27 ms·

Found hooked up to my router

965 points by empath75 8y ago

Jeremy1026 8y ago
Time for a new roommate.
- Filligree 8y ago
  Yes, this one is malfunctioning.
  - kazen44 8y ago
    or time for proper network security? port-security and disabling unused ports works great in these cases, especially if you are the sole user of the network.
    - ghaff 8y ago
      I dunno. Locking down some things may make sense. But, for the most part, assuming that physical security for your wired home network is sufficient doesn't seem like an unreasonable assumption combined with standard practices for your systems.
    - joshumax 8y ago
      Still, network security is extremely hard when the actor has physical access to your networking hardware. I currently live in a dorm situation and put each roommate on their own separate vlan on their own separate wireless gateway behind an f5 firewall running snort and I'd still be at risk if one of my roommates decided to put something between my gateway and the router.
    - SolarNet 8y ago
      Roommates have physical access to the network. Principles of security tell us you can't defend against that. Need to change the network.
    - z3t4 8y ago
      Everything is using port 443 now a days. Yes also malware. You would need a host whitelist.
    - walshemj 8y ago
      Not much good against insider / roommate threat
    - megous 8y ago
      I like some cryptographical guarantees, so my trusted devices get to be on a overlay WireGuard based VPN, and the access from actual ethernet/LAN gets blocked. VPN still uses IP/port blocking, but thanks to WireGuard, you can be sure that source IP really matches the device you think it does.
- paultopia 8y ago
  For serious. the kind of idiot who would hand over facebook credentials, bank account info, and physical network access for fifteen bucks a month to a total rando is also the kind of idiot who will dig up their roommate's social security card to help them out when the nice person from the IRS calls about back taxes.
  - dingaling 8y ago
    I'd quite happily pimp out my unused fake Facebook profile for $15. Lock the 'device' into its own subnetted VLAN so it can't see any local traffic and it's easy money paid into a deposit-only savings account...
    - SmellyGeekBoy 8y ago
      How do you know that your router doesn't have a 0day that allows them to escape the VLAN?
itry2develop 8y ago
What a moron....
tedunangst 8y ago
How is this thing intercepting all his Facebook and bank traffic?
- ghaff 8y ago
  I don't think it is. Here's another thread which may be for the same thing or something similar. https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/?st=jmilt3ow&sh=592d9a78 https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour... It's apparently a "rent a Facebook account" scam. (The roommate apparently also provided his Facebook credentials.)
  - tedunangst 8y ago
    That is 10x more informative.
    - astronautjones 8y ago
      It's also three (!) years old, which is crazy to think someone has been mailing these out and running the same scam on FB without getting caught, particularly from 2016 on, with the scrutiny placed on FB's illegitimate political ads
      - SmellyGeekBoy 8y ago
        Surely it would be fairly easy for FB to fingerprint the "browser" running on these device and see that it isn't a regular user? At the very least get them to jump through some hoops or enter a CAPTCHA or something?
  - tgsovlerkhgsel 8y ago
    I expected click fraud, but if the description is accurate (and I don't have much of a reason to believe it isn't, since it describes pretty shady activity if you read between the lines), they're using the accounts to post shady ads that Facebook doesn't allow (and bans accounts for) until the account gets banned. Also, the participant is supposed to get paid after they send the Raspberry Pi back after the account got banned, i.e. once the user has absolutely zero value for the scammer... I don't see why the scammer would pay... (although it may be chump change compared to the money they make from getting a percentage of the ad spend, so maybe it's worth paying that to get a better reputation).
Animats 8y ago
Strangely, Reddit cut off comment on the topic, before the device was clearly identified.
- tedunangst 8y ago
  Yeah, I have no idea how it could accomplish what is alleged. Just lots of very bad no good end of world comments. Have none of these people ever used public wifi?
  - ghaff 8y ago
    It's clearly not good to have an unknown but presumptively malicious in some way, shape, or form computer on your home network. And I would be cautious about uploading the device's file system and strongly consider changing various passwords. But, yeah, it's not like the computer suddenly has root access to everything else on the network.
  - dstjean 8y ago
    To name a few: - ARP Poisoning - DNS Poisoning - LM Hashes gathering - Packet Sniffing - Packet Interception (and modification)
  - PhantomGremlin 8y ago
    Have none of these people ever used public wifi? This situation is totally totally unlike public wifi! When I connect to public wifi, the attack surface into my laptop is the external interface of the latest MacOS, with firewall on. Perhaps there are exploits against that, but they're not common. The Mac does have pf, but I'm sure it's a way out of date version! :) OTOH, "this thing" on the inside of a router/firewall has complete unrestricted access to the LAN. At my house I have (and I just checked) 35 active IPs behind my firewall. It's not hard to get to that number for 4 people: iPhones, TiVos, laptops, desktops, access points, printers, gaming consoles. I confess I don't secure my LAN computers very well. I have, e.g. 3 letter passwords. That's simply to keep my kids from accidentally going where they shouldn't be. I'm not alone in my lax security. I do occasionally peruse exit traffic and check firewall logs, which probably puts me somewhere in the most secure 1% of "typical" households. And even if I were totally paranoid, what can I do about the Internet of shit? Am I supposed to strictly segment everything? At what point does prudence and caution drift into paranoia?
walrus01 8y ago
