IP Reputation Laundering

Hi, this is Dan Gooden, security reporter at RS Technica and you're listening to Firewalls Don't Stop Dragons. Hello, everybody. Welcome back to Firewalls Don't Stop Dragons. I'm your host, Kerry Parker. Today we have episode 502 for October 12th, 2026. Got a great interview for you today. We're going to be talking with Dan Gooden from RS Technica and Dan's been writing great stories for many years and I've read several of them here on our new shows, mostly from RS Technica, and maybe it seems a little bit of a meta thing to interview a journalist, but I've been interviewed about security and privacy too, so it's a thing that happens after reporting on something for a long time. You definitely develop some expertise and Dan is one of those people for sure. So we're going to have a great talk today about residential proxies and we'll define what they are, but just real quickly it is basically when I want to use the word bad guys, it's not always bad guys, but it often is, are able to use devices in your home as a kind of a stepping stone or a bounce off point, a proxy for their internet traffic, meaning that when they attack a website or scrape a website or do something that's a little bit shady, the IP address that appears to be doing it is yours not theirs. And what allows them to do this is there are either compromised devices in your home or devices where you have loaded shady apps and you may not realize they're shady onto those devices that have built in proxy services and so there are companies that sell these proxy services to others and this is often unfortunately how they are used. So we're going to find out more today about what those are, how you recognize them potentially and what you can do to prevent them. So we do talk about a few things I want to bring up, we talk about botnets which we will pretty much define in the course of the interview, but we talk about DDoS attacks, DDOS or distributed denial of service, the distributed part being many many devices acting in concert to collectively send a lot of traffic towards a server that they want to try to bring down because there's too much traffic or cause it to be unresponsive. That is a distributed denial of service attack and botnets are often used for that purpose. Dan also talks about password spraying and this is where the bad guys have a list of known passwords because many people will reuse simple passwords if you've ever looked at the the annual list of the worst passwords, meaning the passwords that were most often found in a list of compromised passwords. You know, you'll still see people using 1 2 3 4 5 6 password or password with a 0 things like that, but if you try to brute force a given account by trying multiple passwords, often those accounts will lock you out after so many bad attempts. So in a spray attempt, you're really kind of spreading that out and trying multiple different accounts with the same set of credentials hoping to get in. So that again, these botnets are good for enabling that sort of an attack. And finally, we talk a little bit about home networking stuff in which we bring up the concept of NAT and AT that is network address translation. And it's a little hard to describe, but when you've got a single public IP address that is given to you by your internet service provider or more technically given to your router, that is the IP address that your router shows to the world. Every packet that leaves your home network regardless of what device it comes from will have that as its return address. Though internally, all your devices have their own private, not globally routable IP addresses. That's one way we got around the limitation of 4 billion IPv 4 addresses. We've got way more than 4 billion devices on the internet now is we have this NAT function which lets us have a whole range of private IP addresses that the world doesn't see and can be reused in everyone's home around the planet. And your router takes care of mapping the single external IP address to the multiple private internal IP addresses. That's a NAT function. And one bonus to doing that is that really means that it's really hard for anybody on the global internet to individually try to route malicious traffic to some device on your home network because they're obscured by your router. So as the link we're going to use today, so let's get to our interview with Dan Gooden and learn all about residential proxies. Dan Gooden is a senior security editor at Arshtenica where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. He's been chronicling the exploits of hackers since 2005 as a reporter for the Associated Press and later the register. Dan, welcome to the show. Thanks. Great to be here. Very happy to have you here. I've wanted to have you on the show honestly for a long time. So I'm glad we're making this happen. And we've got a great topic. I've covered several stories this year dealing with residential proxy networks. And while botnets have been around for a long time, it seems like using compromised devices as a pass-through or a stepping stone has become very popular recently. I don't think many people understand what they are or realize that they might be facilitating malicious network traffic right now without realizing it. So I thought you'd be an excellent person to help explain these and how we could avoid becoming an unwitting accomplice. So before we get into that, how did you get into security journalism? You've been covering this for a long time now. I'm curious like how have the trends changed over time? What have you noticed and then what threats concern you the most today for ordinary people? Well, I got into security reporting really by accident. I was a Silicon Valley reporter for the Associated Press and hacking and botnets in particular started becoming mainstream news. And so they needed somebody to cover it. And I was the technology guy. So they put me on it. So it was kind of like lambs to the slaughter there. So, you know, at the time I wrote about a, you know, I think the first one I did was about a couple teenagers