3 ms·

Kind of amusing that this is currently the #2 story, while #1 is "Trust Is at the Core of Software Marketing". If you had told me five years ago that I would s

by _jal 7y ago

Kind of amusing that this is currently the #2 story, while #1 is "Trust Is at the Core of Software Marketing". If you had told me five years ago that I would stand up exfil monitors on my home network because commercial and criminal surveillance was so pervasive, I would have said that would be crazy talk. And yet here we are.

dredmorbius 7y ago
What are you using for this, what is blocked / how do you construct blocklists?
- _jal 7y ago
  This is very much a new work in progress. Basically, DNS logging forwards to a daemon I wrote that detects Base64/UU/other encodings in DNS requests and asks the network manager[1] to shut off connectivity to the client asking such questions. There is a volume-of-queries timer, and I have some other ideas to add to it. I'm working on a TLS-inspecting proxy with squid and sslsplit, as I expect there's a lot to look at. I very much want to know if something emits any of various magic numbers - SSN, bank account numbers, address book entries, IMEIs, etc. As far as more general blocking, I use parts of Pihole, which merges with some other data sources, to defeat DNS resolution for folks I don't want on my internet. And I use Maxmind's geoip data to generate iptables rules to block most of the world on public facing infra - my tiny user base is not in most of it. [1] I use Unifi gear, this will do you no good if you don't: https://github.com/Art-of-WiFi/UniFi-API-client https://github.com/Art-of-WiFi/UniFi-API-client
  - dredmorbius 7y ago
    Thanks. EFF's analysis of Amazon Ring egress traffic mentions some possibly useful tools for inspecting SSL/TLS traffic. Specifically: mitmproxy and Frida. https://www.eff.org/deeplinks/2020/01/ring-doorbell-app-packed-third-party-trackers https://www.eff.org/deeplinks/2020/01/ring-doorbell-app-pack... (https://news.ycombinator.com/item?id=22165568 https://news.ycombinator.com/item?id=22165568)

by _jal 7y ago

dredmorbius 7y ago

What are you using for this, what is blocked / how do you construct blocklists?

_jal 7y ago
This is very much a new work in progress. Basically, DNS logging forwards to a daemon I wrote that detects Base64/UU/other encodings in DNS requests and asks the network manager[1] to shut off connectivity to the client asking such questions. There is a volume-of-queries timer, and I have some other ideas to add to it. I'm working on a TLS-inspecting proxy with squid and sslsplit, as I expect there's a lot to look at. I very much want to know if something emits any of various magic numbers - SSN, bank account numbers, address book entries, IMEIs, etc. As far as more general blocking, I use parts of Pihole, which merges with some other data sources, to defeat DNS resolution for folks I don't want on my internet. And I use Maxmind's geoip data to generate iptables rules to block most of the world on public facing infra - my tiny user base is not in most of it. [1] I use Unifi gear, this will do you no good if you don't: https://github.com/Art-of-WiFi/UniFi-API-client https://github.com/Art-of-WiFi/UniFi-API-client
- dredmorbius 7y ago
  Thanks. EFF's analysis of Amazon Ring egress traffic mentions some possibly useful tools for inspecting SSL/TLS traffic. Specifically: mitmproxy and Frida. https://www.eff.org/deeplinks/2020/01/ring-doorbell-app-packed-third-party-trackers https://www.eff.org/deeplinks/2020/01/ring-doorbell-app-pack... (https://news.ycombinator.com/item?id=22165568 https://news.ycombinator.com/item?id=22165568)