Proper setting up and regular monitoring of logs gives you the avenue to know what’s really happening with your box sitting out there in the internets, and to anticipate when bad things are about to happen. One of the warning signs would be that someone has been poking around your box, looking for an (easy?) way in.
The natural thing that would jump out at you then, is that this someone has been accessing your box in far higher volumes/durations, especially on services that should not be accessed by others.
This is one example of such accesses on a linux box: SSHD brute forcing over long periods of time.
Obligatory blog post graphic, to make this more "interesting" 😛 Meanwhile, check out the really nice Tonido Plug at http://www.tonidoplug.com/
My internet connection goes down periodically, and I used to have to power cycle the router in order to fix that. When it started to become too frequent it posed a problem, since I’m too lazy to keep going to the room (my wife too) to restart it. There’s also the option of restarting the router via the web admin interface, but it required me to login, click to the page for restarting, and click “restart”! Very complicated indeed for lazy people.
Inspired by this hack (Hack a Day) where the guy automated the physical power cycling process, I decided to automate mine too. Since I have a Tonido plug which is almost always on, and I’ve just learnt Python too, I decided to go the scripting method. As they say: to a man with a hammer, everything looks like a nail 😉
A couple of lessons learnt
I was caught by surprise by when reproducing the login and restart sequence exactly didn’t work, and I went so far as to reproduce ALL the requests made by a “normal human”. It turned out (after 2 hours and a shower break) that things worked just fine when I simply converted the minimally needed POST parameters to GET parameters. Nice classic web application hacking trick learnt from my old job as a web application ethical hacker I’d say.
Also, the restart sequence for my router turned out to not only need the form “POST” to request a restart, but also a subsequent request for the “restarting now” status page, interesting…
Download
Note that before you use this, some reverse engineering of the web application calls is needed, and some Python coding too. You have been forewarned! Also, I’m not responsible for this script causing you direct/indirect damage in any way, so don’t come crying when your lawnmower starts to act crazy because you installed this script. The script is released under the GPL, and can be downloaded here.
How to install/use
Edit ‘router_host’: ‘10.0.0.1’, in line 8
Reverse engineer the web admin login and restart sequence, see what you need. I used tools like a transparent proxy (Burp Suite), notepad and some brain grease.
Hack the restart_router() (lines 43-73) function in the python script according to your needs (you’re on your own here… Alternatively you could offer me a good amount of Coke/chips for me to help you with the reverse engineering/coding somehow 😉 )
Copy into the Tonido plug’s /root directory (assume running as root, for simplicity’s sake)
SSH into the Tonido plug as root
# chmod 400 /root/internet_connection_monitor.py
# crontab -e
Add in this line: (makes the script run in the background, 4 minutes after every tonido plug reboot to give the router time to start up) @reboot sleep 4m && /usr/bin/python /root/internet_connection_monitor.py &
Press Alt-X, then “y” to save the new crontab
Reboot the Tonido plug
Profit!
What are the risks to note
The script basically is a hardcoded piece of info revealing the password and sequence to your login/router’s workings! Make sure the script is chmod’ed properly, and isn’t accessible via Tonido’s interfaces. For me I don’t have this problem, since I don’t allow connecting to my Tonido from outside anyway, and people will have to brute force ssh public keys to get in…
It’s always better to Read The Fine Manual (or run perl afterglow.pl -h for the more updated helpfile)…though it’s not really that well documented 😛 Afterglow allows for two column inputs, rather than us having to do weird tricks to make them 3-column.
(Note to self: get the raw data with fields in the order that you want where possible/faster, rather than pumping it through sed. Makes for good practice though.)
Using the csv file containing userids (visualized in yellow) and IPs (visualized in green) over the past few months from Splunk, here’re the results of some of the experiments.
Oh, for the Windows users, you can use type instead of cat 😉
Huge, but better visualized with -e 5 option (Resulting image for that is too huge to upload though :P). Note the single IP in the middle (the yellow explosion) that had been trying a LOT of userids to date.
geekery 