openwrt-Smart Router hack technology (2)---"Network information monitoring and stealing"

openwrt-Smart Router hack technology (2)---"Network information monitoring and stealing" 1 guide

PS: Previously written an article, now found that the structure of the content is not too good, resulting in poor reading experience, the impact of communication and SEO, so now tidy up and split up, from the beginning to write,

This series introduces two hack technologies for smart routers for everyone to have a look at.

This paper mainly introduces the data monitoring function of openwrt-intelligent router. (in order to maintain the independence of this article, the content will be duplicated).

Previous article: openwrt-Smart Router hack technology (1)---"DNS hijacking"

2 Overview and preparation

According to the Baidu Encyclopedia introduction: OPENWRT can be described as an embedded Linux distribution, (mainstream router firmware has dd-wrt,tomato,openwrt three categories) instead of trying to build a single, static system. OPENWRT Package Management provides a fully writable file system from the application provider to the selection and configuration, and allows you to customize the device to suit any application.

Before you start the experiment, do some preparatory work:

1. A business smart router hardware device that supports OPENWRT
2. Brush the commercial equipment into a openwrt system (replace the original factory-ordered system)

Note

This article is a Xiaomi Route mini purchased on Xiaomi's official website, and then based on the tutorial openwrt Custom-made Pandorabox

After the success of the brush, it can be remotely routed through the PC, just like a common Linux server remote, after Telnet, the router terminal interface prompts as follows:

Basic file operations, network operations and other commands are similar to regular Linux. At the same time OpenWrt can also install the application software through the software warehouse, see OPENWRT package Management in detail [1].

For example, install the nginx application:

Opkg Install Nginx

The basic knowledge of OpenWrt is briefly introduced, and some comprehensive applications are started later.

[1]	OpenWrt Package Management

3 Information Monitoring

In addition to the network configuration function, the intelligent router also has the function of network data forwarding. Since OpenWrt is Linux-based, it has a good tcpdumpapplication, and with Wireshark visualization tools, it can achieve the ability to monitor all data through this route.

The use of tcpdump and Wireshark , is not the focus of this article, so do not expand, the default reader has a certain basic knowledge of this.

The following example is an experiment that enables a remote machine to monitor all data that passes through a router through a visual tool Wireshark .

3.1 Principles and methods

The basic network structure diagram is as follows:

The main operating principles are:

1. Connect the Internet device to the router

2. Use tcpdump on the router for data capture of the NIC

   As of this, monitoring requirements have been met, but not intuitive enough to require some visual tools, such as Wireshark

3. Run Wireshark on a Linux desktop system within the same network to import tcpdump data on the router

   Remotely execute the tcpdump command via SSH, enter data into desktop, and then act as an input data source for Wireshark

Execute the following commands inside the desktop terminal:

SSH [email protected] "Tcpdump-s 0-u-n-w-I br-lan not port 22" | Wireshark-k-I.-

then enter the corresponding account password can be monitored.

The above command line has the following instructions:

• According to the OpenWrt document, all local area network data is finally forwarded through the Br-lan virtual network card, so the network card can be monitored
• The essence of this command is to remotely perform network monitoring commands on the router and enter text into the Wireshark of the machine.
• Use Wireshark as a visualizer to view

3.2 Tools Tips

The basic principles and operating methods are described earlier, but the disadvantage is that each time you need to enter a long string of command lines and passwords, you can use some of the small operating skills of Linux, simplify the process, make a command tool, convenient to call at any time.

Basic principle:

• Use the sshpass tool to make a name password entry
• Use alias aliases to make command statements

Automatic Login Statement implementation:

Sshpass-p ' Route-pass-world ' ssh-o stricthostkeychecking=no [email protected] ' tcpdump-s 0-u-n-w-i br-lan not por T 22 ' | Wireshark-k-I.-

To edit the ~/.bash_alias file, customize the alias of the command line:

Alias zshark= "Sshpass-p ' Route-pass-world '  ssh-o stricthostkeychecking=no [email protected] ' tcpdump-s 0-u-n-w- -I br-lan not port 22 ' | Wireshark-k-I.-"

You just need to enter Zshark in the shell to complete the command launch.

3.3 Results Display and application

Then start the Grab Kit tool, connect the router with the Xiaomi 4 phone, and open the UC browser to access www.baidu.com :

Click to enter and access to the webpage:

Grab the package as follows:

You can already see the corresponding network IO access content for the device.

