6 ms·

The Kimwolf botnet is stalking your local network

ConorSheehan1 9mo ago
Very interesting! A tutorial to check if kimwolf is running on your network would be nice
- nubinetwork 9mo ago
  Based on the article, try looking for android devices with adb running on the network.
  - thenthenthen 9mo ago
    This article[0] includes a link to a online checker: https://synthient.com/check https://synthient.com/check Have not tested it myself ymmv. [0] https://synthient.com/blog/a-broken-system-fueling-botnets https://synthient.com/blog/a-broken-system-fueling-botnets
    - nubinetwork 9mo ago
      It only references a database of publicly scanned IPs, it won't help you if the device is behind a nat router.
  - HappyPanacea 9mo ago
    Does someone know if the port must be 5555 for this botnet?
    - tgv 9mo ago
      It's the Android debugger port, and it's used for infection, but the article doesn't exclude other methods nor mentions ports used by the malware.
- pamcake 9mo ago
  Not exactly the answer but if you have one of the affected mentioned devices it should be listening on TCP port 5555. You can do a port scan for that. nmap -Pn 192.168.0.0/16 -p 5555 Replace netmask as appropriate. Now that it's publicly known I guess it's possible that they will close the door post-infection to avoid detecton. And it won't detect any other devices it's spread further to. If you have a cheapo Android-based TV box or stick like the ones mentioned, throw it out or reflash it with Armbian after forensics. I'm sure there are HN readers out there who have one of these. They were very popular a couple of years back.
- BloodyIron 9mo ago
  Well the first thing to check is, do you own and operate any of these janky Android "TV" boxes sold by companies nobody has heard of? If yes? Then there's probably your answer.
pamcake 9mo ago
This is wild. It must be crowded on these devices by now - it may be a bit misleading to think of it as a single botnet when there are multiple unrelated entities controlling the same devices via the same methods.
haburka 9mo ago
I love how frequently Botnet creators reference Krebs. Like they are his biggest fans, and they just want a shoutout on his blog.
BloodyIron 9mo ago
How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not because movies and shows are 99.9999% profit (spoiler: they aren't), it's because you're _paying_ to install a backdoor that will rip and tear everything on your network it can. You like having a credit card? That's precious, it's mine now. Look at me, I'm the network now.
- kadoban 9mo ago
  > it's because you're _paying_ to install a backdoor that will rip and tear everything on your network it can. I mean, maybe. More likely imo you're paying for the absolute cheapest hardware and fastest never-updated software someone could throw together and make _any_ profit on. Someone probably had 100k shitty little chips sitting in a warehouse and this was a way to do something with them. The outcome is really the same, it's just the steps to get there are more human nature.
  - BloodyIron 9mo ago
    At a price tag of $5/ea the cost of just advertising and distribution exceeds the cost of the product itself. There is zero room for profit. The business model is installing back doors to the "clients" and stealing money, information, and anything else from them. Consider that even the cost of the included remote is a huge part of the actual hardware cost, and nobody is going to buy something like this without a remote.
  - kube-system 9mo ago
    Even many TVs with "reputable" western brand names, on the shelf at major US retailers, are often sold at a loss on the hardware and the difference is made up by collecting advertising data. https://www.broadbandtvnews.com/2024/11/18/tv-companies-selling-sets-at-a-loss-for-advertising-rewards https://www.broadbandtvnews.com/2024/11/18/tv-companies-sell... > you just have to look at the finances of Vizio or Roku to see they’re selling TVs at somewhere between -3 and -7% margin
polishdude20 9mo ago
So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?
- kadoban 9mo ago
  In most shitty routers: no. They don't even have raw ability to do that. You can look around for something like device isolation, but I doubt you'll find it unless you go a couple of steps up from whatever router ISPs ~give away these days.
  - 0xR1CK 9mo ago
    My ISP's router has isolation. Has had for 5+ years. Main SSID has it off so we can do LAN stuff. Guest SSID is used for IoT things and isolation turned off. Handy.
    - olyjohn 9mo ago
      What exactly does it isolate? An SSID? IP addresses? individual MAC addresses? How does this stop a pre-infected device you purchased from shitting traffic out of your network, acting as a residential proxy or try to own your other IoT devices?
      - kadoban 9mo ago
        The one I've seen on ~basic consumer routers just disallows wifi devices from talking to each other at all, it won't route between them. I usually need something more nuanced personally, but it's not a bad start at all.
- aspbee555 9mo ago
  usually lan devices do not talk to the router unless they need a resource outside your lan network you can however isolate with vlans and a vlan capable switch, then it would be on the router to isolate traffic between lans (I do exactly this for my less trusted virtual machines)
Nextgrid 9mo ago
> to relay malicious and abusive Internet traffic — such as ad fraud, account takeover attempts and mass content scraping Oh no, let me get my tiny violin! Really hard to feel bad here. For most home users (that don’t expose anything sensitive on their LAN) these boxes are not a threat, seem to be doing a useful service in providing a superior streaming service that the balkanized official ones, and also shits on internet spammers/advertisers and frees up loginwalled content - sounds like a pretty good box really.
- hedora 9mo ago
  I’d be nice to control where the money and content go. If I could, I’d strongly consider firing up an old raspberry pi or two. Also, is there a better word than ad fraud? It needs an innocuous sounding euphemism like pretty much everything else involving that industry has. “Monetizing ad display”? “User-agent driven conversions?”
  - cryzinger 9mo ago
    The actual industry lingo is "invalid traffic" :P
- crtasm 9mo ago
  Until all their accounts get pwned due to credential stuffing over this or a similar botnet - being the average person with weak, reused passwords?
  - Nextgrid 9mo ago