If I had to guess, it's providing VPN endpoint/relay services to scammers (CC fraud, etc) who need actual residential IPs to buy things from. Or to use to set up accounts/sockpuppet accounts for things like automated reddit vote manipulation. It's obviously located "inside" the residential end user's router/NAT, on their wifi, so it'll have something like an openvpn or ipsec daemon on it that initiates a connection to an endpoint elsewhere on the internet, building a tunnel for the botnet operators to control it remotely. Or via tor to a tor hidden service somewhere, like many purely software trojan botnets for win32/win64, but in this case it will have the vpn or tor binaries running on its own dedicated raspberry-pi class device. If you have a botnet of several thousand devices which can be made to look indistinguishable from legitimate "ordinary non technical user sitting at home on their comcast connection with their laptop or tablet", you can do all sorts of things. Relay http/https traffic for a click farm in Bangladesh where people are upvoting reddit comments en masse to promote a product, sockpuppet facebook account comments for political campaigns and pushing political agendas (russian internet research agency, anyone?), etc. The goal here is to make the traffic look like legit single end user residential internet traffic and not traffic that's coming from netblocks of major colocation/dedicated server/VPS/VM hosting companies, whose ARIN/RIPE/APNIC space is all documented as such. There's fraud detection systems which will trigger if you're trying to buy something like amazon gift cards from a /20 netblock of an ISP in Bulgaria, but are less "suspicious" if your traffic and useragent, etc, are all coming from a Frontier, Centurylink, Comcast etc netblock in a major American city. Stuff like the maxmind geolocation data correlating closely with the billing zipcode/shipping zip code of what you're trying to buy with a stolen credit card, or other identify theft type scams. If you're doing some variation on a massive vote manipulation service, there's also fraud/botnet detection systems which will trigger on large volumes of upvotes (or similar manipulation) all coming from the same geographical location and netblocks. Your traffic look more like legitimate end users if it is geographically distributed across many states and provinces, many english-speaking countries (AU, NZ, CA, UK, etc), and across many ISPs and several different common end user browser useragents (edge, chrome, firefox, etc). Imagine if you threw 500 darts at a map of the USA on a wall and distributed all your botnet devices randomly around the map, vs having 300 devices all on the same network in the Chicago metro area, for instance.
- 8y ago
z3t4 8y ago
Besides malicious intends and security disasters. These mini-servers could be used for all kind of cool decentralized "self-hosted" services.
- walrus01 8y ago
  a completely legitimate and valuable network engineering resource is run by RIPE using small devices running openwrt: https://atlas.ripe.net/landing/probes-and-anchors/ https://atlas.ripe.net/landing/probes-and-anchors/ a RIPE atlas probe is a small tp-link device that needs a LAN port on your network and USB power. It forms a vpn back to RIPE, and uses traffic outbound via the default gateway it gets via DHCP to reports metrics like uptime, latency to various destinations on the internet, what its external IP is outside your NAT, what ASN it's on, whether your ASN is having reachability issues to the "whole" internet, etc. many medium and large sized ISPs host RIPE probes at different geographic locations in their networks.
  - swiley 8y ago
    I've had one of these running forever... I should go check and see what sorts of queries I'm allowed to run on the collected data at this point.
curiousgal 8y ago
Free pi!
- Topgamer7 8y ago
  Appears to be a nano pi neo https://www.friendlyarm.com/index.php?route=product/product&product_id=132 https://www.friendlyarm.com/index.php?route=product/product&...
- dabockster 8y ago
  Too risky. The hardware should assume to be totally compromised. Smash it to pieces. Or, if you can, shoot it.
qualsiasi 8y ago
If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.
- walrus01 8y ago
  previously, the "pwn plug": https://www.google.com/search?client=ubuntu&channel=fs&q=pwnplug&ie=utf-8&oe=utf-8 https://www.google.com/search?client=ubuntu&channel=fs&q=pwn...
- scroot 8y ago
  This is how stuxnet got into the Natanz facility I think. They left a usb stick in the parking lot. Someone picked it up, plugged it in.
  - cobbzilla 8y ago
    No, iirc stuxnet spread itself without anyone physically leaving a USB stick anywhere. On a system infected via the network, it would try to infect any USB drives connected to the system.
    - lachlan-sneff 8y ago
      Stuxnet is fascinating. Still, as far as I can tell, the most complex, interesting malware ever found in the wild. I believe it's unclear how stuxnet found its way into the enrichment facilities.
      - haimez 8y ago
        It did contain a USB device exploit delivering a dropper with a completely separate payload specifically targeted at the Natanz facility. A compromised USB device picked up in the parking lot would do the trick, but there are certainly other ways to get something through the front door and that information is unlikely to be public knowledge any time soon.
quickthrower2 8y ago
Interesting that it is "worth" $15/month. Maybe they were never going to pay up. But if they were, that seems expensive when they could just use compromised PCs and devices for ... whatever they are going to do? Plus they had to buy and supply the dongle.
- jiveturkey 8y ago
  yah, this needs a deeper analysis. hopefully some researcher reaches out to him to do real forensics.
- abraham_lincoln 8y ago
  I wonder what the average time the user will disconnect it after they don't get paid? It may be worth it to just sacrifice it after a month. I am sure it is profitable, but as people become more aware, it will be harder for them to do this.
- empath75 8y ago
  What are the odds they got paid?
erredois 8y ago
I wish he would not destroy it and send to a security researcher to identify what it really does and what information is collected.
samstave 8y ago
This just made me think of an interesting idea: Imagine a small loop-back-like device which is plugged into all open network ports - if any of them are removed from a network port, an alert is generated stating "device from port 48 on switch 1 in closet 0 was removed"
- walrus01 8y ago
  In general it's best practice to leave unused ports on managed switches in an admin down/shut state until something you know is connected. Or live, but in a quarantine VLAN. Your idea, however, is not totally uncommon to have a raspbery pi sized device at an offsite location, specifically not plugged into any sort of UPS, which is monitored by various alerting systems. In addition to the alerts that one should get during a grid power failure event from managed UPS and automated generator transfer switch systems, the disappearance of your "UPS canary" can indicate that something is going on at an unattended site.
  - abraham_lincoln 8y ago
    My college used to do similar. If you did not register your MAC address, you would be DHCP assigned into a walled-garden IP block. We found we could run an IP scanner on the authorized subnet (from a computer with a whitelisted MAC), and find the unused IPs, and just set those statically for 'visitors'. No need to register any more MAC addresses.
    - dev_dull 8y ago
      I doubt they were very concerned with you or your friends. 80/20 solutions.
      - abraham_lincoln 8y ago
        Only had problems when a classmate was running routed. Oh, and all authorized IPs were in a public address space.
    - 8y ago
negamax 8y ago
The other roommate deliberately installed this for snooping!
petemill 8y ago
