Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Kimwolf botnet is stalking your local network

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 59 posts

Re: The Kimwolf botnet is stalking your local network

#31

Post by 0xR1CK »

kadoban wrote: post #15
polishdude20 wrote: post #13

So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?

In most shitty routers: no. They don't even have raw ability to do that. You can look around for something like device isolation, but I doubt you'll find it unless you go a couple of steps up from whatever router ISPs ~give away these days.

My ISP's router has isolation. Has had for 5+ years. Main SSID has it off so we can do LAN stuff. Guest SSID is used for IoT things and isolation turned off. Handy.

Re: The Kimwolf botnet is stalking your local network

#32

Post by yjftsjthsd-h »

polishdude20 wrote: post #13

So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?

Sometimes; I've seen it called client isolation or something like that. Or, yeah, if you can get under the hood it's probably as easy as one or two iptables rules (or nftables or whatever).

Re: The Kimwolf botnet is stalking your local network

#33

Post by yjftsjthsd-h »

> However, shipping these devices with ADB turned on creates a security nightmare because in this state they constantly listen for and accept unauthenticated connection requests.

I'm confused. I intentionally use ADB over the network sometimes, and I have to explicitly interactively allow each adb client by its key. Are they shipping boxes with adb configured to just allow any connection without any verification?

Re: The Kimwolf botnet is stalking your local network

#34

Post by IgorPartola »

gopher_space wrote: post #24
polishdude20 wrote: post #13

So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?

I'm in the middle of setting up DD-WRT on an old router (I'd use OpenWRT if I could) just to play around with VLANs and AP isolation.

Instead of that I highly recommend either setting up a VM or picking up a $35 thin client and running OPNSense. After years of OpenWRT/DD-WRT I switched about 5 years ago and oh my god what a difference. You will spend basically 0 time on system maintenance and just focus on the actual networking stuff. It has more knobs than a basic router but the UI is excellent and there are very few bugs, if any.

Re: The Kimwolf botnet is stalking your local network

#35

Post by BloodyIron »

kube-system wrote: post #28
kadoban wrote: post #14

Earlier quoted context omitted.

> it's because you're _paying_ to install a backdoor that will rip and tear everything on your network it can. I mean, maybe. More likely imo you're paying for the absolute cheapest hardware and fastest never-updated software someone could throw together and make _any_ profit on. Someone probably had 100k shitty little chips sitting in a warehouse and this was a way to do something with them. The outcome is really th…

Even many TVs with "reputable" western brand names, on the shelf at major US retailers, are often sold at a loss on the hardware and the difference is made up by collecting advertising data. https://www.broadbandtvnews.com/2024/11/18/tv-companies-sell... > you just have to look at the finances of Vizio or Roku to see they’re selling TVs at somewhere between -3 and -7% margin

Wow those negative margins are WILD!

Re: The Kimwolf botnet is stalking your local network

#36

Post by toast0 »

BloodyIron wrote: post #12

How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…

> Or advertise unlimited movies/shows/etc for similarly unbelievable prices.

I mean, it's pretty obvious the services are paid piracy. But it's got to cost something to pull VOD movies from wherever and serve them with an http server limited at 8 mbps even for content that exceeds that. Obviously someone doesn't want the content they stole to be easy to steal... too bad you can't reasonably play it either. :P

Re: The Kimwolf botnet is stalking your local network

#37

Post by olyjohn »

yjftsjthsd-h wrote: post #32
polishdude20 wrote: post #13

So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?

Sometimes; I've seen it called client isolation or something like that. Or, yeah, if you can get under the hood it's probably as easy as one or two iptables rules (or nftables or whatever).

Is this true? For devices on the same subnet, I'm petty sure they don't even have to takl to the router. Maybe a managed switch can stop it, but I doubt most home routers have anything more than a dumb switch in them.

Re: The Kimwolf botnet is stalking your local network

#38

Post by olyjohn »

0xR1CK wrote: post #31
kadoban wrote: post #15

Earlier quoted context omitted.

In most shitty routers: no. They don't even have raw ability to do that. You can look around for something like device isolation, but I doubt you'll find it unless you go a couple of steps up from whatever router ISPs ~give away these days.

My ISP's router has isolation. Has had for 5+ years. Main SSID has it off so we can do LAN stuff. Guest SSID is used for IoT things and isolation turned off. Handy.

What exactly does it isolate? An SSID? IP addresses? individual MAC addresses? How does this stop a pre-infected device you purchased from shitting traffic out of your network, acting as a residential proxy or try to own your other IoT devices?

Re: The Kimwolf botnet is stalking your local network

#39

Post by kadoban »

olyjohn wrote: post #38
0xR1CK wrote: post #31

Earlier quoted context omitted.

My ISP's router has isolation. Has had for 5+ years. Main SSID has it off so we can do LAN stuff. Guest SSID is used for IoT things and isolation turned off. Handy.

What exactly does it isolate? An SSID? IP addresses? individual MAC addresses? How does this stop a pre-infected device you purchased from shitting traffic out of your network, acting as a residential proxy or try to own your other IoT devices?

The one I've seen on ~basic consumer routers just disallows wifi devices from talking to each other at all, it won't route between them. I usually need something more nuanced personally, but it's not a bad start at all.
Post reply on HN