[SATLUG] OT: Router-related question

redpill toddwbucy at grandecom.net
Wed Feb 10 14:25:53 CST 2010


On Wed, 2010-02-10 at 12:04 -0600, Daniel J. Givens wrote: 
> On Feb 10, 2010, at 11:06 AM, redpill <toddwbucy at grandecom.net> wrote:
> 
> > In this case you wouldn't have to.  He said that the script would be  
> > run
> > from his wife's laptop.  One could assume that means via wifi. Crack  
> > the
> > wifi encryption (lets hope he's not using WEP) spoof the ip and your  
> > in.
> 
> That's a lot of work. Someone would have to really have a reason to go  
> to those measures and they probably could care less about a home  
> router. Is it all a possible scenario? Sure, but you have to look at  
> it framed with actual risk in mind. You could go crazy chasing down  
> every possible scenario, but that doesn't make sense unless you're  
> uber-paranoid. 
uber-paranoid...really? can you be too paranoid when it comes to your
personal information (financial or otherwise) in this day and age?  

Does the above scenario require a directed attack against a specific AP?
Yes, but given that it is now easier (and safer for the thief) to crack
your AP's encryption then it is for him to kick in your front door,
maybe we should all be a bit more paranoid.  In my view leaving the
gateway routers ssh port open, even if only internally and for specific
IP and MAC, is tantamount to leaving the front door key under the flower
pot on the front porch.  This is especially true if the WIFI AP is on
the very same router/firewall that the ssh port is open on, a very
common setup for home gateway routers.

but hey maybe I am only this paranoid cuz I happen to be studying for my
security+ exam.

regards
Todd



More information about the SATLUG mailing list