Live data from Hacker News

A 100k Botnet Turns Home Routers to Email Spammers

blog.netlab.360.com

71–80 of 122 posts

Re: A 100k Botnet Turns Home Routers to Email Spammers

#71

Earlier quoted context omitted.

Buy the Archer C7 version 2, and install the optimized version of openwrt: https://github.com/infinitnet/lede-ar71xx-optimized-archer-c... This build gets ~750 mbps NAT speed as opposed to vanilla openwrt, which is around ~300 mbps.

How can you make sure you're getting the v2?

It says so on a sticker underneath. You must ask seller to confirm or provide a picture.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#72
post #43
post #28

Earlier quoted context omitted.

I keep looking into it and keep stopping at 'what should I buy'. I'm willing to / assume I need to buy new hardware. What do I buy that will run it well, and continue to?

This will depend on what kind of Internet connection you have, or expect to have in the future. Gigabit internet connections are becoming more common here in the US, and some lower powered devices just can't route packets faster than say 100-200 Mbit/s. I can tell you what I did, which may or may not be helpful to you. I got Linksys WRT AC3200[0]. The "AC3200" bit refers to a type of wifi 802.11ac configuration that…

Would you happen to know if the 25% cheaper 'gaming edition' is as good? Doesn't seem to have MU-MIMO, which from what you've said might be an easy saving: https://www.amazon.co.uk/Linksys-WRT32X-UK-AC3200-Dual-Band-...

Re: A 100k Botnet Turns Home Routers to Email Spammers

#73
post #27

Earlier quoted context omitted.

I disabled it after this post, but it appears Plex switches to 'indirect' mode (it goes out to the Internet and back in) without it; i.e. I am using UPnP. It's not clear what the solution is - update firmware? I am on the latest. Use OpenWRT (or whatever it's called these days)? Every time I look into it (I really want to!) I stop at the simple 'I want to do this, I will happily buy a new router, which one do I buy a…

Plex has had a major forum breach for basic user data including IP addresses [1], around the time of the botnet's first discovery in 2017, which has me greatly wondering if Plex may have been an inadvertent bootstrap vector for this attack? Worrying, if that's the case. [1] https://haveibeenpwned.com/PwnedWebsites#Plex

Usually a problem for things like Plex, ISPs with double NAT actually do users a favour here.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#74
post #28

Earlier quoted context omitted.

I keep looking into it and keep stopping at 'what should I buy'. I'm willing to / assume I need to buy new hardware. What do I buy that will run it well, and continue to?

Buy the Archer C7 version 2, and install the optimized version of openwrt: https://github.com/infinitnet/lede-ar71xx-optimized-archer-c... This build gets ~750 mbps NAT speed as opposed to vanilla openwrt, which is around ~300 mbps.

Is that v2 as in >v1, or is there a v3+ that I don't want?

That is, can I just buy from Amazon [0] with a fairly safe assumption that a new C7 is OK?

[0]: https://www.amazon.co.uk/TP-Link-AC1750-Dualband-Zertifizier...

Re: A 100k Botnet Turns Home Routers to Email Spammers

#75
post #73

Earlier quoted context omitted.

Plex has had a major forum breach for basic user data including IP addresses [1], around the time of the botnet's first discovery in 2017, which has me greatly wondering if Plex may have been an inadvertent bootstrap vector for this attack? Worrying, if that's the case. [1] https://haveibeenpwned.com/PwnedWebsites#Plex

Usually a problem for things like Plex, ISPs with double NAT actually do users a favour here.

UPnP wouldn't exist without NAT. The underlying root cause of UPnP is NAT (and the slow deployment of things like reliable mDNS implementations). Admittedly, Plex would have different security problems without NAT, given its model, but arguably those security problems would have simpler solutions in a world without NAT.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#76
post #74

Earlier quoted context omitted.

Buy the Archer C7 version 2, and install the optimized version of openwrt: https://github.com/infinitnet/lede-ar71xx-optimized-archer-c... This build gets ~750 mbps NAT speed as opposed to vanilla openwrt, which is around ~300 mbps.

Is that v2 as in >v1, or is there a v3+ that I don't want? That is, can I just buy from Amazon [0] with a fairly safe assumption that a new C7 is OK? [0]: https://www.amazon.co.uk/TP-Link-AC1750-Dualband-Zertifizier...

There are 5 versions at least. The specific HW version is easily identified by a sticker underneath the router.

Consult the openwrt table of hardware[1] for more details.

[1] https://openwrt.org/toh/tp-link/archer-c7-1750

Edit: eBay seems a lot better for this task - https://m.ebay.com/sch/i.html?_from=R40&_trksid=m4084.l1313&...

Re: A 100k Botnet Turns Home Routers to Email Spammers

#77
post #72
post #43

Earlier quoted context omitted.

This will depend on what kind of Internet connection you have, or expect to have in the future. Gigabit internet connections are becoming more common here in the US, and some lower powered devices just can't route packets faster than say 100-200 Mbit/s. I can tell you what I did, which may or may not be helpful to you. I got Linksys WRT AC3200[0]. The "AC3200" bit refers to a type of wifi 802.11ac configuration that…

Would you happen to know if the 25% cheaper 'gaming edition' is as good? Doesn't seem to have MU-MIMO, which from what you've said might be an easy saving: https://www.amazon.co.uk/Linksys-WRT32X-UK-AC3200-Dual-Band-...

Always check reference each hardware revision with the OpenWRT wiki, sometimes chipsets and radios will change between revisions.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#78

I must be missing something, but why are all these routers publicly listening on port 5431?

Ports 5431 and 1900 are used for UPnP.

I can’t think of any good reason they should be listening on an external interface, but maybe the port scanning is happening on the inside.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#79

Earlier quoted context omitted.

While I think this is a really good OpenWrt-router, with good value for money and easy installation... It is fair mentioning that this model is discontinued from TP-Link and you will probably have to buy it second hand. It also comes in at least 5 revisions, with various levels of support, making life a little bit more difficult for the average, uninformed buyer. As a side note: I have a 350mbps symmetrical FTTH link…

Do you know well this router runs Wireguard using OpenWRT?

I have no idea or knowledge about wireguard.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#80
post #55
post #43

Earlier quoted context omitted.

This will depend on what kind of Internet connection you have, or expect to have in the future. Gigabit internet connections are becoming more common here in the US, and some lower powered devices just can't route packets faster than say 100-200 Mbit/s. I can tell you what I did, which may or may not be helpful to you. I got Linksys WRT AC3200[0]. The "AC3200" bit refers to a type of wifi 802.11ac configuration that…

Do you happen to know the throughput when using PPPoE?

I think it's roughly the same. I mean PPPoE framing like adds 8 bytes per packet, but not much you can do about that. My pal has this router and CenturyLink gigabit, which uses PPPoE, and he manages to get around 930 Mbits/s across the WAN.
Post reply on HN