that had started a botnet and were using it for some really just kind of petty cyber crime. And the federal government, you know, justice department went after them really hard and really tried to make these guys an example. And, you know, meanwhile, there were a lot of more pernicious types of attacks largely being perpetrated by nation states that didn't seem to ever really get their attention at least publicly and in terms of indictments and that type of thing. And for a long time, we really continue to focus more on the threats to consumers, botnets, you know, you had all of these computers that were infected and you know, we're being used in DDoS attacks and that, you know, those types of attacks, you know, over really starting in about 2016 to focus really shifted more to nation states. So you had, you know, two different hacking groups from Russia that were caught inside of the campaign networks of both the Trump and, you know, opposition basically trying to get whatever they could from, you learn about the election that was coming up. And then, you know, subsequently, you know, the hacks that led to the release of a lot of the confidential information from, you know, democratic party and that type of thing. And, you know, if we get to today, you know, we're seeing really a confluence of hackers. I mean, there's just way too many, too many stories for any reporter really, you know, organization to cover. And so it's, it really went from kind of a snoozer kind of beat that nobody really even understood why you would have a reporter who covered this thing, you know, really kind of a niche beat to probably one of the biggest beats that most publications have. Yeah. All right. So let's talk about these residential proxy networks. First, obviously, what exactly are they? How did they work? And why have they become such a useful tool for cyber criminals? Well, defenders have gotten pretty good at knowing when their servers are being accessed by an adversary. There are a lot of telltale signs. The IP address is obviously one of the biggest, but there's all kinds of like infrastructure that these folks can use. And those leave signatures that the defenders can recognize and then block. So if you are a hacker, the question becomes, how are you going to get in there and not get blocked? Right. And so residential proxies have been around for at least a decade, probably well over that. They didn't get a lot of attention. To the extent they did, they were usually residential proxies that were being used by nation states, most particularly Russia and China. And, you know, China in particular, they have always wanted to get their tentacles into basically every nation's infrastructure, particularly their critical infrastructure, that they can just, you know, it's kind of like a rainy day fund. We ever need this thing. Yeah. A lot of the speculation is if tensions over Taiwan ever really come to a head, they can very quickly target, you know, anything from water plants to, you know, any other kind of critical infrastructure. And, you know, similarly, Russia was looking for ways to obscure attacks that they're doing on the federal government and all kinds of other ways. And so then it becomes, well, how are we going to do that? How are we going to keep the defenders from recognizing that it's us that's inside their network? And, you know, the simple answer is, well, let's compromise, you know, thousands or hundreds of thousands of ordinary users who are connecting from, you know, Comcast or, you know, whatever ISP. And we will use all of our infrastructure up until this Comcast user's router. And then everything goes from, from their infrastructure, it comes out into the target as just looking like a Comcast IP. And so these IPs have relatively high reputations, people don't, you know, the defenders think that it's just one of their customers or they think it's one of their employees who's logging in remotely. And, so it became a great way to disguise the origin of malicious parties, attackers, essentially. So from there, the attention has now come to just ordinary, you know, more plain vanilla, financially motivated cyber criminals who face the same problem. In some cases, they are trying to, you know, I mean, if you're in, I don't know, the Eastern nation country, and you are trying to, you know, like do password sprays, you know, and compromise accounts, or you actually have a compromised account. Again, it's going to look suspicious of the defenders are going to give a lot more scrutiny to one of those IP addresses. So, so what do they do? They embrace the same strategy and they take over networks. And more recently, what we're seeing is scrapers, largely from AI companies. And they are banned and can face potential, you know, legal consequences if they go into Reddit or most publications and just sort of steal all of their content. And of course, if they use a central infrastructure to download huge amounts of it, you know, Reddit is once again going to get wise to that and shut it down. So what if you use hundreds of thousands, you know, you distribute the scraping across hundreds of thousands of routers that all have IP addresses with good reputations. And you just take a little bit and then you assemble it all on the other end. And so we're now seeing it for these other purposes as well. Essentially, the AI companies have borrowed the page of nation state hackers and cyber criminals. So yeah, I don't know how many of the listeners know this, but your IP address, which is generally fixed, your IP, your ISP can change it over time, but they often don't have a reputation. You can actually look it up. There are tools you could use gray noises, one that I've used that I kind of like. And it will tell you if your IP address has been associated with malicious activity or other nefarious purposes, and these groups are basically fine that they are IP washing or traffic laundering. Coming up with other terms for this, but they're finding ways to make it look like it's coming from you like regular everyday human traffic as opposed to from a