Whilst it's certainly a scam to do with advertising [0], I doesn't look like there's any evidence that the scam has anything to do with 'stealing' anything from network / network traffic: > Facebook has several mechanisms in place to protect your account. We make every attempt to work within the these constraints. In order to keep your account from being locked we use a small device called a Raspberry Pi. This device allows us to connect to Facebook advertising APIs from your home network and avoids the hassle of your account being locked due to unfamiliar activity. Learn more about the Raspberry Pi below. [0] https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/?st=jmilt3ow&sh=592d9a78 https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour...
- larkeith 8y ago
  I find these claims extremely dubious. Everything they claim the Pi is needed for can be accomplished without the equipment and postage costs with a purely software solution; The hardware allows them to monitor all traffic and avoid antivirus/firewalls. Moreover, I doubt it is difficult to find mass-market Facebook accounts for much less than $15/month - it is far more likely that, given the hardware allows them unfettered access to all network traffic, it is designed to report back as much data as possible, ideally including plaintext passwords and banking information.
  - jedieaston 8y ago
    In this case, having a distributed botnet of Pis at people's houses would make sure you didn't get IP blocked by Facebook, since there are also legitimate users at that IP. Facebook probably would not block it, and even if it did unplugging and plugging back in the modem is enough for most residential gateways to get a new external IP.
  - zhobbs 8y ago
    The hardware gives a better guarantee of botnet uptime though. If you want it to be powered on and attached to that network 24/7, you can't rely on their laptop/desktop.
- konschubert 8y ago
stcredzero 8y ago
They Might Be Giants: "What's that blue thing doing here?" https://www.youtube.com/watch?v=HXmBs1OppXw&t=91 https://www.youtube.com/watch?v=HXmBs1OppXw&t=91
krn 8y ago
One comment in that thread[1] gives a full explanation of what such a Raspberry Pi device hooked up to the router can do: forward all the network traffic, replace router's stock firmware with its own, install software on the network connected devices via known vulnerabilities, spoof websites by acting as custom DNS server. In my opinion, it looks like "a Pi-hole[2], but for phishing". [1] https://www.reddit.com/r/whatisthisthing/comments/9ixdh9/found_hooked_up_to_my_router/e6o4tun/ https://www.reddit.com/r/whatisthisthing/comments/9ixdh9/fou... [2] https://pi-hole.net/ https://pi-hole.net/
- dabockster 8y ago
  It's amazing how many people forget that Raspbian is still Linux under all the Wolfram and Raspberry Pi stuff. So you essentially have a tiny computer that can be plugged into almost anything you can program for.
  - dopamean 8y ago
    Do people really forget that? I thought that was the whole point of raspberry pis.
    - dx87 8y ago
      It depends on what you're using it for. I bought a kit for setting up a retro-pi because I didn't feel like checking to ensure the parts were all compatible. It gives you step by step instructions to set it up, and none of it requires knowing anything about Linux. You just download an image file, write it to the ssd, and when you plug it in it does all the setup itself and you're just presented with the retro-pi GUI. The only hint that it's Linux under the hood is when the names of processes scroll past on the screen as it's booting.
  - eugenekolo2 8y ago
    Nobody using a raspberry pi forgets that.
    - 8y ago
abraham_lincoln 8y ago
I am just curious of the age group here.
adamconroy 8y ago
I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).
- krn 8y ago
  What about DNS spoofing[1] at the local network level? [1] https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing
  - p49k 8y ago
    The spoofer wouldn’t be able to obtain a valid certificate for the spoofed site, though.
    - swiftcoder 8y ago
      The spoofer can obtain a valid certificate for another, seemingly legitimate site. Any software that hasn't explicitly pinned the leaf TLS certificates will still accept the (valid) certificate it is redirected to. And sadly, a lot of software still doesn't perform certificate pinning.
      - tedunangst 8y ago
        How is this redirect performed?
        ktta 8y ago
        When a URL is manually typed in, and HSTS or HSTS-preloading isn't enabled, the initial 301 redirect would be http.
        dlubarov 8y ago
        It could just be a 3xx redirect over clear http, right? The http site can redirect to a https site with a similar name.
myth_buster 8y ago
Two extremes as displayed on same day: a. Gizmodo says Facebook Is Giving Advertisers Access to Your Shadow Contact Information and HNers are concerned b. IRL, Roommate also gave them their Facebook email and password (for $15/mth)
- hiccuphippo 8y ago
  So Facebook doesn't care about people's privacy and people themselves don't care about their own privacy. This is pretty demoralizing.
KiDD 8y ago
You will pay me to give you fake information and a free Raspberry Pi Nano?
- King-Aaron 8y ago
  Where do I sign up?!
dev_dull 8y ago
Being a privacy nightmare, I can see how this data can be quite useful for advertisers simply by sniffing DNS traffic: * What sites do they visit? * How long do they spend on each site? * What apps do they use? (apps make http requests, after all) * How long do they spend on these apps (providing it's making consistent http requests) * What devices are they using to access these sites/apps? Kind of like Neilson ratings but for the web.
code4tee 8y ago
In the days when USB sticks were more common it was an easy tactic for someone to drop one in a company parking lot labeled “salary data” and with almost certainty that thing would get plugged into a device on the corporate network. The biggest security vulnerability in most cases is still users doing dumb things.
- dabockster 8y ago
  USB sticks are still pretty common.
  - ObsoleteNerd 8y ago
    As are USB stick attacks.
- ravenstine 8y ago
  FY2018_salary_data.exe
  - taneq 8y ago
    Oh, please, no-one would fall for that! FY2018_salary_data.xls.exe, on the other hand... :P
    - doughj3 8y ago
      It wasn't uncommon to see hot_new_song.mp3.exe back in the gnutella heyday.
      - ericcumbee 8y ago
        I made that mistake once when I was a teen. My father was not pleased one bit.
      - paranoidrobot 8y ago
        It's still reasonably common to see hot_new_movie.mp4.exe or have an encrypted mp4 with a install_this_codec.exe beside it.
deleted 8y ago
[deleted]
homero 8y ago
It could be doing viruses and all that but they'd be better off using it for proxying, scraping and ddos
browsercoin 8y ago
> I have a Raspberry Pi right now in my hands fron rentyouraccont.com, i have it running diagnostics on an Air-Gapped pc. This thing is wild. Every second it tries to connect to bot-net programs. It not only buys ads on facebook (which btw i cannot find code that it actually does this) but it is creating links to malware ridden embeds. It is part of a Botnet, i can say for sure. Every second it tries to establish a connection to the botnet, its like a bee thats lost its colony. Register for one and put it on an air-gap, you wills see excatly what im talking about. It records EVERY KEYSTROKE sent of the network, even SSL connection. so this was a linked comment from a thread 3 years ago....
