Live data from Hacker News

The Kimwolf botnet is stalking your local network

krebsonsecurity.com

11–20 of 59 posts

Re: The Kimwolf botnet is stalking your local network

#11

Very interesting! A tutorial to check if kimwolf is running on your network would be nice

Well the first thing to check is, do you own and operate any of these janky Android "TV" boxes sold by companies nobody has heard of? If yes? Then there's probably your answer.

Re: The Kimwolf botnet is stalking your local network

#12
How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat?

Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices.

Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?".

No, it's not because movies and shows are 99.9999% profit (spoiler: they aren't), it's because you're _paying_ to install a backdoor that will rip and tear everything on your network it can.

You like having a credit card? That's precious, it's mine now.

Look at me, I'm the network now.

Re: The Kimwolf botnet is stalking your local network

#14

How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…

> it's because you're _paying_ to install a backdoor that will rip and tear everything on your network it can.

I mean, maybe. More likely imo you're paying for the absolute cheapest hardware and fastest never-updated software someone could throw together and make _any_ profit on. Someone probably had 100k shitty little chips sitting in a warehouse and this was a way to do something with them.

The outcome is really the same, it's just the steps to get there are more human nature.

Re: The Kimwolf botnet is stalking your local network

#15

So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?

In most shitty routers: no. They don't even have raw ability to do that.

You can look around for something like device isolation, but I doubt you'll find it unless you go a couple of steps up from whatever router ISPs ~give away these days.

Re: The Kimwolf botnet is stalking your local network

#16
post #14

How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…

> it's because you're _paying_ to install a backdoor that will rip and tear everything on your network it can. I mean, maybe. More likely imo you're paying for the absolute cheapest hardware and fastest never-updated software someone could throw together and make _any_ profit on. Someone probably had 100k shitty little chips sitting in a warehouse and this was a way to do something with them. The outcome is really th…

At a price tag of $5/ea the cost of just advertising and distribution exceeds the cost of the product itself. There is zero room for profit. The business model is installing back doors to the "clients" and stealing money, information, and anything else from them. Consider that even the cost of the included remote is a huge part of the actual hardware cost, and nobody is going to buy something like this without a remote.

Re: The Kimwolf botnet is stalking your local network

#17
> to relay malicious and abusive Internet traffic — such as ad fraud, account takeover attempts and mass content scraping

Oh no, let me get my tiny violin! Really hard to feel bad here. For most home users (that don’t expose anything sensitive on their LAN) these boxes are not a threat, seem to be doing a useful service in providing a superior streaming service that the balkanized official ones, and also shits on internet spammers/advertisers and frees up loginwalled content - sounds like a pretty good box really.

Re: The Kimwolf botnet is stalking your local network

#18

> to relay malicious and abusive Internet traffic — such as ad fraud , account takeover attempts and mass content scraping Oh no, let me get my tiny violin! Really hard to feel bad here. For most home users (that don’t expose anything sensitive on their LAN) these boxes are not a threat, seem to be doing a useful service in providing a superior streaming service that the balkanized official ones, and also shits on in…

I’d be nice to control where the money and content go. If I could, I’d strongly consider firing up an old raspberry pi or two.

Also, is there a better word than ad fraud? It needs an innocuous sounding euphemism like pretty much everything else involving that industry has. “Monetizing ad display”? “User-agent driven conversions?”

Re: The Kimwolf botnet is stalking your local network

#19

How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…

>you're _paying_ to install a backdoor that will rip and tear everything on your network it can*

How is this different from buying hardware and software from big market players?

Post reply on HN