4

I went to my parent's house for Easter and my cousin asked me about why he started getting certificate errors on his iPhone. I didn't think much of it until I went to show my family an Android application I've been working on and suddenly ran into similar issues.

security warning

Some background:

The application is using Auth0 to handle OAuth login and I'm using my Google account to login. When attempting to login, I get the warning above with the error:

There are problems with the security certificates for this site.

When I clicked View Certificate, I get the following for itunes.apple.com:

Security certificate

And when I click View Page Info, you can see the page is definitely accounts.google.com:

Page Info

When I run the application, not on their WiFi, it works fine (no certificate errors) and verified my cousin stopped getting the certifcate errors as well.

What is going on here? Any ideas on how to troubleshoot this further? Their router is an old Linksys WRT160N which hasn't had firmware updates since 2009 so maybe it got hacked?

Update to include nslookup:

nslookup

  • What DNS server is the router configured to use? What happens if you run nslookup itunes.apple.com? – multithr3at3d Apr 3 '18 at 0:56
  • No need to figure it out. Buy them a new router that is still supported and junk that one. – Neil Smithline Apr 3 '18 at 3:48
  • @multithr3at3d Added screenshot of nslookup for your viewing pleasure. – Kit Menke Apr 3 '18 at 16:21
5

That particular router was found vulnerable in 2014 for the MoonWorm. It's possible you have fallen victim to someone who's trying to phish credentials or credit card information from your home.

I recommend verifying your payment details, changing passwords and replacing the router.

  • Don't you think it strange that it has an Apple cert if it's a theif? – Neil Smithline Apr 3 '18 at 3:47
  • 1
    That's just a field where you can write anything. Anybody can basically write anything in any field. Only the signature ensures, that those values where checked by a CA and are credible. If the CA that issued the certificate is not found trustworthy, you get exactly the warning we can see. – MemAllox Apr 3 '18 at 11:18
  • I will definitely recommend they get a new router. How did you know the router was vulnerable to MoonWorm? – Kit Menke Apr 3 '18 at 16:23
  • 1
    Google is your friend ;) – Lucas Kauffman Apr 3 '18 at 16:26
  • I'm definitely going to recommend they get a new router but I still really would really like to figure out as much info as possible. According to this article TheMoon worm is not persistent across reboots and doesn't work if Remote Management Access is turned off (which it is). – Kit Menke Apr 3 '18 at 16:31
1

These symptoms are suggestive of a man-in-the-middle attack. A piece of malware running on the router may be generating bogus certificates on the fly — it's easy to fill in all the fields, but if the attacker does not have access to a trusted root certificate's private key, it can't properly sign it —, intercepting HTTPS traffic, and pretending to be miscellaneous webservers. Because your traffic flows through your WiFi router when you're connected to it, this sort of attack does not necessarily need to show up in DNS records; a router directly on the path from you to the webserver has the power to act as though it was a TCP endpoint. If, for one reason or another, the user errs and chooses to accept the bogus certificate as valid, the malware running on the router can listen to and tamper with traffic from this user to this server, and use this power as a springboard to further attacks, whose targets may possibly including either or both of the user's hardware or legal identity.

You may be able to diagnose this class of issues by attempting TCP connections to faraway HTTPS servers but setting the TTL value to low values. (hping3 is a handy tool for this sort of experiments.) Normally, on each hop in the path of an IP packet, routers decrement the IP packet's TTL header field by one, and when TTL reaches zero, the packet will not be forwarded; instead, polite routers will send back an ICMP TTL expired response. This strategy helps guard against immortal packets eternally travelling accidental routing loops, wasting resources. It is also useful for diagnostic tools such as traceroute.

Let's suppose you're one hop away from the WiFi router, and, say, accounts.google.com is ten hops away. If you send at accounts.google.com:443 a TCP packet with its SYN flag set, indicating that you're trying to open an HTTPS connection, but its TTL at a value of, say, five, the packet should never be able to reach accounts.google.com, like this:

$ sudo hping3 -c 3 -p 443 -S -t 5 accounts.google.com
HPING accounts.google.com (en1 216.58.209.141): S set, 40 headers + 0 data bytes
TTL 0 during transit from ip=62.115.61.30 name=google-ic-314684-s-b5.c.telia.net

(Note, however, that the ICMP response may, these days, not be delivered or get lost in traffic, so the diagnostic criterion is lack of a TCP SYN+ACK response rather than arrival of a TTL expired ICMP response.)

If, however, you get a SYN ACK response, like this:

len=44 ip=216.58.209.141 ttl=59 id=23005 sport=443 flags=SA seq=0 win=42780 rtt=8.1 ms

it means that somebody within five hops from you — which, if you're ten hops away from a genuine accounts.google.com, is almost certainly a nefarious imposter — is responding to traffic meant for accounts.google.com, and you can know for sure that something is wrong within these five hops on the IP path.

Note, however, that smart malware may be wise to this trick, so this is conclusive in only one direction. If you, indeed, can't reach faraway servers with low-TTL packets, it hints against, but is not strong evidence against, presence of MiTM malware in the WiFi router. Also note that it is quite possible to be nearer than ten hops to accounts.google.com, so you may want to play with the TTL value (-t option to hping3) a bit.

  • Thank you very much for this answer. This is exactly the kind of thing I was looking for and will give it a try. DNS doesn't appear to be compromised on the router (visibly anyway). The only other thing I can think of is to pull the router and try to capture traffic coming out of it to the internet. – Kit Menke Apr 6 '18 at 2:39
0

I think dig said it best here but looks like a man in the middle attack. It looks incredibly similar and behaves just like a transparent proxy in this sense. I'd think the router is compromised. Buying a new one would be your best bet, a fun test might be to flash the latest firmware and test again with something that doesn't pass personal info. If it happens after router replacement then I'd be calling the ISP.

A second test may be worth trying is seeing if plugging in to modem directly still yields same result. If you can in this case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.