- Pxtl 8y ago
  How is that even possible? How does it capture keystrokes (unless you mean Google searches where each key is sent for autocomplete). How does it break SSL?
  - deleted 8y ago
    [deleted]
  - krn 8y ago
    I think that by "every keystroke" he meant "every network packet".
    - Zee2 8y ago
      Which would capture passwords in plaintext sent from the user side, no?
      - Pxtl 8y ago
        Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.
        osrec 8y ago
swiley 8y ago
Want to see what's in the initramfs. It almost certainly doesn't have his data on it (it looks to me like it never writes anything to the sdcard, at least not that partition)
King-Aaron 8y ago
I guess this touches on rules 1 & 3 of the Ten immutable laws of security. Maybe rule 4 to an extent as well. https://blogs.technet.microsoft.com/rhalbheer/2011/06/16/ten-immutable-laws-of-security-version-2-0/ https://blogs.technet.microsoft.com/rhalbheer/2011/06/16/ten...
ChuckMcM 8y ago
A somewhat dated reminder that "Social engineering is the best engineering." when it comes to getting around security blocks. As Natasha said to Boris, "I said system is 'Idiot proof' not 'Moose proof'!"
espeed 8y ago
Here is the list of pinned domains [1] in Chrome: Chrome Pinsets https://cs.chromium.org/chromium/src/net/http/transport_security_state_static.json https://cs.chromium.org/chromium/src/net/http/transport_secu... [1] https://www.chromium.org/sts https://www.chromium.org/sts https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
- rocky1138 8y ago
  Makes me happy seeing my domains in there.
planb 8y ago
This is overblown, isn't it? That thing can't do anything that a public wifi couldn't, and yet everyone connects their laptops to those without hassle. SSL is nearly everywhere now...
- putlake 8y ago
  Exactly. Came here to post this and ask what I'm missing.
  - baxtr 8y ago
    You might be looking at the difference between HN and reddit as a community
- chrisper 8y ago
  I still wouldn't use a public wifi without a VPN...
- dirkt 8y ago
  Test how many SSL connections go the extra mile and secure themselves against Man in the Middle attacks. You'll be surprised.
  - thegeomaster 8y ago
    All of them, since that's an explicit design goal of SSL/TLS?
    - cube00 8y ago
      If a user wants their free wifi enough they'll be happy to click through those pesky warnings that the root cert is not trusted. They'll probably not think anything of it if it loads as normal, even with a big angry red cross. The speed at which users rip though Windows UAC warnings is astonishing.
    - _verandaguy 8y ago
      https:// https:// with no extra options is still very much prone to downgrade/stripping attacks, and first-time connections to an https:// https:// site are particularly vulnerable since a lot of the extra hardening options (HSTS in particular) can be nullified through TOFU.
bhaavan 8y ago
TL;DR Roomate is dumb.
deleted 8y ago
[deleted]
mrhackerpoland 8y ago
My roommate received this device too. Having observed its activity. It doesn't steal any data. It simply setups a ssh dynamic tunnel and uses your network IP for accessing your Facebook account which you sold. Why? Because Fb locks the account the moment it's accessed from a different network from a different device. Can it steal your data? Absolutely yes! Does it steal? Probably no. Afaik, all they want is your fb account for which they pay you.
SmellyGeekBoy 8y ago
I'd understand why someone would be tempted to install something like this for $1500... Maybe even $150. But $15!? If you're that desperate why not get 3 friends to donate $5 each or something? I'm sure they'd understand if it was truly life-or-death.
novaRom 8y ago
The board is Nano Pi NEO. It costs $15 and contains quad-core Cortex A7 along with two USB (2.0) ports and 100 Mbit Ethernet. It is about 25% of size of RaspberryPi. By the way, the same Chinese company now offers a much more powerful board called Nano Pi M4 which is just a bomb with respect to RaspberryPi B+ if you look at its specifications.
amelius 8y ago
Most of whatever their router sees, their ISP sees as well. So I understand they are upset, but the panic is not warranted.
the_clarence 8y ago
Can someone post the image here? I have blocked reddit on my phone.
- cupar 8y ago
  https://i.imgur.com/W30vAXk.jpg https://i.imgur.com/W30vAXk.jpg
tonyb 8y ago
Is a disk image of one of these available anywhere? I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server. Plugging a device into your network doesn't make it magically see all the traffic. It would have to be doing ARP spoofing, DHCP hijacking, or hacking the router config/firmware. Is it possible that it is doing some or all of those things -- sure. But why? That could all be done via a malicious client executable that would give you access to the network and much more and is much more discrete than a physical box, so why would someone go through the trouble of shipping out a box + paying the recipient? The more simple explanation is the sender of the device is doing nefarious actions on the internet and needs a bunch of IPs for cheap so when they get blocked they can just move on to the next IP. Would I put one of these on my home network - hell no. But if one of my friends tells me they had one plugged into their network I wouldn't immediately assume that their entire digital life was compromised. I would tell them to unplug it though.
- wstuartcl 8y ago
  Well if they are willing to break TOS to sell ads on facebook how much further do you need to go to rationalize auth capture, rootkit injection or any other malicious activity. "Plugging in the device on your network doesn't make it magically see all of the traffic" ... Assuming it has not been constructed to do all of the things you list (or more) does not magically make it not see all of your traffic either. There is no magic involved, it is either constructed to capture/inject or not -- the only way to know is to review the actual bits and firmware.
  - ams6110 8y ago
    Unless you work in a SCIF (and probably not even then) your local network should not be considered trustworthy. Assume that hostile activity is always present. Especially if you have "appliance" type stuff on your LAN, such as ISP-provided routers, Amazon/Google devices, smart light bulbs, etc. Keep your machines and firewalls updated.
  - 8y ago
arayh 8y ago
It seems like they're fishing for gullible Facebook users on Craigslist. I found an example of a Craigslist posting that tries to "rent" your Facebook profile: https://image.ibb.co/dzT9j9/rent_facebook.png https://image.ibb.co/dzT9j9/rent_facebook.png
- wstuartcl 8y ago
  My guess would be either a MITM auth capture, rootkit inject or someone (even a nation state) trying to attribute sources of illicit facebook ads/posts to unsuspecting citizens. I would not touch that with a 10 foot pole.

