Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A 100k Botnet Turns Home Routers to Email Spammers

blog.netlab.360.com

Post reply on HN
Print view View original

51–60 of 122 posts

Re: A 100k Botnet Turns Home Routers to Email Spammers

#51

Post by macintux »

rbanffy wrote: post #22

What if someone did that, but to use the routers for some charitable distributed computing project? Or mining crypto currencies and giving the proceeds to the router's owners? Or perhaps a globally distributed weather prediction system that automatically detects network enabled weather stations and predicts weather everywhere for free? Or a distributed P2P social network?

It's wrong, full stop. No less wrong than it would be for someone to set up a homeless encampment on property you own without your consent.

Sure, it's (probably) a good cause. It's still wrong.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#52

Post by weinzierl »

9712263 wrote: post #38

So, what is the most secured option for the moment? Buy a x86 box and turn it into a router? But it consumes more power than a low-power router, and buying more network adapter is not that cheap. I am currently using the open source tomato firmware. However, since there is a bug/feature in the router so that I cannot flash an image too large, or otherwise it would not work. Also, the configuration is limited to 32 KB…

fli4l [1] on an ALIX board [2] (for example) is an option.

ALIX boards are reasonably energy efficient. fli4l can run from read-only media. This is no panacea (see fileless malware) but at least you can be sure that after a reboot your system is clean. Security is a primary goal [3] of the fli4l project and they maintain a public Security Archive.

[1] http://www.fli4l.de/en

[2] https://www.pcengines.ch/alix.htm

[3] http://www.fli4l.de/en/home/security/

Re: A 100k Botnet Turns Home Routers to Email Spammers

#54

Post by eikenberry »

mark-r wrote: post #48
degenerate wrote: post #2

A much better, more thorough analysis, complete with affected router model numbers, graphs, charts, and area affected map are at the source post: https://blog.netlab.360.com/bcmpupnp_hunter-a-100k-botnet-tu...

I think you just killed the site. I get a 504 error.

https://web.archive.org/web/20181112153533/https://blog.netl...

Re: A 100k Botnet Turns Home Routers to Email Spammers

#55

Post by 0xEFF »

spudlyo wrote: post #43
OJFord wrote: post #28

Earlier quoted context omitted.

I keep looking into it and keep stopping at 'what should I buy'. I'm willing to / assume I need to buy new hardware. What do I buy that will run it well, and continue to?

This will depend on what kind of Internet connection you have, or expect to have in the future. Gigabit internet connections are becoming more common here in the US, and some lower powered devices just can't route packets faster than say 100-200 Mbit/s. I can tell you what I did, which may or may not be helpful to you. I got Linksys WRT AC3200[0]. The "AC3200" bit refers to a type of wifi 802.11ac configuration that…

Do you happen to know the throughput when using PPPoE?

Re: A 100k Botnet Turns Home Routers to Email Spammers

#56

Post by josteink »

rubatuga wrote: post #35
OJFord wrote: post #28

Earlier quoted context omitted.

I keep looking into it and keep stopping at 'what should I buy'. I'm willing to / assume I need to buy new hardware. What do I buy that will run it well, and continue to?

Buy the Archer C7 version 2, and install the optimized version of openwrt: https://github.com/infinitnet/lede-ar71xx-optimized-archer-c... This build gets ~750 mbps NAT speed as opposed to vanilla openwrt, which is around ~300 mbps.

While I think this is a really good OpenWrt-router, with good value for money and easy installation...

It is fair mentioning that this model is discontinued from TP-Link and you will probably have to buy it second hand. It also comes in at least 5 revisions, with various levels of support, making life a little bit more difficult for the average, uninformed buyer.

As a side note: I have a 350mbps symmetrical FTTH link and I've had no issues maxing this line with regular, official OpenWRT builds.

Unless you need significantly higher speeds and can prove that official builds can't do it, I see no reason to go with unofficial, unsupported builds.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#57

Post by [deleted] »

rubatuga wrote: post #35
OJFord wrote: post #28

Earlier quoted context omitted.

I keep looking into it and keep stopping at 'what should I buy'. I'm willing to / assume I need to buy new hardware. What do I buy that will run it well, and continue to?

Buy the Archer C7 version 2, and install the optimized version of openwrt: https://github.com/infinitnet/lede-ar71xx-optimized-archer-c... This build gets ~750 mbps NAT speed as opposed to vanilla openwrt, which is around ~300 mbps.

[deleted]

Re: A 100k Botnet Turns Home Routers to Email Spammers

#59

Post by exhilaration »

josteink wrote: post #56
rubatuga wrote: post #35

Earlier quoted context omitted.

Buy the Archer C7 version 2, and install the optimized version of openwrt: https://github.com/infinitnet/lede-ar71xx-optimized-archer-c... This build gets ~750 mbps NAT speed as opposed to vanilla openwrt, which is around ~300 mbps.

While I think this is a really good OpenWrt-router, with good value for money and easy installation... It is fair mentioning that this model is discontinued from TP-Link and you will probably have to buy it second hand. It also comes in at least 5 revisions, with various levels of support, making life a little bit more difficult for the average, uninformed buyer. As a side note: I have a 350mbps symmetrical FTTH link…

Do you know well this router runs Wireguard using OpenWRT?

Re: A 100k Botnet Turns Home Routers to Email Spammers

#60

Post by Scoundreller »

I’ve said it before: it shouldn’t be that hard for someone handy with a soldering iron to “harden” their router:

Look up the Pinout for the flash chip, find the write-enable line, and put it on a switch to lock firmware updates.

This won’t protect you against non-persistent malware, but it will prevent malicious updates.

One could attach a bit of logic and an LED to this line to switch on when a flash is attempted. Then you know something bad is in the stream.

Post reply on HN