How hard would it be to grab one of these little virus boxes and flash it with linux?
Well then you just have a very overpriced, extremely low power linux box that doesn't do what you want it to do
The Kimwolf botnet is stalking your local network
51–59 of 59 posts
Re: The Kimwolf botnet is stalking your local network
#52How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…
>you're _paying_ to install a backdoor that will rip and tear everything on your network it can* How is this different from buying hardware and software from big market players?
*Samsung Core Features has the chat.*
Re: The Kimwolf botnet is stalking your local network
#53I couldn't really follow the technical details of the malware from the article, so I found what seems to be the first major report on the topic: https://blog.xlab.qianxin.com/kimwolf-botnet-en/#network-pro... That article has a more technical lens. It focuses primarily on the size and detection evasion methods of Kimwolf, rather than some notable (and definitely not unique) method of spreading. Without looking too de…
What’s the deal with that seemingly random address written out as a domain name? Brian krebb’s home address? 14 emelia terrace west roxbury ma 02132 . su As for your assumption the OP talks about how it uses residential proxies to get into lans, I don’t think it is a supply chain attack.
Krebs redacted the one that was his own home address. Certainly someone's home address: https://www.zillow.com/homedetails/14-Emelia-Ter-West-Roxbur...
Re: The Kimwolf botnet is stalking your local network
#54How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…
>you're _paying_ to install a backdoor that will rip and tear everything on your network it can* How is this different from buying hardware and software from big market players?
Brand damage; The big players have more to loose from being caught installing backdoors on devices sold to the general public, and will probably put in something in the T&Cs to deflect their responsibilities.
Re: The Kimwolf botnet is stalking your local network
#55How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…
It's quite obvious to everyone here. Why it's not obvious to every Senator and Representative in our Government is frustrating to an extreme. We really do need to end our enhance our trade protections one way or another.
>Why it's not obvious to every Senator and Representative in our Government is frustrating to an extreme.
Why? How does this impact your life enough to be that frustrating?
Re: The Kimwolf botnet is stalking your local network
#56Earlier quoted context omitted.
Sometimes; I've seen it called client isolation or something like that. Or, yeah, if you can get under the hood it's probably as easy as one or two iptables rules (or nftables or whatever).
Is this true? For devices on the same subnet, I'm petty sure they don't even have to takl to the router. Maybe a managed switch can stop it, but I doubt most home routers have anything more than a dumb switch in them.
Client isolation is a Wi-Fi feature, not an Ethernet feature. So a wireless client can't talk directly to another wireless client when client isolation is on.
Wired clients are unaffected.
Re: The Kimwolf botnet is stalking your local network
#57How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not…
>you're _paying_ to install a backdoor that will rip and tear everything on your network it can* How is this different from buying hardware and software from big market players?
Re: The Kimwolf botnet is stalking your local network
#58Earlier quoted context omitted.
Regular people don't need a "secure network". Phones and computers are, by default, secure against malicious networks. Just don't run code you download from the internet or put your passwords to important accounts into cheap devices and you'll be fine. Normally people don't the the former, but sometimes do the latter. edit: To be clear: the bitterness in this comment comes from how many developers assume loopback is…
Regular people download shit all the time though? Especially now with GPT, everyone is a programmer pasting code into command line. And how many people have IoT devices that they have to connect to WiFi? That’s total blind trust. Every time I ask this question nobody is able to give me a solid answer :/
Based on the :/ emoticon, I now understand that you were asking this question for yourself. In that case, I will express anger at the article. I believe that it was vague and leaned into fear mongering. This explains the vagueness of your question (emphasis mind):
> I know this may seem trivial for many here but how can regular people easily check and debug their network for stuff like this?
"Stuff like this" is very vague.
- If there is a device on your network that is occasionally sending requests to the internet, then it generally isn't hurting you. That's why security is weak here, because the person buying the device is not harmed.
- If you're worried about the device sniffing your local network, then "normal people" are typically safe. Computers that you use are typically safe from malicious devices on the network, and you're in no more danger than working at a coffee shop, hotel, or university network.
- If you're knowledgeable enough to be a danger to yourself, and need the local network to be safe to protect yourself, then there is definitely a longer conversation to be had.
Responding point by point (before I realized that you were asking for yourself, and not the average person):
> Regular people download shit all the time though?
This is fair, though on macOS, most people download apps from the App Store (macOS makes it difficult to run apps downloaded from the internet and not signed by a registered developer).
> Especially now with GPT, everyone is a programmer pasting code into command line.
I am trying to reference a group of "regular people" who definitely do not fit this description---something like "the average citizen in the developed world". My parents definitely are not writing code with AI and pasting it into the command line. Although this was not crystal clear in this comment chain.
> And how many people have IoT devices that they have to connect to WiFi? That’s total blind trust.
My point was these devices do not endanger things that regular people care about. Their computers are still just as secure as when they visit a coffee shop or connect to their university wifi.
> Every time I ask this question nobody is able to give me a solid answer :/
for stuff like this?
Re: The Kimwolf botnet is stalking your local network
#59Earlier quoted context omitted.
Regular people don't need a "secure network". Phones and computers are, by default, secure against malicious networks. Just don't run code you download from the internet or put your passwords to important accounts into cheap devices and you'll be fine. Normally people don't the the former, but sometimes do the latter. edit: To be clear: the bitterness in this comment comes from how many developers assume loopback is…
Sure they can send requests but they can't receive them unless you've got misconfigured CORS. I guess there's DNS rebinding but like, idk, attack surface seems pretty small. This sort of stuff isn't really worth worrying about unless you're an idiot or likely to be the victim of a targeted attack. I happily run code off the internet all the time and it seems fine. If there's one thing that really seems like a mind vi…
So, purely for example:
When you run VS Code, it spins up a local language server that is capable of making code changes. That is how refactoring python works in many editors (including VS Code).
A website that you're browsing could potentially send requests to this server asking for code to be inserted that fully compromises your device. What keeps us safe?
- maybe the website is only allowed to send GET requests, not PUT requests, and maybe the language servers that you're using are all "hardened" so that they will never permit mutations via any get requests, and never have a misconfigured CORS header
- the website has to guess the correct port and the correct language server with a known vulnerability
- any website doing this on a large scale would likely get the language server patched and the website on a block list
- there might be other safeguards that I'm not familiar with. For example, I believe that Chrome disallows this by default
So now, here's my frustration: these two statements seem hugely at odds with each other:
> I'm ok getting pwned every few decades if the tradeoff is never worrying about this shit.
> (i will say putting a device not running open source software/firmware or something very locked down like a phone on your LAN is insanity, i could never)
I'm ok with a person who makes either statement. I'm also ok with a person who makes the first statement, and also wants their LAN locked down. However, I do not feel as though the a LAN ever needs to be locked down unless a person in running a server on the LAN network. Personal devices (like laptops and phones) are plenty capable of resisting malicious networks by default (coffee shops, university wifi, etc). What else is on a LAN?
> mind virus it's the paranoia all security people get
I generally agree with you, but I feel as though I am the one who has accepted that personal laptops need to handle malicious networks, and I'm generally comfortable with that. I don't worry too much about putting IoT devices on the same network as my personal laptop, nor about connecting to coffee shop wifis.