Your Netgear router can't break TLS. Google Mail and Facebook are designed to assume that your Netgear router is already evil.

Both true - but once you own someone's router, one could (hypothetically) social engineer the target into downloading an alternative SSL cert (like you would do yourself when setting up a debugging proxy for HTTPS traffic). As soon as they do that, it's all cleartext. I've been able to convince various (non-technical) house guests and (technical) coworkers to do this in the past, so I imagine it'd be possible on a wider scale.

Isn't Facebook pinned? Google is.

Obviously, if you can trick someone into running an EXE, it's game over, but that's true whether or not your router is owned up (95%+ of the Internet sites people visit can be used to stage this kind of phishing attack.)

Someone who knows more about organized crime than I do can tell me whether or not people actually harvest logins from compromised routers. CSRF RCE definitely belongs to the class of attacks that can be deployed en masse with very little effort, so it's at least sort of plausible.

Their certs may be pinned, but from what I can tell there's nothing keeping me from introducing a new root cert to my system (IIRC there was a scary popup and that's it).

Here's a screenshot of Chrome giving me the "insecure" padlock, but still rendering Facebook while I debug the HTTPS traffic: http://puu.sh/jdGhc/128d35f793.png

Here's similar, showing Google HTTPS traffic being debugged while browsing in Safari (with nothing appearing out of the ordinary): http://puu.sh/jdGoW/3163db1e54.png

(the debugging proxy is Cellist, which I find to be a suitable replacement for mitmproxy, as long as I don't need rewrite/replay)

> if you can trick someone into running an EXE, it's game over

I suppose it is roughly equivalent (i.e. if you could get them to download a cert, you could probably get them to download an EXE so the point may be moot). I always figured you might have more luck with this sort of thing if you owned a Starbucks router or something, where people might be more accepting of having to jump through hoops to use the internet.

Have you never executed a binary you downloaded over http? (Live) Patching backdoors into existing binaries is not exactly difficult.

So far I've only seen one attack like this in the wild, but you need to understand that these exploit vendors primarily sell for targeted attacks (usually by various government actors)

Of course not. But, like I said, if all you need is to pop up a convincing looking page that gets someone to download an executable, you don't need to pop a router to do it. There are hundreds of ad networks you can inject stuff into to accomplish this.

My point is that the compromised router isn't a usefully privileged position to launch this attack from. Whether or not you have the router, you're relying on sending someone to a random convincing-looking web page. This is an "open redirect" level of difficulty, not an $80k RCE level.

> the compromised router isn't a usefully privileged position to launch this attack from.

I hadn't thought too deeply about it but you're absolutely right. Given the presence of encryption, the biggest advantage you can get from owning the router is being able to phish the user from a site they might normally trust but isn't encrypted (a group of sites that is, thankfully, getting smaller every day).

Key is that you don't need to phish, you can just wait until the user downloads an unencrypted executable.