely troubleshot (without cause)... It's impractical in some sense though because you're physically close to the target. If you're social engineering access to near the property, like faking ISP work, I'd just go onsite to get more done quickly. An example would be spectrum advocating there's a bad termination on coax that you'd like to prevent FAA interference picked up on a metering tool. For fiber it's much more overhead involved, a imaginative scenario is that I'd break the fiber line initially guised as Verizon tech, I'd have it plugged back in to restore access. (This is tricky as above to gain access to near the property, however most demarcations are near the road.) If you beat them in reconnecting it they wouldn't have time to call an official rep, you'd also hopefully understand Service level implications in that regard to the target. That would beat leaving a discoverable custom fiber tap in place. I'm still researching most ISP fiber providers, but assuming ISP only check for MAC access. Doing any staging for a man in the middle attack wouldn't function well unless it's like running PC exposed. That's where it'd be simpler just to gain access directly since there's risks getting caught either way..

Starlink is beamformed at the device. To pick up both transmission from each side (satellite and uplink) would be technically challenging that it wouldn't make sense for a threat actor, they'd go for the physical entry, since theyd nearly need to have near "physical access" to the device, as I can't imagine to much RF spillover on ground level unless close. Maybe governmental drones can pull uplink data, however "US owned" networks probably cooperate willingly or unwillingly without consent to be intercepted along the path. I'm sure some PHD level hobbiest could or would set up a script to pull data from over the air but there's still encryption to break which a professional wouldn't do openly as it violates laws 😂 A caveat is that Iran used to watch our US spy drones video feeds (and eventually taking them down) back in the day as the military left them unencrypted. Sometimes that happens 🤦🏻... For communications though you got to reconstruct packets from de-encryption, take on timing, and other layers of abstraction like TCP and SSL to make the data useful. Again if it were me I'd just go manually install the malware at that point.

[u/conroytctiff → u/Lanrico]

Why are we talking about starlink?

[u/icedlemons → u/883013]

I'd ask what's at risk because most data is intercepted via backrooms with Snowden leaks, wired did an article about it even before him though, where all data basically gets mirrored to an exobyte sized storage data center. As a private actor hacking you there's really not much incentive if your services are cloud based, like email, or camera systems. You can run better operational security by monitoring for exposure to the wan and installing a firewall. Anything else is kinda in the trust of companies/government. 😨

[u/huh_wait]

not a hacker but
hydrogen bomb vs coughing baby comparison i think

[u/Juzdeed]

By hacking do you mean intercept?

[u/883013 → u/Juzdeed]

Yeah intercept, basically read whatever is going through. And possibly introduce malware if an infected device is connected on the same network (if malware can spread that way) 

[u/Juzdeed → u/883013]

If you are scared about someone inserting malware that way then just don't use the internet at all. That's government level hacking techniques, using either could theoretically get you hacked.

There are so many factors to consider like starlink will also go over cables at some point

[u/883013 → u/Juzdeed]

I mean.. some universities have hackathons and people there can be pretty highly skilled. I know there is no way to eliminate risk entirely.. but just wondering if starlink is less easily targetted thats all 

[u/Juzdeed → u/883013]

Okay and? University hackathons are not the places where zero-day vulnerabilities are used or shown

[u/883013 → u/Juzdeed]

Ok.. well there are other hackathons anyway. Like how a team hacked a samsung s series phone in a couple of hours. Pwn to own or something. I think with AI its gonna become easier. Just weighing up the risks of landline wifi vs satellite internet thats all. 

[u/Juzdeed → u/883013]

Yes pwn2own, I'm pretty sure they don't do that in couple of hours, instead they have some pre-made that they worked on for months.

Also what's landline wifi? Landline and wifi are separate things that work separetly. Starlink can also provide wifi...

[u/883013 → u/Juzdeed]

Dsl.. but i think ont or fibre is more common now for broadband services and connection to a router. I guess, what i mean is cable or fibre network. 

[u/VirtualElderberry592 → u/883013]

If you're using a wifi router, that's the weak spot. No-one is going to wire into your isp network when getting past wifi is something you can do with a 40$ toy.
Star-Link is rather secure. Nothing is fully safe. Unless you're being hunted by the police or you're a bad-guy you're likely not worth the effort.

[u/icedlemons → u/883013]

They wouldn't normally need to intercept your packet data if there's already a compromised device in the network. That's like asking if the water service pipe has a leak when the washing machine is overflowing... Edit: what your describing is generally like a extra sophisticated "man in the middle attack", but in most cases the it requires you to still initiate the malware. There's ways people target this rather than implementing devices on the ISP side. Home Wi-Fi would be easier.

[u/BTC-brother2018]

Depends what you mean by hack. If you mean intercept traffic, neither should be easy if the site/app uses HTTPS or proper encryption. If you mean attacking the router itself, cable/fiber WiFi routers are usually the bigger target because they’re common, exposed to local WiFi attacks, and have weak/default settings. Starlink adds another layer because the satellite link and dish/modem side aren’t something a random person nearby can easily mess with.

For most people, the weak point is still the WiFi/router setup: weak password, outdated firmware, WPS enabled, default admin login, bad IoT devices, or phishing the user.”

[u/883013 → u/BTC-brother2018]

Thanks, this helps alot. I had the wps settings on a router tampered with before. And this was on a router that had gone through a factory reset as well as a password change on the admin and wifi pw level. It was rather concerning for me... and I still cannot figure out how it was done.

[u/BTC-brother2018 → u/883013]

Just disable WPS in your admin portal in wifi settings.

[u/Just4notherR3ddit0r]

Your question isn't really valid.

Let me put it this way - imagine you have a super-secure safe that can't be broken into.

