Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/google/ubntools
Copyright 2017 Google Inc.
This is not a google product.
Tools to do fun things with ubiquity gear.
$ mkdir ~/.ssh
$ dropbearkey -t rsa -f ~/.ssh/id_dropbear -s 2048
ssh-rsa AAAA…== admin@apname
~/.ssh/authorized_keys
Try a one-time upload by uploading ap-uploader.sh
to the AP and running:
$ ./ap-uploader.sh user@server:path/
On the AP, run:
$ nohup sh -c 'while true; do ./ap-uploader.sh user@server:path/;sleep 600;done' &
Make sure files are being uploaded to the server every 10 minutes. If it all looks good then the AP setup is done. At least until it reboots.
$ createdb ubntools
$ psql ubntools -f schema.sql
$ go build inserter.go
$ ./inserter -dbconnect='dbname=ubntools host=/var/run/postgresql sslmode=disable' /path/to/*.gz
$ psql ubntools
ubntools=> SELECT * FROM view_neighbors;
ap | channel | bssid | essid | bw | rssi | security | adhoc
----------+---------+-------------------+------------------------+----+------+----------+-------
apname | 6 | 00:8e:f2:aa:aa:aa | virginmediaxxxxxxx | 20 | 10 | secured | f
[…]
$ go build mkgraph.go
$ ./mkgraph -dbconnect='dbname=ubntools host=/var/run/postgresql sslmode=disable' | gnuplot
$ mv foo.png /path/to/web/root/or/something/
There are premade views (do \d
and then SELECT * from view_…
),
but you can query more raw data too.
SELECT
essid,
ap,
channel,
data->>'hostname' hostname,
data->>'mac' mac,
data->>'rssi' rssi
FROM sta_table_latest
ORDER BY essid,ap,channel,hostname,mac;
SELECT
ap,
data->>'name' AS name,
data->>'radio' AS radio,
CASE data->>'is_11ac' WHEN 'true' THEN TRUE ELSE FALSE END as "802.11ac",
data->>'max_txpower' AS power
FROM radio_table_latest
ORDER BY ap, name;
SELECT
ts,
(data->>'rssi')::int rssi
FROM sta_table
WHERE data->>'mac'='11:22:33:44:55:66'
ORDER BY ts;
SELECT
ap,
ts,
essid,
channel,
data->>'hostname' hostname,
data->>'mac' mac,
data->>'rssi' rssi
FROM sta_table
ORDER BY data->>'mac',ts;
# SELECT TO_CHAR(ts,'YYYY-MM-DD') dayy,MIN(channel) channel FROM view_clients_history WHERE ap='ap-longrange' AND ts>'2020-11-01' AND channel>11 GROUP BY dayy ORDER BY dayy;
dayy | channel
------------+---------
2020-11-01 | 128
2020-11-02 | 128
2020-11-03 | 128
2020-11-04 | 128
2020-11-05 | 128
2020-11-06 | 40
2020-11-07 | 40
2020-11-08 | 44
2020-11-09 | 128
2020-11-10 | 128
2020-11-11 | 44
2020-11-12 | 44
2020-11-13 | 36
2020-11-14 | 36
2020-11-15 | 44
2020-11-16 | 44
2020-11-17 | 128
2020-11-18 | 36
2020-11-19 | 36
2020-11-20 | 36
2020-11-21 | 36
2020-11-22 | 48
2020-11-23 | 48
2020-11-24 | 44
2020-11-25 | 48
2020-11-26 | 48
2020-11-27 | 36
2020-11-28 | 36
2020-11-29 | 128
2020-11-30 | 40
2020-12-01 | 40
2020-12-02 | 40
(32 rows)
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.