    The majority of accounts out there don't have anything of value. If it gets pwned the person just resets their password and calls it a day (in fact due to the lack of password manager their usual workflow is to reset the password anyway on each login since they never remember whatever variation of their shitty weak password they used).
- themafia 9mo ago
  > sounds like a pretty good box really. You can buy a better one that does not have malware installed. So these are complete and total garbage and no sane person should run them under any circumstance. Sounds like you have a bias which has prevented you from thinking about this clearly.
cogman10 9mo ago
How hard would it be to grab one of these little virus boxes and flash it with linux?
- CryptoBanker 9mo ago
  Well then you just have a very overpriced, extremely low power linux box that doesn't do what you want it to do
yjftsjthsd-h 9mo ago
> However, shipping these devices with ADB turned on creates a security nightmare because in this state they constantly listen for and accept unauthenticated connection requests. I'm confused. I intentionally use ADB over the network sometimes, and I have to explicitly interactively allow each adb client by its key. Are they shipping boxes with adb configured to just allow any connection without any verification?
bix6 9mo ago
I know this may seem trivial for many here but how can regular people easily check and debug their network for stuff like this?
- tennysont 9mo ago
  Regular people don't need a "secure network". Phones and computers are, by default, secure against malicious networks. Just don't run code you download from the internet or put your passwords to important accounts into cheap devices and you'll be fine. Normally people don't the the former, but sometimes do the latter. edit: To be clear: the bitterness in this comment comes from how many developers assume loopback is secure. However, most website are allowed to send requests to local ports on your computer (IIRC) so that assumption is basically completely false. This is forgivable, except in a world where every developer runs tons of extensions/scripts/open-source apps, and have next-to-zero blast-radius-reduction methods, it makes me sad.
  - thot_experiment 9mo ago
    Sure they can send requests but they can't receive them unless you've got misconfigured CORS. I guess there's DNS rebinding but like, idk, attack surface seems pretty small. This sort of stuff isn't really worth worrying about unless you're an idiot or likely to be the victim of a targeted attack. I happily run code off the internet all the time and it seems fine. If there's one thing that really seems like a mind virus it's the paranoia all security people get, I can't imagine living life like that. I'm ok getting pwned every few decades if the tradeoff is never worrying about this shit. Maybe I've just gotten lucky? (i will say putting a device not running open source software/firmware or something very locked down like a phone on your LAN is insanity, i could never)
    - tennysont 8mo ago
      So, purely for example: When you run VS Code, it spins up a local language server that is capable of making code changes. That is how refactoring python works in many editors (including VS Code). A website that you're browsing could potentially send requests to this server asking for code to be inserted that fully compromises your device. What keeps us safe? - maybe the website is only allowed to send GET requests, not PUT requests, and maybe the language servers that you're using are all "hardened" so that they will never permit mutations via any get requests, and never have a misconfigured CORS header - the website has to guess the correct port and the correct language server with a known vulnerability - any website doing this on a large scale would likely get the language server patched and the website on a block list - there might be other safeguards that I'm not familiar with. For example, I believe that Chrome disallows this by default So now, here's my frustration: these two statements seem hugely at odds with each other: > I'm ok getting pwned every few decades if the tradeoff is never worrying about this shit. > (i will say putting a device not running open source software/firmware or something very locked down like a phone on your LAN is insanity, i could never) I'm ok with a person who makes either statement. I'm also ok with a person who makes the first statement, and also wants their LAN locked down. However, I do not feel as though the a LAN ever needs to be locked down unless a person in running a server on the LAN network. Personal devices (like laptops and phones) are plenty capable of resisting malicious networks by default (coffee shops, university wifi, etc). What else is on a LAN? > mind virus it's the paranoia all security people get I generally agree with you, but I feel as though I am the one who has accepted that personal laptops need to handle malicious networks, and I'm generally comfortable with that. I don't worry too much about putting IoT devices on the same network as my personal laptop, nor about connecting to coffee shop wifis.
tennysont 9mo ago
I couldn't really follow the technical details of the malware from the article, so I found what seems to be the first major report on the topic: https://blog.xlab.qianxin.com/kimwolf-botnet-en/#network-protocol https://blog.xlab.qianxin.com/kimwolf-botnet-en/#network-pro... That article has a more technical lens. It focuses primarily on the size and detection evasion methods of Kimwolf, rather than some notable (and definitely not unique) method of spreading. Without looking too deeply, I'm going to assume that this is a successful botnet because it managed to get into product supply lines at big box stores and in app store games, rather than some clever virus that is spreading across the world. I hope someone will correct me if I am mistaken!
- VladVladikoff 9mo ago
  What’s the deal with that seemingly random address written out as a domain name? Brian krebb’s home address? 14 emelia terrace west roxbury ma 02132 . su As for your assumption the OP talks about how it uses residential proxies to get into lans, I don’t think it is a supply chain attack.
  - WorldMaker 9mo ago
    Krebs redacted the one that was his own home address. Certainly someone's home address: https://www.zillow.com/homedetails/14-Emelia-Ter-West-Roxbury-MA-02132/59155338_zpid/?oem=b_rent https://www.zillow.com/homedetails/14-Emelia-Ter-West-Roxbur...