known bad IP address. Did I get that right? Yeah, that's exactly right. And essentially they are you. They're coming through your device. So they're not they they have basically terminated the connection is being made to the target from the benign device or the benign appearing device that's belonging to, you know, some 65 year old retiree who, you know, just uses word old or, you know, something like that, right? And so they have no idea that this other traffic is going out at the same time. Right. All right, so we already talked a little bit about who builds and operates these networks, but are we mostly it does seem like it's been at least in the news more? Is that just because it's getting more attention and it's always been there or has there really been a shift? And then there's also a you kind of alluded to this as well, like semi legitimate residential epoxy companies that are really kind of blurring the lines. There are these apps that you couldn't install on your smart TVs that would have ads normally, but like, hey, if you don't want to have ads, then let us use your unused bandwidth. And some of these are public companies that are that are putting these apps out. Explain why it's been seems more popular recently. And and maybe some of these more fuzzy actors that are doing quasi legitimate things. Well, it's it's hard to know what a true legitimate use would be. I mean, if you mean legal, and the company discloses it somewhere in their, you know, 10,000 word terms of service, then it probably, you know, it might pass legal muster, but it's really hard to know. I mean, if you want anonymous browsing, use tour, right? You know, like why Tiggy back off of some unsuspecting person who didn't read the terms of service or in many cases has had their device completely compromised. In which case, you know, you're talking about federal hacking statutes that would apply. So, I mean, certainly there are reasons to want to browse anonymously, but you're not really browsing anonymously if you're using somebody else's traceable IP address. And you know, the ethics of that seem highly questionable. That answers part of your question. Why have they suddenly become noticed and reported so much? I think partly, I don't have data on this, but I think that these proxy networks have really moved into the main stream. And, you know, we're hearing from Brian Krebs did a great report this or last month on a botnet that was operated by a publicly traded Israeli for a massive number of connected devices. These are, you know, basically residential internet connections. I think Google was measuring it like in the millions, maybe tens of millions of devices. So, this is a sprawling ecosystem. I think it's gotten bigger. I think there's more money involved. And so as that, you know, you know, essentially it was the nation states doing this kind of thing. And maybe, you know, some cyber criminals doing it on the side, you had some botnets that would advertise on like gray markets or dark, you know, dark markets about these services. And you'd like need to pay in Bitcoin or other types of things to use them. But, you know, it was basically the smaller actors that were doing it. And then the money makers, you know, decided, hey, let's turn this into into a big business. And so as that has happened and more and more, I mean, it's just become a huge problem for, you know, Google and Cloud Flare and all of those folks. And so they have initiated a number of takedown campaigns. Really a better term is that takedown would be disruption campaigns. And I think that's probably why we're hearing a lot more of it. The Brian Creme story, if anyone's really interested in this, should go back and read it because it gives a lot of, you know, good information about that. I mean, the headline is popup, p-o-p-a, botnet linked to publicly traded Israeli firm. And it has a lot more information than just that. So I think, you know, Brian kind of crystallized what has been happening for, you know, last couple of years in that single article. All right. Well, real quick. You mentioned botnets. And this is similar to that. Can you explain real quick to the audience how you would differentiate your botnet versus a residential proxy network? Well, a residential proxy network is essentially a subset of the things that people use botnets for. So, you know, Amy botnets were created to just wrangle hundreds or thousands or in some cases, millions of computers owned by, you know, small offices, some in some cases, corporations, but mostly like residential people, you know, particularly back in the days when computer OSs were so porous and poorly secured. And, you know, the idea was I can use these things essentially, residential, I can bounce myself off of that. But I can also do other things like DDoS attacks, password, spraying, where you distribute a ton of password guesses across hundreds of thousands of different users. And the odds become, when you do it at scale, the odds that you're going to start compromising an account, even if it's 0.5% is high enough that you can get 100% compromised accounts. And so they started being used for things like this. And so not everything was used to obscure your origination of your connection. But that was always a small part of it. But what Brian was uncovered is that the POPA botnet was actually-- it was leasing itself out to lots of people, including this Israeli firm. They're saying, hey, we got a bunch of bots. And if you want to use some of them to obscure your connection, then pay us a monthly subscription fee. And what has also happened now is that a lot of these botnet allow-- well, a lot of the people that are using-- I have a subscription can then white label stuff and start selling it almost as like an affiliate or something to other people. So they can end up making money off of it. So hopefully that gives you a good explanation of the difference-- botnet is a much bigger ecosystem that's used for many more purposes. And the proxy service is just one of those services that can thrive because of the botnet. I just think it's