Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Execute a VLAN "flop" to allow the AT&T Residential Gateway (RG) to perform 802.1x authentication via the Optical Network Terminal (ONT) before falling back to the subscriber's "own" router/gateway hardware. The RG is toggled off and on as needed via a remote-controlled power outlet (see below).
For more information about this procedure, please see brianlan's original document on DSL Reports.
Netgear gigabit-speed "Smart Managed Plus" switch. The following models are known to work:
Please submit a PR if you confirm another working model.
MQTT broker (like this one)
"Smart" outlet that can be remotely-controlled (i.e. set "on" or "off") via a message published to a MQTT bus. For example:
Host (for the script) with:
N.B. With a SmartThings- or other cloud-based solution, an Internet connection is required to perform the VLAN flop, so if the operation fails (or is attempted after your router has already lost its DHCP lease), your network may get stuck in an inconsistent state. To recover, run the script and toggle the RG power manually as indicated.
Follow the guide to establish the initial network environment, which includes copying information from the RG to your own router. You should perform the VLAN flop one time through by hand to make sure everything is set up and working correctly. Jot down your VLAN IDs and port assignments for later.
Next, pick a server where the script will run and install it:
$ gem install rg_refresh
Create a configuration file and write it somewhere sensible, e.g.
/etc/rg_refresh.yml
, using the following template:
---
:netgear:
# Tip: Give your switch a static IP address or DNS name if possible.
:address: 'http://a.b.c.d'
:password: password
:vlans:
:rg: 2
:my_router: 3
:ports_vlans:
# ONT is on switch port #1 in this example.
# Put .<vlan> to reference above VLAN assignments.
# Put ~ to preserve the port's current VLAN assignment; trailing ~ can be
# omitted if desired.
:reauth: [.rg, .rg, .my_router]
:bypass: [.my_router, .rg, .my_router]
:mqtt:
:client:
# This section is passed to MQTT::Client.connect as-is.
# https://www.rubydoc.info/gems/mqtt/MQTT/Client#instance_attr_details
:host: localhost
:port: 1883
:topic: smartthings/RG/switch
:messages:
# Remember to quote YAML-reserved terms like "on" and "off".
:reauth: 'on'
:bypass: 'off'
Run the script to make sure it works correctly, passing in the path to the configuration file created above. For example:
$ rg_refresh -c /etc/rg_refresh.yml
Finally, schedule the script to run once a week or so, during off-hours, and/or when your router loses its DHCP lease.
After checking out the repo, run bin/setup
to install dependencies. Then, run
rake test
to run the tests. You can also run bin/console
for an interactive
prompt that will allow you to experiment.
To install this gem onto your local machine, run bundle exec rake install
. To
release a new version, update the version number in version.rb
, and then run
bundle exec rake release
, which will create a git tag for the version, push
git commits and tags, and push the .gem
file to
rubygems.org.
Bug reports and pull requests are welcome on GitHub at https://github.com/mwpastore/rg_refresh.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that rg_refresh demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.