965 points by empath75 8y ago

Jeremy1026 8y ago

Time for a new roommate.

Filligree 8y ago
Yes, this one is malfunctioning.
- kazen44 8y ago
  or time for proper network security? port-security and disabling unused ports works great in these cases, especially if you are the sole user of the network.
  - ghaff 8y ago
    I dunno. Locking down some things may make sense. But, for the most part, assuming that physical security for your wired home network is sufficient doesn't seem like an unreasonable assumption combined with standard practices for your systems.
  - joshumax 8y ago
    Still, network security is extremely hard when the actor has physical access to your networking hardware. I currently live in a dorm situation and put each roommate on their own separate vlan on their own separate wireless gateway behind an f5 firewall running snort and I'd still be at risk if one of my roommates decided to put something between my gateway and the router.
  - SolarNet 8y ago
    Roommates have physical access to the network. Principles of security tell us you can't defend against that. Need to change the network.
  - z3t4 8y ago
    Everything is using port 443 now a days. Yes also malware. You would need a host whitelist.
  - walshemj 8y ago
    Not much good against insider / roommate threat
  - megous 8y ago
    I like some cryptographical guarantees, so my trusted devices get to be on a overlay WireGuard based VPN, and the access from actual ethernet/LAN gets blocked. VPN still uses IP/port blocking, but thanks to WireGuard, you can be sure that source IP really matches the device you think it does.
paultopia 8y ago
For serious. the kind of idiot who would hand over facebook credentials, bank account info, and physical network access for fifteen bucks a month to a total rando is also the kind of idiot who will dig up their roommate's social security card to help them out when the nice person from the IRS calls about back taxes.
- dingaling 8y ago
  I'd quite happily pimp out my unused fake Facebook profile for $15. Lock the 'device' into its own subnetted VLAN so it can't see any local traffic and it's easy money paid into a deposit-only savings account...
  - SmellyGeekBoy 8y ago
    How do you know that your router doesn't have a 0day that allows them to escape the VLAN?

itry2develop 8y ago

What a moron....

tedunangst 8y ago

How is this thing intercepting all his Facebook and bank traffic?

ghaff 8y ago
I don't think it is. Here's another thread which may be for the same thing or something similar. https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/?st=jmilt3ow&sh=592d9a78 https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour... It's apparently a "rent a Facebook account" scam. (The roommate apparently also provided his Facebook credentials.)
- tedunangst 8y ago
  That is 10x more informative.
  - astronautjones 8y ago
    It's also three (!) years old, which is crazy to think someone has been mailing these out and running the same scam on FB without getting caught, particularly from 2016 on, with the scrutiny placed on FB's illegitimate political ads
    - SmellyGeekBoy 8y ago
      Surely it would be fairly easy for FB to fingerprint the "browser" running on these device and see that it isn't a regular user? At the very least get them to jump through some hoops or enter a CAPTCHA or something?
- tgsovlerkhgsel 8y ago
  I expected click fraud, but if the description is accurate (and I don't have much of a reason to believe it isn't, since it describes pretty shady activity if you read between the lines), they're using the accounts to post shady ads that Facebook doesn't allow (and bans accounts for) until the account gets banned. Also, the participant is supposed to get paid after they send the Raspberry Pi back after the account got banned, i.e. once the user has absolutely zero value for the scammer... I don't see why the scammer would pay... (although it may be chump change compared to the money they make from getting a percentage of the ad spend, so maybe it's worth paying that to get a better reputation).

Animats 8y ago

Strangely, Reddit cut off comment on the topic, before the device was clearly identified.

tedunangst 8y ago
Yeah, I have no idea how it could accomplish what is alleged. Just lots of very bad no good end of world comments. Have none of these people ever used public wifi?
- ghaff 8y ago
  It's clearly not good to have an unknown but presumptively malicious in some way, shape, or form computer on your home network. And I would be cautious about uploading the device's file system and strongly consider changing various passwords. But, yeah, it's not like the computer suddenly has root access to everything else on the network.
- dstjean 8y ago
  To name a few: - ARP Poisoning - DNS Poisoning - LM Hashes gathering - Packet Sniffing - Packet Interception (and modification)
- PhantomGremlin 8y ago
  Have none of these people ever used public wifi? This situation is totally totally unlike public wifi! When I connect to public wifi, the attack surface into my laptop is the external interface of the latest MacOS, with firewall on. Perhaps there are exploits against that, but they're not common. The Mac does have pf, but I'm sure it's a way out of date version! :) OTOH, "this thing" on the inside of a router/firewall has complete unrestricted access to the LAN. At my house I have (and I just checked) 35 active IPs behind my firewall. It's not hard to get to that number for 4 people: iPhones, TiVos, laptops, desktops, access points, printers, gaming consoles. I confess I don't secure my LAN computers very well. I have, e.g. 3 letter passwords. That's simply to keep my kids from accidentally going where they shouldn't be. I'm not alone in my lax security. I do occasionally peruse exit traffic and check firewall logs, which probably puts me somewhere in the most secure 1% of "typical" households. And even if I were totally paranoid, what can I do about the Internet of shit? Am I supposed to strictly segment everything? At what point does prudence and caution drift into paranoia?