hilarious that even the criminals are going to subscription models. It's worth money. On going revenue, it's hard to beat that. All right, so our routers, our home routers, are the things really on our home network that are directly exposed to the internet. There are gateway between everything that's on our home network and the broader internet. So it kind of makes sense that those might be vulnerable. So I'm curious is how home routers are typically compromised. But also, it's not just our routers. It's devices that are in our home as well. And they're supposed to be protected by our routers. Our router is kind of like the balancer for our house, right? I mean, it's got the NAT function and a firewall function. That's not supposed to let malicious traffic in. So it should kind of isolate or protect those home devices. And yet, they're still being compromised. So how are our home devices getting hacked, too? Well, in many cases-- so first of all, yeah, then the NAT is designed to prevent any authorized external parties from being able to access particular ports on, say, your TV or your connected computers or those other types of things. So it essentially is a firewall. And it says, you can connect over port 80 or a handful of other ports that we know about and are generally locked down, but you can't connect over a port that's used for SSH or other types of things like that. So that created a problem for the attackers. Well, like we used to just exploit an unpatched vulnerability in a browser or the operating system. But now that we can't access those device ports, what do we do? Well, it turns out that these routers-- they ship with a version of Linux that's already like woefully outed. So if there are certain types of Linux vulnerabilities that make their way into this router firmware image, they might be able to exploit that. So there are a number of vulnerabilities that are reside directly in the router and in the router firmware. And a lot of times, the device makers will push out firmware updates. But firmware updates are a hassle to install. A lot of us and a lot of your listeners know how to do that. But I'll bet you a lot of your listeners don't. And there's nothing-- it's no fault of their own. These things are cumbersome. They've gotten better. But the other thing is that device makers, at some point, put their older devices out to pasture. And they just say, we're not going to issue any more firmware updates for this. And so as vulnerabilities are discovered in those older devices, there's really no way to lock them down other than some kind of esoteric things like installing open source firmware known as WRT. But again, that is out of the capabilities of a large percentage of device owners. So that tends to be the way that people get into the routers. But let's say that somebody has a pretty good router. And there are no known exploits available for it. What do you do that? And the answer has been to create apps that appear or possibly even do have legitimate purposes, but have functionality in them that provide this proxy service. And so you're seeing a whole ecosystem of really low cost streaming devices, you're seeing VPNs, other types of things. And again, they either don't disclose the proxy functionality at all, or they bury it deep in the terms of service that nobody ever reads, like the POPA botnet, for instance, that Google just performed a disruption campaign on, was seeded largely with apps that were built using a software development kit. Essentially, a whole bunch of pre-installed APIs that eliminate the hassle of a developer having to go right their own really low-level code. They can just sort of plug in a bunch of stuff. And so they will write their streaming app, for instance, using these SDKs, software development kits. And these apps will then have the functionality built in that perhaps the developer doesn't even know, right? Or perhaps they do. So that, you know, and kind of the same thing with VPNs and other types of things. And so this has now become one of the go-to ways to build these massive, you know, essentially proxy services. I mean, I mean, in a sense, they're just botnets, right? But they're really just used or mostly used for just these proxy services. Well, and now once you have a device that's on your home network that has been compromised, either by malware or by your bot installing an app that was kind of shady and includes perhaps one of these SDKs, or buying a really super cheap Android streaming box that has this kind of functionality built in, I always liken this to inviting the vampire across the threshold, right? Once they're in your house, once some device in your house has been compromised, it could be used as a beachhead to compromise others. Or just to do reconnaissance inside your home looking for data or something. How often do we see that happening? You know, it's getting increasingly hard to use, say, your router to infect other devices inside your network. That's a lot of work. It can definitely be done in a nation state that has a good reason to do that, could, and probably does do that. But, you know, I mean, really the bigger worry is just that your bandwidth is being stolen, which may or may not be a problem. But, you know, if you have caps on the amount of bandwidth, you can use each month and then that could be a problem. You know, so like that's not the biggest worry, I think. Although, you know, you don't want anything inside your network. I mean, I just don't know how easy it would be for somebody to use your, you know, Samsung TV to go and start sending malicious packets to your printer or whatever. - Yeah, printer or Denon receivers, something like that. And it's questionable how, you know, what the real benefit would be. I mean, what can you do? I mean, I guess the printer you can sometimes see what's being printed. But, you know, and it's somebody, if there was a way to send packets from your TV to your Windows device or your Linux device, Apple device, those OSs are pretty well locked down. You would probably have to use a zero day that would cost, you