Hacker News Reader

Comment by click170 | Hacker News Reader

The only reason I feel comfortable connecting things like consumer network-connected cameras, TVs, Bluray players, game consoles, or anything else "Internet Ready" to my network is because I perform outbound filtering, and it's a big eye-opener to see first-hand what these devices are trying to connect to.

Luckily most things use HTTP so you can actually filter based on the URL it's trying to access. For example, permitting software updates, but denying any kind of analytics reporting.

And with VPN on your phone (especially Always-On VPN) you can filter the requests from your phone with the same granularity, which is even more eye-opening.

Outbound filtering is incredibly useful if you value your security and privacy.

View on HN

If anyone wants to build it, I would love a website where you could look up any device/program and see a profile of what data it sends out of your house, or what it brings in. Pair it with an open source app to collect the profiles and upload them to the website (somewhat ironically).

You know, that's a fantastic idea.

It's almost analagous to the "nutrition facts" that you get on food. A standard baseline so you can know what's going on.

Making the collected data machine readable so it could be sucked into snort/firewall rules/redirected etc might prove nice too.

Relatively few people run gateway devices with the ability to do what you're describing, but pcap is an open format and there are existing utilities for dumping (tcpdump/wireshark) and visualization (https://www.sans.org/security-resources/idfaq/visualize_data...).

Luckily most things use HTTP

The irony is that as people justifiably push for "more security", more and more of them are going to use HTTPS or other encrypted transports, making it impossible to determine what information they're transferring just from network inspection.

End-to-end encryption is a good thing only if you trust both endpoints and don't want MITMs to interfere. Otherwise, it's security being used against you.

When these smart device manufacturers "smarten up" and start encrypting everything (likely with no options to disable and/or e.g. install self-signed certificates - naturally, because of "security reasons"), it'll be all-or-nothing.

Yeah but theoretically, you should control your own devices, and be able to decrypt what they're sending because you have access to the keys they're using. (of course I realize this is complete bs, they're black boxes). Richard Stallman is looking less crazy now with all his warnings about "tivoization"

This.

When I said HTTP, I meant to include HTTPS. Intercepting HTTPS and filtering it is actually rather simple, and avoiding certificate warnings only slightly less so by deploying your own CA.

You're correct that some devices may use certificate pinning to prevent me from doing this, but for those devices my solution is simple: They're denied Internet access entirely.

Edit: As a manufacturer/vendor you have zero expectation of privacy from me the consumer. I bought the device, I bought the equipment that runs the network, I pay to keep the device connected to the Internet, I get the final say on which packets your app receives. Any vendor who believes otherwise is mistaken and should be named and shamed.

Can you recommend any resources for getting started?

Yeah, I'd also be interested in some resources on outbound filtering your network.

I currently use a Mikrotik 750GL as my main router to the internet. In it i have a list of static DNS entries to send AD networks, and things like google-stats to a local http server to block the traffic. I also use it to block devices that i can not control from connecting to the internet (this is how i will block any "internet if things" crap). I dont need a internet connection on all the "things" in my house.

Also, there is no reason why all these functions should be built into a TV. I believe that the TV should be a monitor and thats it. We dont even need to have a TV tuner anymore. Just add 6 HDMI ports or more and I will add whatever function i want.

[Edited]

Every time I say this I feel like a shill because I worked for them briefly, but Sophos has a Home version of their UTM firewall (0). It has pros and cons, but overall I think it's pretty good (even after working there).

Some other options include Sonicwall and pfsense, and I encourage others to post their suggestions as well. I haven't used SonicWall, though I have used pfsense strictly as a firewall.

(0) http://www.sophos.com/en-us/products/free-tools/sophos-utm-h...

Any hardware solution recommendations - or things that will run on a RPi/router?

I don't like the idea of having to keep a desktop/laptop computer on 24/7.

https://www.pfsense.org/hardware/#pfsense-store

Yeah, I saw that. Not exactly consumer prices are they?

Reading the forums there are some dual LAN Atom based mini PCs that seem OK.

Edit: Also http://store.netgate.com/Desktop-Systems-C83.aspx has some preconfigured options at under $300.

Those are the same things.

If you do not want to financially support pfSense, you can buy hardware from Netgate directly, starting from $299. Even cheaper as a kit or with older hardware, but you decide for yourself whether it will be adequate for you. I'm planning on buying an assembled APU from Netgate for myself; right now I'm using m0n0wall on a separate P3 PC (Celeron 1000), modded for silence. Probably will try out pfSense beforehand, on a separate CF card I just ordered.

The Netgate APU2/APU4 devices don't appear to be available directly from pfsense. They do say money from them goes to pfsense though (and they advertise them on the pfsense site)

OpenWRT on a Buffalo WZR-HP-AG300H is a another very nice and cheap solution.

Throw pfsense on an alix box. www.pcengines.ch/apu.htm

Curious as to why you don't want to keep a desktop on 24/7?

Desktops use a fair amount of power and almost always have some amount of noise associated with them.

There are some nice form factor cases out there now-a-days, and I would like to explore using those to make a firewall I could offer to friends and family to protect them too, but I'm just using an old desktop right now.

I've been looking at this AMD-based barebones machine with dual LAN: newegg.com/Product/Product.aspx?Item=N82E16856107110

Reviews suggest pfsense runs well, and with 4GB RAM and a decent SSD one could probably run snort and squid as well. Probably about $330 all assembled.

I use Little Snitch for OSX: http://www.obdev.at/products/littlesnitch/index.html

Glasswire: https://news.ycombinator.com/item?id=8222652

Thanks for the useful list. The only problem with these things is that they require some time, effort and expertise to set up, which the average citizen may not have. I understand you are just being pragmatic, but we definitely need to work towards solutions, which works for more than the educated tech folk.

What sort of firewall/router setup do you recommend?

Reply on news.ycombinator.com