Very interesting! A tutorial to check if kimwolf is running on your network would be nice

nubinetwork 9mo ago
Based on the article, try looking for android devices with adb running on the network.
- thenthenthen 9mo ago
  This article[0] includes a link to a online checker: https://synthient.com/check https://synthient.com/check Have not tested it myself ymmv. [0] https://synthient.com/blog/a-broken-system-fueling-botnets https://synthient.com/blog/a-broken-system-fueling-botnets
  - nubinetwork 9mo ago
    It only references a database of publicly scanned IPs, it won't help you if the device is behind a nat router.
- HappyPanacea 9mo ago
  Does someone know if the port must be 5555 for this botnet?
  - tgv 9mo ago
    It's the Android debugger port, and it's used for infection, but the article doesn't exclude other methods nor mentions ports used by the malware.
pamcake 9mo ago
Not exactly the answer but if you have one of the affected mentioned devices it should be listening on TCP port 5555. You can do a port scan for that. nmap -Pn 192.168.0.0/16 -p 5555 Replace netmask as appropriate. Now that it's publicly known I guess it's possible that they will close the door post-infection to avoid detecton. And it won't detect any other devices it's spread further to. If you have a cheapo Android-based TV box or stick like the ones mentioned, throw it out or reflash it with Armbian after forensics. I'm sure there are HN readers out there who have one of these. They were very popular a couple of years back.
BloodyIron 9mo ago
Well the first thing to check is, do you own and operate any of these janky Android "TV" boxes sold by companies nobody has heard of? If yes? Then there's probably your answer.

This is wild. It must be crowded on these devices by now - it may be a bit misleading to think of it as a single botnet when there are multiple unrelated entities controlling the same devices via the same methods.

haburka 9mo ago

I love how frequently Botnet creators reference Krebs. Like they are his biggest fans, and they just want a shoutout on his blog.