know, $1,000,000 or more. And nobody's gonna, you know, like these are not the types of zero days that somebody's gonna burn for some kind of petty purpose like that. - Well, and I will also think that one of the benefits to them of you having one of these devices as a proxy is you not knowing about it. So, I would also think they probably wouldn't want to draw undue attention to themselves. They would get much more use out of you if you had no idea that your Samsung TV is compromised and being acts as a proxy for their network. - Yeah, that's exactly right. So the other thing though is if, and you alluded to this earlier though, if someone uses one of my home devices to do these bad deeds, my house, something in my house is being used as a proxy. The digital trail leads back to me or my router anyway, which leads to me. So has this landed regular people in any kind of legal trouble? If this happens, let's say, yeah, some bad attack is coming in one and my IP is being used as part of this attack and the FBI whoever comes not going to my door. And I think we'll be able to tell that, okay, talking to the ISP or looking my devices, okay, this is wrong. Through your house, you weren't the actual person doing this. You know, there aren't a lot of reports of that type of thing happening. I remember, you know, 20 years ago doing some reports on people that were running, you know, tour exit notes, you know, being, you know, rated in the middle of the night. These were, you know, for instance, one particular exit note overseas was somebody was using it to download or view a lot of like child sexual abuse material. And so the authority thought that this person was doing it, you know, that this was, you know, I mean, they, you know, they didn't even know what a tour exit note is. Funion router designed for anonymous browsing and it routes traffic through three different servers. So the origin doesn't know who the destination is, the destination doesn't know who the origin is. So it's got to come out somewhere from the tour network back onto the internet. That's what an exit note does. And so this person's IP address was being used to facilitate this horrific crime. So you, like, I mean, I think it would take something of that level. I mean, if, if one comcast address participates in a password spray that, you know, it's, it's such an infotescal part of the overall attack that to go after everybody would, you know, be, it wouldn't scale. And on top of that authorities and, you know, the defenders inside a Google or cloud player now recognize, oh, this is a residential proxy. This is going to be some, you know, 32 year old school teacher who doesn't, you know, they just want to connect to the internet. You don't want to have to be an IT admin. So, you know, like they, you know, you're not, I mean, if it's happening, it's not, it's not super visible that individuals are being targeted or prosecuted or at least accused by authorities of some sort of crime. Well, and, and again, even if they don't eventually come back and adore yours, you are still passively facilitating crime. And you might not be knowing it. So it's still we're going to get to how we can maybe try to prevent this in a second. But I want to come back to something you talked about earlier, because this is important. We, we've, I often read headlines about this on, on my new shows. And we read one recently that you're referring to, but there's been several about like the FBI and other agencies who have quote unquote taken down a botnet or taken down a proxy network. You alluded to this. Let's take into more like what does that really mean? And because you even said it's more like disrupted rather than killed or eliminated. So why, why did you make that clarification? And then to follow up all the devices that were part of this proxy network are probably still compromised or at least still vulnerable, right? In many cases, they are compromised. So, so the these campaigns typically work by seizing the IP address and the domain name of that were used to facilitate the botnet like a command control server. Yeah, essentially, or the or the residential proxy provider who's tapping into the botnet. And so, you know, but the the software continues to run on the TV, you know, or the malware on the router continues to be there. Unless, you know, in rare cases, the FBI has gone in and issued commands to a pool of IP addresses that they have identified as infected that will either reboot the router, you know, do something to remove the infection. So that does happen, but generally it doesn't and it certainly doesn't happen when Google or cloud player, some of these private players are initiating a campaign. So the devices do continue to run this software or malware that has these functionalities. And in many cases, there are ways that the botnet operator can go and reach these devices and just tell them connect to a whole bunch of new infrastructure. Right, so it's really more of a disruption, it kind of like knock something out, you know, it might knock out, I'm just going to pick a 70% of the capability of a botnet and then these operators need to scramble and find a way to like resurrect this botnet and get it back. And they may or may not be able to do that, but they can always just compromise more and start all over again. And you know, we've even heard of the cases, I think crems was reporting this that somebody who gets taken out will then just start buying services from one of these other white label people. So that they don't, you know, they're, you've just driven up their costs because now they're paying for something that they used to, you know, have for three. But, you know, I mean, I used to work at a restaurant and when we ran out of pizza restaurant, when we ran out of cheese, we'd go to our competitors and say, hey, can we buy a bunch of cheese? You know, we need something to screw it for the next rate. And so, you know, is that a real disruption? You know, I mean, is that a real take down? I don't think so. But, you know, it does make their life harder and it kind of puts