The Kimwolf botnet is stalking your local network
krebsonsecurity.com
The Kimwolf botnet is stalking your local network
1–10 of 59 posts
Re: The Kimwolf botnet is stalking your local network
#2Very interesting! A tutorial to check if kimwolf is running on your network would be nice
Re: The Kimwolf botnet is stalking your local network
#3Very interesting! A tutorial to check if kimwolf is running on your network would be nice
Based on the article, try looking for android devices with adb running on the network.
Re: The Kimwolf botnet is stalking your local network
#4Very interesting! A tutorial to check if kimwolf is running on your network would be nice
Based on the article, try looking for android devices with adb running on the network.
This article[0] includes a link to a online checker: https://synthient.com/check
Have not tested it myself ymmv.
[0] https://synthient.com/blog/a-broken-system-fueling-botnets
Re: The Kimwolf botnet is stalking your local network
#5Earlier quoted context omitted.
Based on the article, try looking for android devices with adb running on the network.
This article[0] includes a link to a online checker: https://synthient.com/check Have not tested it myself ymmv. [0] https://synthient.com/blog/a-broken-system-fueling-botnets
It only references a database of publicly scanned IPs, it won't help you if the device is behind a nat router.
Re: The Kimwolf botnet is stalking your local network
#6Re: The Kimwolf botnet is stalking your local network
#7Very interesting! A tutorial to check if kimwolf is running on your network would be nice
Not exactly the answer but if you have one of the affected mentioned devices it should be listening on TCP port 5555. You can do a port scan for that.
nmap -Pn 192.168.0.0/16 -p 5555
Now that it's publicly known I guess it's possible that they will close the door post-infection to avoid detecton. And it won't detect any other devices it's spread further to.
If you have a cheapo Android-based TV box or stick like the ones mentioned, throw it out or reflash it with Armbian after forensics.
I'm sure there are HN readers out there who have one of these. They were very popular a couple of years back.
Re: The Kimwolf botnet is stalking your local network
#8This is wild.
It must be crowded on these devices by now - it may be a bit misleading to think of it as a single botnet when there are multiple unrelated entities controlling the same devices via the same methods.
Re: The Kimwolf botnet is stalking your local network
#9Earlier quoted context omitted.
Based on the article, try looking for android devices with adb running on the network.
Does someone know if the port must be 5555 for this botnet?
It's the Android debugger port, and it's used for infection, but the article doesn't exclude other methods nor mentions ports used by the malware.
Re: The Kimwolf botnet is stalking your local network
#10I love how frequently Botnet creators reference Krebs. Like they are his biggest fans, and they just want a shoutout on his blog.