41 ms·

I recently discovered a similar concerning security issue with my KVM. In my case it was a pretty standard KVM for multiple machines to share a keyboard, mouse,

I recently discovered a similar concerning security issue with my KVM. In my case it was a pretty standard KVM for multiple machines to share a keyboard, mouse, and screen but also Ethernet. One day while looking at my home network I noticed the KVM had its own IP and was transferring GBs of data everyday. I quickly blocked it from my network. But having used it for a number of months I worried that with screen capture and access to all my input devices, someone could have gotten access to pretty much everything I use. I wasn’t able to figure out if any data was actually being sent off my network and I really didn’t want to put myself in any more risk so I just threw it in an electronics recycling bin. Pretty scary what a network connected KVM could maliciously do.

Renaud 10mo ago
Shame you threw it away. It would have been useful to collect the traffic with Wireshark and share that with info about the device in a post or a blog for others to investigate and be warned about that brand and model.
stragies 10mo ago
Why did you not just login to the device, and switched off "Broadcast to multicast", or changed the destination address? Edit: Some brands of Network-KVM use this, so that you can control the target device from another device, like e.g. an App on a tablet. That way you don't have to stand next to the target device in the noisy and cold machine room
- jlward4th 10mo ago
  The KVM didn't have any documentation on anything related to its network interface. I ran a port scan on it but didn't know if there was a way to log into it.
  - deleted 10mo ago
    [deleted]
  - simoncion 10mo ago
    > The KVM didn't have any documentation on anything related to its network interface. My research disagrees. See [0] [0] <https://news.ycombinator.com/item?id=46177462 https://news.ycombinator.com/item?id=46177462>
CoastalCoder 10mo ago
Is it possible for you to name the KVM model? It sounds like a potential risk is to the public.
- jlward4th 10mo ago
  It is this one: https://www.amazon.com/dp/B0CP4PD3SM https://www.amazon.com/dp/B0CP4PD3SM I did post a review there citing my security concerns. Honestly I didn't go further with the investigation because if someone really has all my data, I'm worried about retribution.
  - stragies 10mo ago
    Was the network port bridged to both PCs all the time (as the description makes it sound, or did only the "active" PC get a functioning network connection? Could you tell from the FDB of the upstream device, if there were more than two MAC addresses active on the port? Did you (hopefully) open it up and make PCB pictures before chucking it?
    - jlward4th 10mo ago
      The network was active for both machines connected to it. And it had its own IP. So 3 MAC addresses in total. I didn't ever open it up. But maybe someone will be interested in buying one and exploring more.
    - simoncion 10mo ago
      This picture from the list of product pictures [0] indicates that the thing acts as an Ethernet bridge. It probably exposes itself as a USB-C gigabit Ethernet device to the machine it's plugged into. Page four of TFM [1] supports this theory. Also, this functionality is called out in the product listing and in the manual. I'm over here laughing my ass off because OP got so frightened by this clearly-documented feature that they immediately threw the thing in the trash, rather than first investigating to see if the source of the network traffic was the machines plugged into the device. [0] <https://m.media-amazon.com/images/I/71GglDmzCYL._SL1500_.jpg https://m.media-amazon.com/images/I/71GglDmzCYL._SL1500_.jpg> (If this direct link fails, it's the image that has the header "A Stable Gigabit Ethernet Port". [1] <https://avaccess.com/wp-content/uploads/2024/01/UM-_-iDock-C20-KVM-Switch-Docking-Station-V1.0.1.pdf https://avaccess.com/wp-content/uploads/2024/01/UM-_-iDock-C...> (This is the "DOWNLOAD USER MANUAL" link in the Downloads subsection of the More Information section of [2]) [2] <https://www.avaccess.com/products/idock-c20-kvm-switch-docking-station/ https://www.avaccess.com/products/idock-c20-kvm-switch-docki...>

Renaud 10mo ago

Shame you threw it away. It would have been useful to collect the traffic with Wireshark and share that with info about the device in a post or a blog for others to investigate and be warned about that brand and model.

stragies 10mo ago

Why did you not just login to the device, and switched off "Broadcast to multicast", or changed the destination address? Edit: Some brands of Network-KVM use this, so that you can control the target device from another device, like e.g. an App on a tablet. That way you don't have to stand next to the target device in the noisy and cold machine room

jlward4th 10mo ago
The KVM didn't have any documentation on anything related to its network interface. I ran a port scan on it but didn't know if there was a way to log into it.
- deleted 10mo ago
  [deleted]
- simoncion 10mo ago
  > The KVM didn't have any documentation on anything related to its network interface. My research disagrees. See [0] [0] <https://news.ycombinator.com/item?id=46177462 https://news.ycombinator.com/item?id=46177462>

CoastalCoder 10mo ago

Is it possible for you to name the KVM model? It sounds like a potential risk is to the public.

jlward4th 10mo ago
It is this one: https://www.amazon.com/dp/B0CP4PD3SM https://www.amazon.com/dp/B0CP4PD3SM I did post a review there citing my security concerns. Honestly I didn't go further with the investigation because if someone really has all my data, I'm worried about retribution.
- stragies 10mo ago
  Was the network port bridged to both PCs all the time (as the description makes it sound, or did only the "active" PC get a functioning network connection? Could you tell from the FDB of the upstream device, if there were more than two MAC addresses active on the port? Did you (hopefully) open it up and make PCB pictures before chucking it?
  - jlward4th 10mo ago
    The network was active for both machines connected to it. And it had its own IP. So 3 MAC addresses in total. I didn't ever open it up. But maybe someone will be interested in buying one and exploring more.
  - simoncion 10mo ago
    This picture from the list of product pictures [0] indicates that the thing acts as an Ethernet bridge. It probably exposes itself as a USB-C gigabit Ethernet device to the machine it's plugged into. Page four of TFM [1] supports this theory. Also, this functionality is called out in the product listing and in the manual. I'm over here laughing my ass off because OP got so frightened by this clearly-documented feature that they immediately threw the thing in the trash, rather than first investigating to see if the source of the network traffic was the machines plugged into the device. [0] <https://m.media-amazon.com/images/I/71GglDmzCYL._SL1500_.jpg https://m.media-amazon.com/images/I/71GglDmzCYL._SL1500_.jpg> (If this direct link fails, it's the image that has the header "A Stable Gigabit Ethernet Port". [1] <https://avaccess.com/wp-content/uploads/2024/01/UM-_-iDock-C20-KVM-Switch-Docking-Station-V1.0.1.pdf https://avaccess.com/wp-content/uploads/2024/01/UM-_-iDock-C...> (This is the "DOWNLOAD USER MANUAL" link in the Downloads subsection of the More Information section of [2]) [2] <https://www.avaccess.com/products/idock-c20-kvm-switch-docking-station/ https://www.avaccess.com/products/idock-c20-kvm-switch-docki...>