walrus01 8y ago

If I had to guess, it's providing VPN endpoint/relay services to scammers (CC fraud, etc) who need actual residential IPs to buy things from. Or to use to set up accounts/sockpuppet accounts for things like automated reddit vote manipulation. It's obviously located "inside" the residential end user's router/NAT, on their wifi, so it'll have something like an openvpn or ipsec daemon on it that initiates a connection to an endpoint elsewhere on the internet, building a tunnel for the botnet operators to control it remotely. Or via tor to a tor hidden service somewhere, like many purely software trojan botnets for win32/win64, but in this case it will have the vpn or tor binaries running on its own dedicated raspberry-pi class device. If you have a botnet of several thousand devices which can be made to look indistinguishable from legitimate "ordinary non technical user sitting at home on their comcast connection with their laptop or tablet", you can do all sorts of things. Relay http/https traffic for a click farm in Bangladesh where people are upvoting reddit comments en masse to promote a product, sockpuppet facebook account comments for political campaigns and pushing political agendas (russian internet research agency, anyone?), etc. The goal here is to make the traffic look like legit single end user residential internet traffic and not traffic that's coming from netblocks of major colocation/dedicated server/VPS/VM hosting companies, whose ARIN/RIPE/APNIC space is all documented as such. There's fraud detection systems which will trigger if you're trying to buy something like amazon gift cards from a /20 netblock of an ISP in Bulgaria, but are less "suspicious" if your traffic and useragent, etc, are all coming from a Frontier, Centurylink, Comcast etc netblock in a major American city. Stuff like the maxmind geolocation data correlating closely with the billing zipcode/shipping zip code of what you're trying to buy with a stolen credit card, or other identify theft type scams. If you're doing some variation on a massive vote manipulation service, there's also fraud/botnet detection systems which will trigger on large volumes of upvotes (or similar manipulation) all coming from the same geographical location and netblocks. Your traffic look more like legitimate end users if it is geographically distributed across many states and provinces, many english-speaking countries (AU, NZ, CA, UK, etc), and across many ISPs and several different common end user browser useragents (edge, chrome, firefox, etc). Imagine if you threw 500 darts at a map of the USA on a wall and distributed all your botnet devices randomly around the map, vs having 300 devices all on the same network in the Chicago metro area, for instance.

8y ago

z3t4 8y ago

Besides malicious intends and security disasters. These mini-servers could be used for all kind of cool decentralized "self-hosted" services.

walrus01 8y ago
a completely legitimate and valuable network engineering resource is run by RIPE using small devices running openwrt: https://atlas.ripe.net/landing/probes-and-anchors/ https://atlas.ripe.net/landing/probes-and-anchors/ a RIPE atlas probe is a small tp-link device that needs a LAN port on your network and USB power. It forms a vpn back to RIPE, and uses traffic outbound via the default gateway it gets via DHCP to reports metrics like uptime, latency to various destinations on the internet, what its external IP is outside your NAT, what ASN it's on, whether your ASN is having reachability issues to the "whole" internet, etc. many medium and large sized ISPs host RIPE probes at different geographic locations in their networks.
- swiley 8y ago
  I've had one of these running forever... I should go check and see what sorts of queries I'm allowed to run on the collected data at this point.

curiousgal 8y ago

Free pi!

Topgamer7 8y ago
Appears to be a nano pi neo https://www.friendlyarm.com/index.php?route=product/product&product_id=132 https://www.friendlyarm.com/index.php?route=product/product&...
dabockster 8y ago
Too risky. The hardware should assume to be totally compromised. Smash it to pieces. Or, if you can, shoot it.

qualsiasi 8y ago

If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.

walrus01 8y ago
previously, the "pwn plug": https://www.google.com/search?client=ubuntu&channel=fs&q=pwnplug&ie=utf-8&oe=utf-8 https://www.google.com/search?client=ubuntu&channel=fs&q=pwn...
scroot 8y ago
This is how stuxnet got into the Natanz facility I think. They left a usb stick in the parking lot. Someone picked it up, plugged it in.
- cobbzilla 8y ago
  No, iirc stuxnet spread itself without anyone physically leaving a USB stick anywhere. On a system infected via the network, it would try to infect any USB drives connected to the system.
  - lachlan-sneff 8y ago
    Stuxnet is fascinating. Still, as far as I can tell, the most complex, interesting malware ever found in the wild. I believe it's unclear how stuxnet found its way into the enrichment facilities.
    - haimez 8y ago
      It did contain a USB device exploit delivering a dropper with a completely separate payload specifically targeted at the Natanz facility. A compromised USB device picked up in the parking lot would do the trick, but there are certainly other ways to get something through the front door and that information is unlikely to be public knowledge any time soon.

quickthrower2 8y ago

Interesting that it is "worth" $15/month. Maybe they were never going to pay up. But if they were, that seems expensive when they could just use compromised PCs and devices for ... whatever they are going to do? Plus they had to buy and supply the dongle.

jiveturkey 8y ago
yah, this needs a deeper analysis. hopefully some researcher reaches out to him to do real forensics.
abraham_lincoln 8y ago
I wonder what the average time the user will disconnect it after they don't get paid? It may be worth it to just sacrifice it after a month. I am sure it is profitable, but as people become more aware, it will be harder for them to do this.
empath75 8y ago
What are the odds they got paid?

erredois 8y ago

I wish he would not destroy it and send to a security researcher to identify what it really does and what information is collected.

samstave 8y ago

This just made me think of an interesting idea: Imagine a small loop-back-like device which is plugged into all open network ports - if any of them are removed from a network port, an alert is generated stating "device from port 48 on switch 1 in closet 0 was removed"

walrus01 8y ago
In general it's best practice to leave unused ports on managed switches in an admin down/shut state until something you know is connected. Or live, but in a quarantine VLAN. Your idea, however, is not totally uncommon to have a raspbery pi sized device at an offsite location, specifically not plugged into any sort of UPS, which is monitored by various alerting systems. In addition to the alerts that one should get during a grid power failure event from managed UPS and automated generator transfer switch systems, the disappearance of your "UPS canary" can indicate that something is going on at an unattended site.
- abraham_lincoln 8y ago
  My college used to do similar. If you did not register your MAC address, you would be DHCP assigned into a walled-garden IP block. We found we could run an IP scanner on the authorized subnet (from a computer with a whitelisted MAC), and find the unused IPs, and just set those statically for 'visitors'. No need to register any more MAC addresses.
  - dev_dull 8y ago
    I doubt they were very concerned with you or your friends. 80/20 solutions.
    - abraham_lincoln 8y ago
      Only had problems when a classmate was running routed. Oh, and all authorized IPs were in a public address space.
  - 8y ago

negamax 8y ago

The other roommate deliberately installed this for snooping!

petemill 8y ago

Whilst it's certainly a scam to do with advertising [0], I doesn't look like there's any evidence that the scam has anything to do with 'stealing' anything from network / network traffic: > Facebook has several mechanisms in place to protect your account. We make every attempt to work within the these constraints. In order to keep your account from being locked we use a small device called a Raspberry Pi. This device allows us to connect to Facebook advertising APIs from your home network and avoids the hassle of your account being locked due to unfamiliar activity. Learn more about the Raspberry Pi below. [0] https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/?st=jmilt3ow&sh=592d9a78 https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour...

