4 ms·
Is a disk image of one of these available anywhere? I find it much more likely that these are being used for what they say they are (basically a proxy so they
by tonyb 8y ago
Is a disk image of one of these available anywhere?
I find it much more likely that these are being used for what they say they are (basically a proxy so they can buy ads from a residential IP) than some crazy MITM device. The "Attacker" is basically renting an IP connection or paying a co-location fee for their little server.
Plugging a device into your network doesn't make it magically see all the traffic. It would have to be doing ARP spoofing, DHCP hijacking, or hacking the router config/firmware. Is it possible that it is doing some or all of those things -- sure. But why? That could all be done via a malicious client executable that would give you access to the network and much more and is much more discrete than a physical box, so why would someone go through the trouble of shipping out a box + paying the recipient? The more simple explanation is the sender of the device is doing nefarious actions on the internet and needs a bunch of IPs for cheap so when they get blocked they can just move on to the next IP.
Would I put one of these on my home network - hell no. But if one of my friends tells me they had one plugged into their network I wouldn't immediately assume that their entire digital life was compromised. I would tell them to unplug it though.
- wstuartcl 8y agoWell if they are willing to break TOS to sell ads on facebook how much further do you need to go to rationalize auth capture, rootkit injection or any other malicious activity. "Plugging in the device on your network doesn't make it magically see all of the traffic" ... Assuming it has not been constructed to do all of the things you list (or more) does not magically make it not see all of your traffic either. There is no magic involved, it is either constructed to capture/inject or not -- the only way to know is to review the actual bits and firmware.
- ams6110 8y agoUnless you work in a SCIF (and probably not even then) your local network should not be considered trustworthy. Assume that hostile activity is always present. Especially if you have "appliance" type stuff on your LAN, such as ISP-provided routers, Amazon/Google devices, smart light bulbs, etc. Keep your machines and firewalls updated.
- gpm 8y ago> Well if they are willing to break TOS to sell ads on facebook What TOS? Facebooks? Why would they be bound by it?
- hankhill 8y ago...because they're selling ads on Facebook maybe?
- closetohome 8y agoWell personally I do see a small distinction between breaking a corporate TOS and felony unauthorized network access.
- sfoley 8y ago> Plugging a device into your network doesn't make it magically see all the traffic. Isn't that exactly what Wireshark's "promiscuous mode" does?
- nradov 8y agoFor wired Ethernet it depends on whether the traffic even reaches that port or not. Old dumb Ethernet hubs used to pass all traffic to all ports, but modern switches only send traffic to the intended destination.
- tonyb 8y agoIt will show you everything coming out of the switch port but only traffic to/from the connected device will come out the switch port. You have to use ARP poisoning or some other trick to get other network devices to send ethernet frames to your mac address in order for the switch to forward them out your port.
- slovette 8y agoYes. You’re right. These things don’t care about local traffic. SSL would ruin its day if that where the case. This is meant to be an agent to a network of these things. Not sure what the total point really is, but I can pretty much guarantee it has absolutely no cares about the local traffic.
- londons_explore 8y agoUnless OP is someone very special, all their private data isn't worth 15 dollars a month. I suspect this device is far more likely a broadband speed testing agency trying to get speed test results from different consumer ISP's, taking WiFi and the customers device out of the picture.
- wildrhythms 8y agoI disagree; the plug-in-this-Raspberry-Pi scam is unfortunately not uncommon, and not at all related to broadband testing AFAIK. A company called rentyouraccount.com runs a similar scam, and their service explains what the Pi is doing: >Facebook has several mechanisms in place to protect your account. We make every attempt to work within the these constraints. In order to keep your account from being locked we use a small device called a Raspberry Pi. This device allows us to connect to Facebook advertising APIs from your home network and avoids the hassle of your account being locked due to unfamiliar activity. Learn more about the Raspberry Pi below. https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/ https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour...
- londons_explore 8y agoSounds true, although I question why they don't simply install a proxy extension in the users browser. Would save them a lot of capital expenses.