5 ms·
Isn't this because of the kimwolf (and now 6+ other botnets) that are taking advantage of people running residential proxyware unknowingly on the device which p
by pigggg 2mo ago
Isn't this because of the kimwolf (and now 6+ other botnets) that are taking advantage of people running residential proxyware unknowingly on the device which permits outbound connections to 127.0.0.1 on tcp/5555 to auth in and exec wgets or drops a loader that grabs the ddos malware APKs and install it?
- xg15 2mo agoHadn't thought about that additional attack vector those proxies are enabling. In addition to "internet access from residental connection" privileges, the attacker also gets access to loopback on the device that does the proxying... But even then, shouldn't this show the same permission prompt for the user that anything else trying to connect to port 5555 would?
- londons_explore 2mo agoYes, but users are told to allow it if they want to get free coins etc.
- xg15 2mo agoTold by whom though? If it's through proxyware, then there are three parties who mostly don't know each other: - the app embedding the proxyware SDK for money - the proxy operators - the attackers/botnets using the proxy to access ADB. The botnet has no access to the app, so it can't show any messages. The app can show messages, but probably has no connection to the botnet. (I hope) The proxy operators could show a message by abusing the SDK even more, but that would mean they actively colluded with the botnet. Is that likely? Then they could just give the botnet direct access to the app, no need to do the whole proxy thing.
- londons_explore 2mo agoIt isn't being done behind-the-back of proxy operators. It's one more revenue stream to be able to remote control real android phones to pass device attestation checks etc. It's marketed to users with phrases like "earn money from your phone whilst you sleep".
- TeMPOraL 2mo agoYou can't fully protect people from the risk of taking bad advice from malicious strangers. Not the least because most of our industry relies on it to make money. Marketing and advertising themselves are institutionalized forms of "do this thing that's actually harmful to you to get free coins / be safe / get laid".
- xg15 2mo ago> Not the least because most of our industry relies on it to make money. I mean, this seems more like one of the root causes for a lot of bad things in the industry me...
- crote 2mo agoIt seems to require the user to: 1. Enable Developer Mode by going to an obscure settings page and tapping the build number seven times 2. Enable USB ADB debugging in the Developer Options 3. Establish an actual USB ADB session 4. Enable TCP/IP ADB debugging in the Developer Options 5. Unknowingly download a malware app from the official Play Store 6. Blindly click "Yes" on the permission prompt. In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it. And it only works if the Play Store is useless at preventing malware in the first place - but I thought their excellent app scanning was the entire reasoning behind all-but-banning 3rd-party app stores and sideloading??? It is "for safety" in the same sense that governments banning all encryption is to "protect the children" or to "prevent terrorism": flawed justification invented to distract from the real reason they want it.
- II2II 2mo ago> In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it. Have you ever worked with someone who barely knows how to use a mobile phone? They will hand their phone over to someone they barely even know to do something they don't understand. They will follow instructions from a stranger over the phone, without understanding what the phone is warning them about. I have worked with such a person. They did have someone walk them through a dubious process. Thankfully they realized what was going on before the process was complete, but who knows how much damage was done by the initial steps. There are legitimate security reasons here. Whether there are reasons beyond that is an open question.
- g-b-r 2mo agoCan we freaking sell them dumbphones, then, and stop destroying portable computers for everyone else with that excuse? Which incidentally is often just a pretense for other motives? If computers have suddenly become so dangerous for normal people, and they want smartphones nonetheless, add to them a dumb-mode encouraged at the initial setup, and requiring some third party assistance to turn it off once enabled..! (and forbid apps to change their behavior if it's not enabled)
- franga2000 2mo agoYou haven't been able to connect to an android device on port 5555 for yeeears. Every time you enable adb/IP it generates a new random port, or you need to use the QR/PIN pairing thing. On top of needing to enable developer options, adb/IP, confirm the fingerprint.
- pigggg 2mo agoMillions of Superboxes and various digital picture frames say different. https://synthient.com/blog/a-broken-system-fueling-botnets https://synthient.com/blog/a-broken-system-fueling-botnets
- microtonal 2mo agoKimwolf exploits vulnerable Android Debug Bridge (ADB) services. Many low-cost TV boxes come "pre-infected" with proxy SDKs; Kimwolf then scans these residential proxy networks and exploits the devices within minutes as it propagates. https://www.cloudflare.com/learning/ddos/glossary/aisuru-kimwolf-botnet/ https://www.cloudflare.com/learning/ddos/glossary/aisuru-kim... This is like saying that SSH is insecure because some device vendors install SSH, permitting root login with a default password of 'root'.
- BiteCode_dev 2mo agoYeah let's block port 80, too many people expose unprotected api.
- ValdikSS 2mo agoThis is what several cellular ISP to (block ports <1024 and 5555) to protect the users on IPv6. You can unlock it with additional free option.
- franga2000 2mo agoWell yes, but those won't get Google's new updates either. Open ADB on 5555 was a problem we solved almost a decade ago and these devices are still vulnerable. Even further restricting ADB in the latest version won't do anything to prevent that.
- jambalaya8 2mo agoThere are so many people in my neighborhood here that are actively members of residential proxy networks that it makes me stabby. They don't seem to care. That said, I wasn't under the impression kimwolf was that technically sophisticated. Some of the others are, though.
- kitsumed 2mo agoFrom memory, for the kimwolf exploit things, other user already had good points about the device already beeing compromised. But also, the authentification part of ADB was just completly disabled, which is why this worked. Basically it was so-compromised as-is that ADB was just sitting here open, as is you where to put SSH with no authentification at all.