larkeith 8y ago
I find these claims extremely dubious. Everything they claim the Pi is needed for can be accomplished without the equipment and postage costs with a purely software solution; The hardware allows them to monitor all traffic and avoid antivirus/firewalls. Moreover, I doubt it is difficult to find mass-market Facebook accounts for much less than $15/month - it is far more likely that, given the hardware allows them unfettered access to all network traffic, it is designed to report back as much data as possible, ideally including plaintext passwords and banking information.
- jedieaston 8y ago
  In this case, having a distributed botnet of Pis at people's houses would make sure you didn't get IP blocked by Facebook, since there are also legitimate users at that IP. Facebook probably would not block it, and even if it did unplugging and plugging back in the modem is enough for most residential gateways to get a new external IP.
- zhobbs 8y ago
  The hardware gives a better guarantee of botnet uptime though. If you want it to be powered on and attached to that network 24/7, you can't rely on their laptop/desktop.
konschubert 8y ago

stcredzero 8y ago

They Might Be Giants: "What's that blue thing doing here?" https://www.youtube.com/watch?v=HXmBs1OppXw&t=91 https://www.youtube.com/watch?v=HXmBs1OppXw&t=91

krn 8y ago

One comment in that thread[1] gives a full explanation of what such a Raspberry Pi device hooked up to the router can do: forward all the network traffic, replace router's stock firmware with its own, install software on the network connected devices via known vulnerabilities, spoof websites by acting as custom DNS server. In my opinion, it looks like "a Pi-hole[2], but for phishing". [1] https://www.reddit.com/r/whatisthisthing/comments/9ixdh9/found_hooked_up_to_my_router/e6o4tun/ https://www.reddit.com/r/whatisthisthing/comments/9ixdh9/fou... [2] https://pi-hole.net/ https://pi-hole.net/

dabockster 8y ago
It's amazing how many people forget that Raspbian is still Linux under all the Wolfram and Raspberry Pi stuff. So you essentially have a tiny computer that can be plugged into almost anything you can program for.
- dopamean 8y ago
  Do people really forget that? I thought that was the whole point of raspberry pis.
  - dx87 8y ago
    It depends on what you're using it for. I bought a kit for setting up a retro-pi because I didn't feel like checking to ensure the parts were all compatible. It gives you step by step instructions to set it up, and none of it requires knowing anything about Linux. You just download an image file, write it to the ssd, and when you plug it in it does all the setup itself and you're just presented with the retro-pi GUI. The only hint that it's Linux under the hood is when the names of processes scroll past on the screen as it's booting.
- eugenekolo2 8y ago
  Nobody using a raspberry pi forgets that.
  - 8y ago

abraham_lincoln 8y ago

I am just curious of the age group here.

adamconroy 8y ago

I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).

krn 8y ago
What about DNS spoofing[1] at the local network level? [1] https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing
- p49k 8y ago
  The spoofer wouldn’t be able to obtain a valid certificate for the spoofed site, though.
  - swiftcoder 8y ago
    The spoofer can obtain a valid certificate for another, seemingly legitimate site. Any software that hasn't explicitly pinned the leaf TLS certificates will still accept the (valid) certificate it is redirected to. And sadly, a lot of software still doesn't perform certificate pinning.
    - tedunangst 8y ago
      How is this redirect performed?
      - ktta 8y ago
        When a URL is manually typed in, and HSTS or HSTS-preloading isn't enabled, the initial 301 redirect would be http.
      - dlubarov 8y ago
        It could just be a 3xx redirect over clear http, right? The http site can redirect to a https site with a similar name.

myth_buster 8y ago

Two extremes as displayed on same day: a. Gizmodo says Facebook Is Giving Advertisers Access to Your Shadow Contact Information and HNers are concerned b. IRL, Roommate also gave them their Facebook email and password (for $15/mth)

hiccuphippo 8y ago
So Facebook doesn't care about people's privacy and people themselves don't care about their own privacy. This is pretty demoralizing.

KiDD 8y ago

You will pay me to give you fake information and a free Raspberry Pi Nano?

King-Aaron 8y ago
Where do I sign up?!

dev_dull 8y ago

Being a privacy nightmare, I can see how this data can be quite useful for advertisers simply by sniffing DNS traffic: * What sites do they visit? * How long do they spend on each site? * What apps do they use? (apps make http requests, after all) * How long do they spend on these apps (providing it's making consistent http requests) * What devices are they using to access these sites/apps? Kind of like Neilson ratings but for the web.

code4tee 8y ago

In the days when USB sticks were more common it was an easy tactic for someone to drop one in a company parking lot labeled “salary data” and with almost certainty that thing would get plugged into a device on the corporate network. The biggest security vulnerability in most cases is still users doing dumb things.

dabockster 8y ago
USB sticks are still pretty common.
- ObsoleteNerd 8y ago
  As are USB stick attacks.
ravenstine 8y ago
FY2018_salary_data.exe
- taneq 8y ago
  Oh, please, no-one would fall for that! FY2018_salary_data.xls.exe, on the other hand... :P
  - doughj3 8y ago
    It wasn't uncommon to see hot_new_song.mp3.exe back in the gnutella heyday.
    - ericcumbee 8y ago
      I made that mistake once when I was a teen. My father was not pleased one bit.
    - paranoidrobot 8y ago
      It's still reasonably common to see hot_new_movie.mp4.exe or have an encrypted mp4 with a install_this_codec.exe beside it.

deleted 8y ago

[deleted]

homero 8y ago

It could be doing viruses and all that but they'd be better off using it for proxying, scraping and ddos

browsercoin 8y ago

> I have a Raspberry Pi right now in my hands fron rentyouraccont.com, i have it running diagnostics on an Air-Gapped pc. This thing is wild. Every second it tries to connect to bot-net programs. It not only buys ads on facebook (which btw i cannot find code that it actually does this) but it is creating links to malware ridden embeds. It is part of a Botnet, i can say for sure. Every second it tries to establish a connection to the botnet, its like a bee thats lost its colony. Register for one and put it on an air-gap, you wills see excatly what im talking about. It records EVERY KEYSTROKE sent of the network, even SSL connection. so this was a linked comment from a thread 3 years ago....

