Some implications from the research in today's story:

"Consider the following scenario, in which the mere act of allowing someone to use your Wi-Fi network could lead to a Kimwolf botnet infection. In this example, a friend or family member comes to stay with you for a few days, and you grant them access to your Wi-Fi without knowing that their mobile phone is infected with an app that turns the device into a residential proxy node. At that point, your home’s public IP address will show up for rent at the website of some residential proxy provider."

"Miscreants like those behind Kimwolf then use residential proxy services online to access that proxy node on your IP, tunnel back through it and into your local area network (LAN), and automatically scan the internal network for devices with Android Debug Bridge mode turned on."

"By the time your guest has packed up their things, said their goodbyes and disconnected from your Wi-Fi, you now have two devices on your local network — a digital photo frame and an unsanctioned Android TV box — that are infected with Kimwolf. You may have never intended for these devices to be exposed to the larger Internet, and yet there you are."

"Here’s another possible nightmare scenario: Attackers use their access to proxy networks to modify your Internet router’s settings so that it relies on malicious DNS servers controlled by the attackers — allowing them to control where your Web browser goes when it requests a website. Think that’s far-fetched? Recall the DNSChanger malware from 2012 that infected more than a half-million routers with search-hijacking malware, and ultimately spawned an entire security industry working group focused on containing and eradicating it."

@briankrebs This is one of the reasons I keep all the IoT/customer surveillance devices on their own network and block access from that network to other internal spaces It's not a perfect and doesn't prevent that network from becoming a cesspool, but at least it isolates the blast radius.

I do periodic checks of the outbound traffic from that network looking for suspicious activity but it's tough given how chatty even legitimate boxes are.

#Security

@briankrebs

Excellent read, thank you!

@briankrebs

I await part II. Will be interesting.

@briankrebs

Perhaps a stupid question…

How much does this rely on the internal network being 192.168.0.x?

(I could not tell from the article as to whether that was an example… or specifically how it worked)

@briankrebs good piece on the kimwolf botnet, but i disagree with the solutions (buy name brands, check Synthient for compromise, use guest wifi). these treat symptoms, not causes. there will inevitably be another kimwolf botnet b/c of industry malpractice

the issue is lack of regulation and audits for hw/sw + anti-circumvention laws that block independent shops from flashing custom fw: https://media.ccc.de/v/39c3-a-post-american-enshittification-resistant-internet

projs like pmOS, lineageos, and mobian help users reclaim control of their hw

@briankrebs whenever I do network threat modelling, lateral movement has been on the top spot for a long time for me. Whenever I consult IT departments I always tell them:

Always assume your whole network being totally exposed to the Internet, that there are no edge firewalls to filter traffic. If you design your network to be resilient under that assumption, you're 90% there.

@briankrebs
The only things here on LAN are PCs (mostly Linux), Tablets and Phones. Android is an issue, as are apps.
No BD player, home theatre or TV gets a WiFI password or cable. Google & Vendors not trustworthy on Privacy, apart from security issues.
Also simply won't buy gadget / device that needs Internet to work, like doorbell, security, heating, etc.

Why do Routers have a uPNP at all? It's evil. No router ever deployed on default settings.

@briankrebs
A lot of the streaming boxes and sticks are deliberately evil. Some stupidity. The Streaming services are not good on privacy.

Sat TV boxes and Projector have no WiFi password.

The Nintendo Switch and Steamdeck have WiFi.

Router is Fritz!box with even ISP and vendor access disabled.