This feature can be used to monitor and analyze network data on some platforms without packet capture applications. Example: Analyze the network traffic on the phone.

At the time of software development, the cache tends to cause some false illusion, which is very easy to influence the analysis and judgment in the process of software debugging. For example, in the process of network environment migration, different devices have different DNS or static file caching mechanism, especially the mobile phone terminal browser has some cloud acceleration features, these features have changed the previous understanding of the network request process, if you do not understand the impact, Applications tend to present some confusing or misleading phenomena. Therefore, it is necessary to use the Network monitoring tool to confirm that the network environment of the device is properly migrated, in order to ensure that some of the phenomena seen by the developers are credible.

For example: UC and QQ Mobile browser has the cloud acceleration function, but at least in the settings can be closed, but the built-in browser actually has this function, and there is no place to set off, which is easy to understand in the Web development debugging process is confusing or misunderstanding.

3.4 Network Security Random Thoughts

In the previous content has been described how to grab the package, apparently already on the PC to see the access information on the phone:

• Non-sensitive information

  • Phone model
  • Operating system
  • Browser identity
  • Access page content and time

• Sensitive information

  • In the case of the HTTP protocol, the contents of the form submitted by the page will be read in plain text.

For non-sensitive information, in fact, some time is also more sensitive, this is a violation of privacy, after all, no one wants their network behavior habits by others prying.

For example, Wireshark can count access records for a device:

This is just the experiment a short time to visit the baidu.com, if the network export monitoring for a long time, then it is easy according to the browser's content category, the device holder's preferences and characteristics can be analyzed sorta. For example, the discovery of a large number of women's clothing shopping links can be identified as a young woman, if found a large number of scientific papers search pages, can be identified as scientific researchers.

With some more data, you'll be analyzing more of the content. For example, you take a mobile phone secretly in search engine to find the treatment of leukemia , very careful you think others do not know, but in fact, others know everything, you want to know more through search engines, you will search for more input, and then the resulting network behavior, the more people will know more.

Of course, fortunately, the country's largest search engine Baidu , probably in 2015 finally used the HTTPS Search service, before this is a non-encrypted HTTP protocol. Other search engines, such as Sogou , are still using the non-encrypted HTTP protocol so far.

For sensitive information, such as logins and passwords, if they are transmitted under the HTTP protocol, the content can be caught directly on the router and seen. This part of the content of the impact can be very small.

So the security summary is as follows:

• Non-sensitive information is being spied on

  Generate statistical value, exposing personal characteristics and preferences, etc. privacy

• Sensitive information is being spied on

  Directly involved in the account password, the result may be very serious

Attention

The HTTPS protocol transmits encrypted content, even if the router catches the packet and does not see the plaintext. The sensitive data transfer parts of large internet companies are basically HTTPS -based, but many small and medium-sized Internet companies still do not notice this and still use unencrypted http protocols. Like the user name password when these things are transmitted on the router, the capture can see clear text.

4 Public WiFi Security Alert

After the following method is elaborated, should be able to arouse some users to public WiFi security awareness of the attention bar. If the other side is the administrator of the router, and then the end user connects the device to the router (being fished), then:

• DNS Hijacking

  Originally, the user visited a site, but was directed to a well-disguised malicious B site, then the user's login password and other sensitive information and even bank information can be intercepted

• Communication data is monitored

  • The network address that the user accesses is learned (the user's habits are controlled)
  • HTTP request data content will be intercepted in plaintext

Of course, there is a clear source of WiFi or can be trusted attitude (after all, the major businesses now have free WiFi, not unworthy), but unknown WiFi try not to easily connect, otherwise there will be unpredictable risks.

5 Final Summary

The above introduction of the two types of smart router, the original intention or hope that we can try to use it in the right way, for production, to enhance the productivity of the software it. Do not use it indiscriminately.

Author:	Harmo ha mo
Author Introduction:	Https://zhengwh.github.io
Technical Blog:	Http://www.cnblogs.com/beer
Email:	[Email protected]
Qq:	1295351490
Time:	2015-10
Copyright Notice:	Welcome to learn to exchange for the purpose of the reader to reprint, but please "annotated source"
Support this article:	If you are inspired by the article, you can click the button in the lower right corner of the blog to "recommend"

openwrt-Smart Router hack technology (2)---"Network information monitoring and stealing"