Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Kimwolf botnet is stalking your local network

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 59 posts

Re: The Kimwolf botnet is stalking your local network

#21

Post by cryzinger »

hedora wrote: post #18
Nextgrid wrote: post #17

> to relay malicious and abusive Internet traffic — such as ad fraud , account takeover attempts and mass content scraping Oh no, let me get my tiny violin! Really hard to feel bad here. For most home users (that don’t expose anything sensitive on their LAN) these boxes are not a threat, seem to be doing a useful service in providing a superior streaming service that the balkanized official ones, and also shits on in…

I’d be nice to control where the money and content go. If I could, I’d strongly consider firing up an old raspberry pi or two. Also, is there a better word than ad fraud? It needs an innocuous sounding euphemism like pretty much everything else involving that industry has. “Monetizing ad display”? “User-agent driven conversions?”

The actual industry lingo is "invalid traffic" :P

Re: The Kimwolf botnet is stalking your local network

#22

Post by aspbee555 »

polishdude20 wrote: post #13

So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?

usually lan devices do not talk to the router unless they need a resource outside your lan network

you can however isolate with vlans and a vlan capable switch, then it would be on the router to isolate traffic between lans (I do exactly this for my less trusted virtual machines)

Re: The Kimwolf botnet is stalking your local network

#23

Post by crtasm »

Nextgrid wrote: post #17

> to relay malicious and abusive Internet traffic — such as ad fraud , account takeover attempts and mass content scraping Oh no, let me get my tiny violin! Really hard to feel bad here. For most home users (that don’t expose anything sensitive on their LAN) these boxes are not a threat, seem to be doing a useful service in providing a superior streaming service that the balkanized official ones, and also shits on in…

Until all their accounts get pwned due to credential stuffing over this or a similar botnet - being the average person with weak, reused passwords?

Re: The Kimwolf botnet is stalking your local network

#24

Post by gopher_space »

polishdude20 wrote: post #13

So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?

I'm in the middle of setting up DD-WRT on an old router (I'd use OpenWRT if I could) just to play around with VLANs and AP isolation.

Re: The Kimwolf botnet is stalking your local network

#25

Post by themafia »

BloodyIron wrote: post #12

How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…

It's quite obvious to everyone here.

Why it's not obvious to every Senator and Representative in our Government is frustrating to an extreme.

We really do need to end our enhance our trade protections one way or another.

Re: The Kimwolf botnet is stalking your local network

#26

Post by themafia »

Nextgrid wrote: post #17

> to relay malicious and abusive Internet traffic — such as ad fraud , account takeover attempts and mass content scraping Oh no, let me get my tiny violin! Really hard to feel bad here. For most home users (that don’t expose anything sensitive on their LAN) these boxes are not a threat, seem to be doing a useful service in providing a superior streaming service that the balkanized official ones, and also shits on in…

> sounds like a pretty good box really.

You can buy a better one that does not have malware installed. So these are complete and total garbage and no sane person should run them under any circumstance. Sounds like you have a bias which has prevented you from thinking about this clearly.

Re: The Kimwolf botnet is stalking your local network

#27

Post by reactordev »

themafia wrote: post #25
BloodyIron wrote: post #12

How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…

It's quite obvious to everyone here. Why it's not obvious to every Senator and Representative in our Government is frustrating to an extreme. We really do need to end our enhance our trade protections one way or another.

Money talks

Re: The Kimwolf botnet is stalking your local network

#28

Post by kube-system »

kadoban wrote: post #14
BloodyIron wrote: post #12

How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…

> it's because you're _paying_ to install a backdoor that will rip and tear everything on your network it can. I mean, maybe. More likely imo you're paying for the absolute cheapest hardware and fastest never-updated software someone could throw together and make _any_ profit on. Someone probably had 100k shitty little chips sitting in a warehouse and this was a way to do something with them. The outcome is really th…

Even many TVs with "reputable" western brand names, on the shelf at major US retailers, are often sold at a loss on the hardware and the difference is made up by collecting advertising data.

https://www.broadbandtvnews.com/2024/11/18/tv-companies-sell...

> you just have to look at the finances of Vizio or Roku to see they’re selling TVs at somewhere between -3 and -7% margin

Re: The Kimwolf botnet is stalking your local network

#29

Post by electroglyph »

GolfPopper wrote: post #19
BloodyIron wrote: post #12

How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…

>you're _paying_ to install a backdoor that will rip and tear everything on your network it can* How is this different from buying hardware and software from big market players?

they just steal different things

Re: The Kimwolf botnet is stalking your local network

#30

Post by pamcake »

polishdude20 wrote: post #13

So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?

Heads up that even if you block local forwarding in the router, it won't always be enough to prevent devices talking to each other over, say, an unmanaged switch or a wifi link.

Some (even cheap) unmanaged switches have a "vlan" or "isolation" switch that does exactly that, where only one or two "uplink" or "wan" ports can talk to the rest. If you have a managed switch, vlans is what most people would use for isolation.

On the software side you could also assign /32 IPv4 addresses only and add explicit ip route for the router only.

Post reply on HN