Hacker News Reader

Comment by supriyo-biswas | Hacker News Reader

The Trend Micro report[1] (linked in TFA) and the paper on residential proxies[2] mentioning hijacked IoT devices makes me wonder whether the people shouting on HN and elsewhere about Cloudflare blocking their internet access are actually victims of a similarly malicious IoT device operating on their network.

[1] https://www.trendmicro.com/en_us/research/23/e/lemon-group-c...

[2] http://staff.ustc.edu.cn/~xmi/files/resi_paper.pdf

View on HN

I've worked as tech support and I was surprised how difficult it was for people to find the infected device on their network. Many people don't even seem to think of their phones or tablets as things that can be infected, let alone their IoT smart cameras/temperature hubs/solar panels.

That goes for iPhones too. At some point a customer had managed to get their iPhone infected but they absolutely refused to believe me. I was able to log into their router and verify the source of the malware on their WiFi through a packet dump, but they still refused to believe a device made by Apple could get infected with malware.

Often, we'd take the customer's word for it that they scanned all their devices, remove them from the quarantine list, only to get back into quarantine a week later. After a few back and forths they'd switch ISPs and no longer were our problem.

This is also why I take all of those "Cloudflare is blocking me for no reason at all!" posts with a grain of salt. For sure, those behind a CGNAT ISP will become false positives, but the mere idea that something on their network can be causing problems seems to be taken as a personal insult rather than a reason to start hunting down malware. I also have my suspicions a decent amount of people on here could've made the list by running scrapers at home (I certainly have) or installing shady browser extension VPNs (I have!) but those require action from people themselves so that's hard to prove.

I think it's because people treat the news of an infection of their network the same way they do when learning they have an STI.

Deny and it can't be your fault.

Did you ever identify the iOS malware?

I wonder if it was a misbehaving app or had persistent root.

I was supposed to help customers hook up modems and reboot their routers, I wasn't really supposed to dig into this stuff (and when I did I'd usually get an annoyed manager asking me to focus on my job). It would've been a great learning experience, but nobody really knew much other than that some device on the customer network was interacting with some known C&C servers.

The customer wasn't particularly interested in finding out either, they blamed us for false reports the moment their XP machine was scanned and found no viruses.

I want to note that they themselves don't need to be operating those malicious devices; with prevalence of dynamic IPs or NAT with ISPs just being assigned dynamic IP from same block is enough to trigger any filter by IP.

I think I might setup future networks to block all incoming AND outgoing connections by default, and then only open the ones I know or want (and perhaps even some of them “for a time” when clicked).

I already block the IoT junk/cameras.

I've had that same thought, but fairly quickly been overrun by the number of things that need rules defined that I've gone back to 'just ban known badness'. (even my pihole setup needed an exception added recently for the one-off usage of a streaming service for the missus).

But it's still a goal I aspire to eventually.

Reply on news.ycombinator.com