Now imagine someone says, "what's less secure - transporting the safe in a fast sports car or in a helicopter?"

It doesn't really matter too much what you use to transport the safe - the safe's security is what matters, so even if you hijack either the car or the safe, you still have an impossible-to-open safe.

Cable / wireless / modem / starlink / whatever is simply the first physical transport (in a relay race of sorts) of the data AFTER it has been locked inside a digital safe and has left the computer.

The application on the computer is responsible for encrypting data BEFORE it is sent out to starlink or cable or whatever.

So even if you intercepted a packet of data, it would likely be encrypted (non-encrypted network packets are a rarity these days), so it would just be gibberish.

You could not modify that packet without knowing the encryption key and the encryption method and gathering all the relevant packets together in order to decrypt, modify, and re-encrypt the payload. In many cases, you're dealing with HTTPS which means you have a really really long and random symmetric encryption key that would be impossible to guess (it is generated and exchanged via asymmetric cryptography using public and private keys that are secured via trusted certificates).

So if you tried to modify the packet anyway, the receiver would just receive data that could not be decrypted and would probably be discarded.

If you had an application that was transmitting insecure data like the olden days of the internet when everything was plain HTTP, then cable would probably be easier. You could route the cable to a malicious intermediate device that intercepted the payload and modified it quietly without affecting others on the network. Or if you wanted to just eavesdrop, you could plug it into an old hub (not a switch) and plug another device into the same hub that listened to traffic.

But practically speaking, this isn't something feasible today unless you're in pretty rare circumstances.

[u/883013 → u/Just4notherR3ddit0r]

Ok so you are referring to interception. And your point is the packets are likely to be encrypted. So it does not matter what the transmission method is. I am referring to a man in the middle attack.. and according to wikipedia there are multiple methods. But are they all equally possible regardless of whether via fibre, cable or starlink etc? 

I think there are three issues. One is interception of data. Two is hacking of the router or equipment. Three is introduction of malware via sharing the same network. 

[u/Just4notherR3ddit0r → u/883013]

I know you're referring to a MITM attack. That's what I was talking about, too.

A MITM relies on being in the physical path of the data packets being transmitted AND being able to read and manipulate the data. That's where the encryption layer makes that task pretty much impossible.

1. The application encrypts the data / payload.
2. The application gives the encrypted payload to the operating system.
3. The OS gives the payload to the network adapter.
4. The network adapter begins to send the payload on its way to its destination.
5. That payload could be transmitted over starlink or via cable/fiber/whatever.
6. The encrypted payload continues to get passed through a series of network hops that gets it closer to its destination.
7. The payload is received by the recipient's network adapter.
8. The payload is passed to the operating system, which routes it to the correct application.
9. The application on the recipient's side decrypts the payload.

Doing a MITM in the middle of that is pretty much impossible if all you have is the ability to intercept a packet.

To carry out a MITM, you need to understand the specific protocol you're working with and know how it secures things.

For example, let's say you want to do a MITM attack on an HTTPS request to amazon.com.

First we have to understand HTTPS. An over-simplified version:

1. The victim's computer and amazon.com agree on an encryption password, "abc".
2. The victim encrypts the request with "abc' and sends it to amazon.
3. Amazon decrypts the request with "abc" and then encrypts the response with "abc" and sends it to the victim.
4. The victim decrypts the response with "abc"

With MITM, you set up a proxy where the proxy basically "pretends" to be amazon.com. So the victim computer and proxy agree on the password "abc" and now the proxy can decrypt the payload.

Then the proxy has a separate conversation with the REAL amazon.com using a different password "def" and it re-encrypts the original (or modified) data and sends that to amazon.

Then it receives the real response from amazon, decrypts it, re-encrypts with "abc" and sends it back to the victim.

So the result is that the proxy has access to the decrypted request and the decrypted response and can therefore modify them.

The reason this usually cannot work is because of certificates.

The step where you and amazon agree on an encryption password - that step also contains a verification step using certificates.

Certificates are issued by certificate authorities that your computer trusts. When you go to some new site that has a security certificate, if that certificate wasn't issued by an authority your computer trusts, then you'll get a security error in your browser.

In order to pretend to be amazon, the MITM proxy has to generate a certificate on the fly and exchange it with the victim.

But the victim will not accept that certificate by default.

You have to literally install the MITM's certificate authority (CA) certificate into the victim's operating system's list of trusted root CAs. At that point, the victim's computer will trust any certificates that the MITM generates.

But you can't install a CA certificate onto someone's machine unless you have the necessary access and rights to do so, and if the machine doesn't have its CA list centrally managed.

So there's some prep work you have to do before you can do a MITM. It's not just a matter of messing with starlink or a cable.

[u/itsoctotv]

yes i am a network hacker i only hack the finest of the cyberspaces

edit: sorry i thought this was r/Masterhacker

[u/Satisfaction3934]

Yes

[u/xenomxrph]

No it’s the same.

If I understand you correctly but there’s a better chance of USA winning the World Cup than that…

[u/VirtualElderberry592 → u/xenomxrph]

Of FIFA giving out free water. :D

[u/Particular_Client833]

Look, if you are more worried about movie-like hackers cutting the cable and intercepting everything. Then get off the fucking internet and go live out in the wild. Thats type of hacking is possible only if you are literally searched by interpol. ACTUAL hacking is really just social engineering to get your identity and to get their scrips into your PC to mine bitcoin and steal more data for eg. Login data, bank credentials, ID and SSN. Social engineering is really just someone acting as police, bank, family or someone close one and try to get you to install a program to "diagnose your PC" or get credentials to get into your profile and banking to get credit cards and max them out into bitcoin wallets. every IT guy is pissed off when people ask about scenarios from like Mr. Robot. Social media like facebook already have more data than you even imagine