BloodyIron 9mo ago

How is it not obvious to everyone reading HN that janky Android "TV" boxes (like the article references) are a by-default threat? Like seriously, many of them are sold for stupid cheap prices like $5/ea. Or advertise unlimited movies/shows/etc for similarly unbelievable prices. Putting aside the copyright infringement aspect of it, to me it's extremely obvious "wait... _why_ am I paying so little here?". No, it's not because movies and shows are 99.9999% profit (spoiler: they aren't), it's because you're _paying_ to install a backdoor that will rip and tear everything on your network it can. You like having a credit card? That's precious, it's mine now. Look at me, I'm the network now.

kadoban 9mo ago
> it's because you're _paying_ to install a backdoor that will rip and tear everything on your network it can. I mean, maybe. More likely imo you're paying for the absolute cheapest hardware and fastest never-updated software someone could throw together and make _any_ profit on. Someone probably had 100k shitty little chips sitting in a warehouse and this was a way to do something with them. The outcome is really the same, it's just the steps to get there are more human nature.
- BloodyIron 9mo ago
  At a price tag of $5/ea the cost of just advertising and distribution exceeds the cost of the product itself. There is zero room for profit. The business model is installing back doors to the "clients" and stealing money, information, and anything else from them. Consider that even the cost of the included remote is a huge part of the actual hardware cost, and nobody is going to buy something like this without a remote.
- kube-system 9mo ago
  Even many TVs with "reputable" western brand names, on the shelf at major US retailers, are often sold at a loss on the hardware and the difference is made up by collecting advertising data. https://www.broadbandtvnews.com/2024/11/18/tv-companies-selling-sets-at-a-loss-for-advertising-rewards https://www.broadbandtvnews.com/2024/11/18/tv-companies-sell... > you just have to look at the finances of Vizio or Roku to see they’re selling TVs at somewhere between -3 and -7% margin

polishdude20 9mo ago

So is there some catch all setting I can enable in my router to prevent my devices talking to eachother on the local network?

kadoban 9mo ago
In most shitty routers: no. They don't even have raw ability to do that. You can look around for something like device isolation, but I doubt you'll find it unless you go a couple of steps up from whatever router ISPs ~give away these days.
- 0xR1CK 9mo ago
  My ISP's router has isolation. Has had for 5+ years. Main SSID has it off so we can do LAN stuff. Guest SSID is used for IoT things and isolation turned off. Handy.
  - olyjohn 9mo ago
    What exactly does it isolate? An SSID? IP addresses? individual MAC addresses? How does this stop a pre-infected device you purchased from shitting traffic out of your network, acting as a residential proxy or try to own your other IoT devices?
    - kadoban 9mo ago
      The one I've seen on ~basic consumer routers just disallows wifi devices from talking to each other at all, it won't route between them. I usually need something more nuanced personally, but it's not a bad start at all.
aspbee555 9mo ago
usually lan devices do not talk to the router unless they need a resource outside your lan network you can however isolate with vlans and a vlan capable switch, then it would be on the router to isolate traffic between lans (I do exactly this for my less trusted virtual machines)

Nextgrid 9mo ago

> to relay malicious and abusive Internet traffic — such as ad fraud, account takeover attempts and mass content scraping Oh no, let me get my tiny violin! Really hard to feel bad here. For most home users (that don’t expose anything sensitive on their LAN) these boxes are not a threat, seem to be doing a useful service in providing a superior streaming service that the balkanized official ones, and also shits on internet spammers/advertisers and frees up loginwalled content - sounds like a pretty good box really.

hedora 9mo ago
I’d be nice to control where the money and content go. If I could, I’d strongly consider firing up an old raspberry pi or two. Also, is there a better word than ad fraud? It needs an innocuous sounding euphemism like pretty much everything else involving that industry has. “Monetizing ad display”? “User-agent driven conversions?”
- cryzinger 9mo ago
  The actual industry lingo is "invalid traffic" :P
crtasm 9mo ago
Until all their accounts get pwned due to credential stuffing over this or a similar botnet - being the average person with weak, reused passwords?
- Nextgrid 9mo ago
  The majority of accounts out there don't have anything of value. If it gets pwned the person just resets their password and calls it a day (in fact due to the lack of password manager their usual workflow is to reset the password anyway on each login since they never remember whatever variation of their shitty weak password they used).
themafia 9mo ago
> sounds like a pretty good box really. You can buy a better one that does not have malware installed. So these are complete and total garbage and no sane person should run them under any circumstance. Sounds like you have a bias which has prevented you from thinking about this clearly.

cogman10 9mo ago

How hard would it be to grab one of these little virus boxes and flash it with linux?