Pxtl 8y ago
How is that even possible? How does it capture keystrokes (unless you mean Google searches where each key is sent for autocomplete). How does it break SSL?
- deleted 8y ago
  [deleted]
- krn 8y ago
  I think that by "every keystroke" he meant "every network packet".
  - Zee2 8y ago
    Which would capture passwords in plaintext sent from the user side, no?
    - Pxtl 8y ago
      Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.
      - osrec 8y ago

swiley 8y ago

Want to see what's in the initramfs. It almost certainly doesn't have his data on it (it looks to me like it never writes anything to the sdcard, at least not that partition)

King-Aaron 8y ago

I guess this touches on rules 1 & 3 of the Ten immutable laws of security. Maybe rule 4 to an extent as well. https://blogs.technet.microsoft.com/rhalbheer/2011/06/16/ten-immutable-laws-of-security-version-2-0/ https://blogs.technet.microsoft.com/rhalbheer/2011/06/16/ten...

ChuckMcM 8y ago

A somewhat dated reminder that "Social engineering is the best engineering." when it comes to getting around security blocks. As Natasha said to Boris, "I said system is 'Idiot proof' not 'Moose proof'!"

espeed 8y ago

Here is the list of pinned domains [1] in Chrome: Chrome Pinsets https://cs.chromium.org/chromium/src/net/http/transport_security_state_static.json https://cs.chromium.org/chromium/src/net/http/transport_secu... [1] https://www.chromium.org/sts https://www.chromium.org/sts https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning

rocky1138 8y ago
Makes me happy seeing my domains in there.

planb 8y ago

This is overblown, isn't it? That thing can't do anything that a public wifi couldn't, and yet everyone connects their laptops to those without hassle. SSL is nearly everywhere now...

putlake 8y ago
Exactly. Came here to post this and ask what I'm missing.
- baxtr 8y ago
  You might be looking at the difference between HN and reddit as a community
chrisper 8y ago
I still wouldn't use a public wifi without a VPN...
dirkt 8y ago
Test how many SSL connections go the extra mile and secure themselves against Man in the Middle attacks. You'll be surprised.
- thegeomaster 8y ago
  All of them, since that's an explicit design goal of SSL/TLS?
  - cube00 8y ago
    If a user wants their free wifi enough they'll be happy to click through those pesky warnings that the root cert is not trusted. They'll probably not think anything of it if it loads as normal, even with a big angry red cross. The speed at which users rip though Windows UAC warnings is astonishing.
  - _verandaguy 8y ago
    https:// https:// with no extra options is still very much prone to downgrade/stripping attacks, and first-time connections to an https:// https:// site are particularly vulnerable since a lot of the extra hardening options (HSTS in particular) can be nullified through TOFU.

bhaavan 8y ago

TL;DR Roomate is dumb.

deleted 8y ago

[deleted]

mrhackerpoland 8y ago

My roommate received this device too. Having observed its activity. It doesn't steal any data. It simply setups a ssh dynamic tunnel and uses your network IP for accessing your Facebook account which you sold. Why? Because Fb locks the account the moment it's accessed from a different network from a different device. Can it steal your data? Absolutely yes! Does it steal? Probably no. Afaik, all they want is your fb account for which they pay you.

SmellyGeekBoy 8y ago

I'd understand why someone would be tempted to install something like this for $1500... Maybe even $150. But $15!? If you're that desperate why not get 3 friends to donate $5 each or something? I'm sure they'd understand if it was truly life-or-death.

novaRom 8y ago

The board is Nano Pi NEO. It costs $15 and contains quad-core Cortex A7 along with two USB (2.0) ports and 100 Mbit Ethernet. It is about 25% of size of RaspberryPi. By the way, the same Chinese company now offers a much more powerful board called Nano Pi M4 which is just a bomb with respect to RaspberryPi B+ if you look at its specifications.

amelius 8y ago

Most of whatever their router sees, their ISP sees as well. So I understand they are upset, but the panic is not warranted.

the_clarence 8y ago

Can someone post the image here? I have blocked reddit on my phone.

cupar 8y ago
https://i.imgur.com/W30vAXk.jpg https://i.imgur.com/W30vAXk.jpg

tonyb 8y ago

Is a disk image of one of these available anywhere? I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server. Plugging a device into your network doesn't make it magically see all the traffic. It would have to be doing ARP spoofing, DHCP hijacking, or hacking the router config/firmware. Is it possible that it is doing some or all of those things -- sure. But why? That could all be done via a malicious client executable that would give you access to the network and much more and is much more discrete than a physical box, so why would someone go through the trouble of shipping out a box + paying the recipient? The more simple explanation is the sender of the device is doing nefarious actions on the internet and needs a bunch of IPs for cheap so when they get blocked they can just move on to the next IP. Would I put one of these on my home network - hell no. But if one of my friends tells me they had one plugged into their network I wouldn't immediately assume that their entire digital life was compromised. I would tell them to unplug it though.

wstuartcl 8y ago
Well if they are willing to break TOS to sell ads on facebook how much further do you need to go to rationalize auth capture, rootkit injection or any other malicious activity. "Plugging in the device on your network doesn't make it magically see all of the traffic" ... Assuming it has not been constructed to do all of the things you list (or more) does not magically make it not see all of your traffic either. There is no magic involved, it is either constructed to capture/inject or not -- the only way to know is to review the actual bits and firmware.
- ams6110 8y ago
  Unless you work in a SCIF (and probably not even then) your local network should not be considered trustworthy. Assume that hostile activity is always present. Especially if you have "appliance" type stuff on your LAN, such as ISP-provided routers, Amazon/Google devices, smart light bulbs, etc. Keep your machines and firewalls updated.
- 8y ago

arayh 8y ago

It seems like they're fishing for gullible Facebook users on Craigslist. I found an example of a Craigslist posting that tries to "rent" your Facebook profile: https://image.ibb.co/dzT9j9/rent_facebook.png https://image.ibb.co/dzT9j9/rent_facebook.png

wstuartcl 8y ago
My guess would be either a MITM auth capture, rootkit inject or someone (even a nation state) trying to attribute sources of illicit facebook ads/posts to unsuspecting citizens. I would not touch that with a 10 foot pole.