CryptoBanker 9mo ago
Well then you just have a very overpriced, extremely low power linux box that doesn't do what you want it to do

yjftsjthsd-h 9mo ago

> However, shipping these devices with ADB turned on creates a security nightmare because in this state they constantly listen for and accept unauthenticated connection requests. I'm confused. I intentionally use ADB over the network sometimes, and I have to explicitly interactively allow each adb client by its key. Are they shipping boxes with adb configured to just allow any connection without any verification?

bix6 9mo ago

I know this may seem trivial for many here but how can regular people easily check and debug their network for stuff like this?

tennysont 9mo ago
Regular people don't need a "secure network". Phones and computers are, by default, secure against malicious networks. Just don't run code you download from the internet or put your passwords to important accounts into cheap devices and you'll be fine. Normally people don't the the former, but sometimes do the latter. edit: To be clear: the bitterness in this comment comes from how many developers assume loopback is secure. However, most website are allowed to send requests to local ports on your computer (IIRC) so that assumption is basically completely false. This is forgivable, except in a world where every developer runs tons of extensions/scripts/open-source apps, and have next-to-zero blast-radius-reduction methods, it makes me sad.
- thot_experiment 9mo ago
  Sure they can send requests but they can't receive them unless you've got misconfigured CORS. I guess there's DNS rebinding but like, idk, attack surface seems pretty small. This sort of stuff isn't really worth worrying about unless you're an idiot or likely to be the victim of a targeted attack. I happily run code off the internet all the time and it seems fine. If there's one thing that really seems like a mind virus it's the paranoia all security people get, I can't imagine living life like that. I'm ok getting pwned every few decades if the tradeoff is never worrying about this shit. Maybe I've just gotten lucky? (i will say putting a device not running open source software/firmware or something very locked down like a phone on your LAN is insanity, i could never)
  - tennysont 8mo ago
    So, purely for example: When you run VS Code, it spins up a local language server that is capable of making code changes. That is how refactoring python works in many editors (including VS Code). A website that you're browsing could potentially send requests to this server asking for code to be inserted that fully compromises your device. What keeps us safe? - maybe the website is only allowed to send GET requests, not PUT requests, and maybe the language servers that you're using are all "hardened" so that they will never permit mutations via any get requests, and never have a misconfigured CORS header - the website has to guess the correct port and the correct language server with a known vulnerability - any website doing this on a large scale would likely get the language server patched and the website on a block list - there might be other safeguards that I'm not familiar with. For example, I believe that Chrome disallows this by default So now, here's my frustration: these two statements seem hugely at odds with each other: > I'm ok getting pwned every few decades if the tradeoff is never worrying about this shit. > (i will say putting a device not running open source software/firmware or something very locked down like a phone on your LAN is insanity, i could never) I'm ok with a person who makes either statement. I'm also ok with a person who makes the first statement, and also wants their LAN locked down. However, I do not feel as though the a LAN ever needs to be locked down unless a person in running a server on the LAN network. Personal devices (like laptops and phones) are plenty capable of resisting malicious networks by default (coffee shops, university wifi, etc). What else is on a LAN? > mind virus it's the paranoia all security people get I generally agree with you, but I feel as though I am the one who has accepted that personal laptops need to handle malicious networks, and I'm generally comfortable with that. I don't worry too much about putting IoT devices on the same network as my personal laptop, nor about connecting to coffee shop wifis.

tennysont 9mo ago

I couldn't really follow the technical details of the malware from the article, so I found what seems to be the first major report on the topic: https://blog.xlab.qianxin.com/kimwolf-botnet-en/#network-protocol https://blog.xlab.qianxin.com/kimwolf-botnet-en/#network-pro... That article has a more technical lens. It focuses primarily on the size and detection evasion methods of Kimwolf, rather than some notable (and definitely not unique) method of spreading. Without looking too deeply, I'm going to assume that this is a successful botnet because it managed to get into product supply lines at big box stores and in app store games, rather than some clever virus that is spreading across the world. I hope someone will correct me if I am mistaken!

VladVladikoff 9mo ago
What’s the deal with that seemingly random address written out as a domain name? Brian krebb’s home address? 14 emelia terrace west roxbury ma 02132 . su As for your assumption the OP talks about how it uses residential proxies to get into lans, I don’t think it is a supply chain attack.
- WorldMaker 9mo ago
  Krebs redacted the one that was his own home address. Certainly someone's home address: https://www.zillow.com/homedetails/14-Emelia-Ter-West-Roxbury-MA-02132/59155338_zpid/?oem=b_rent https://www.zillow.com/homedetails/14-Emelia-Ter-West-Roxbur...