them on notice. But, you know, it's, once again, it's just the classic game of whackable that has, you know, been the sort of the central type of dynamic in cyber security for three decades. You take one place down and two more pop up and you're just constantly scrambling to, you know, and you're reacting. You're not doing something proactive. So, you know, in some cases, you know, Google killed a bunch of the Android SDKs that were using these types of things. But if it's an unauthorized box, again, it's not clear if that would have much of an effect. Right. Yeah. So, whatever it was that initially got them compromised, whatever it was that it'll let someone else mind control these things basically from a distance is still there. It's just you took away the thing giving instructions. It's really clever the way these guys have figured some of these things out like a lot of them have built in algorithms that on a regular basis based on the time of day and the day of the week, like the date. We'll look for a different command and control server like a randomly generated domain name that with an algorithm that both the controller and the control ease know. So that on a regular basis, it's looking into a different place all the time for a command control server. So that the if we take one down in the bad guys know what the algorithm is, they know that all these millions of devices out there are going to check. Because they have the same algorithm, we're going to start looking for these other new command and control servers, which they can just stand up in a different place, right. That's true. I think one of the first cases of discovering that type of capability was with malware from a decade or two ago called Conficker. That the it makes defenders job a lot harder because they now have to, you know, so they're able to reverse engineer the algorithm and figure out like, okay, here's here they're going to be the new domains that open up. But sometimes it's a new domain every day. So that means that they have to now go and proactively register these domains so that they can sink all them. And so it becomes a lot harder. I haven't heard of that technique being used a lot recently. I think maybe the, you know, I mean, eventually the defenders just saying fine, you know, we will register these things at scale. And so it may it may just be that ultimately the return on investment diminished enough that the technique isn't being used a lot. I wouldn't be surprised if it's being used somewhere. But I would suspect it's in rarer cases, probably for much more advanced attackers. Well, one more thing I want to make sure I draw attention to the mentioned very briefly, but it's a really kind of a big deal. And that is whether or not the agencies like let's say the FBI or recently is a Canadian spy agency, which I forget their initials, but had to go to their local court. I probably federal courts in both cases to get permission to actually kind of hack back like to we know there's these 100,000 devices out there that are compromised. We know how they're compromised. We want to uncompromise them. But that's basically your government hacking into your thing and they don't have time to go to 100,000 people and ask for permission so that they just get a court to okay it. That's a big deal. What first of all, how often does that happen? Second, what's your opinion on that? That's that's controversial. Yeah, it's you know, a decade ago it was considered for a boat and you know there was a lot of liability because if you go in somebody's network and it's being used to monitor their blue coast level and they have like type two or type three diabetes and you disrupt that thing and they have an injury or having forbid die you've got a lot of liability on your hands and you've also got you know quite the ethical dilemma and so I don't think I mean mostly what these agencies are going to court for is permission to seize the domains and the IP addresses so they say we you know like this is some kind of bulletproof hosting provider that won't cooperate with us and just turn these these domains or IP addresses over so we want you to legally allow us to like essentially turn over storage in or ownership of these addresses to us you know but but there was at least one case that the FBI covertly issued command to remove a bunch of routers and even that is kind of a big deal I don't hear people kind of yelling about it the way people did a decade ago I think partly because you know maybe disinfecting a router often just involves setting a simple reset command or a reboot or something like that routers reboot periodically anyways so you know like whereas if you're going into somebody's windows machine and disinfecting it you know you're messing around with the registry you're messing around with a whole bunch of other stuff and so the chances of something going wrong are much higher so you know it but even you know it's not common that people are reaching into somebody's network and sending commands to a device there it it does it has happened but you know like even with blanking on the name of the malware but it was one of the early cases of Russia being caught infecting massive numbers of routers in the US and in that case the malware didn't survive a reboot so you know the FBI just issued an advisory suggesting that everybody right and it doesn't matter what your brand is like plug it count to 10 plug it back in you know so that tends to be a little bit more of the way that I think people are are trying to go about this well the UK and I think the US has got some of this as well has offered to do some scanning your residential networks and to actually alert people I think I think that might be interesting if we can come up with some sort of way where there's a dedicated way to let you know that hey your IP might be doing something weird call us if you want some information or hear some tips or whatever but you might want to like you said reboot so last question and this is the most probably the most important one I think what do you do what do we do about this what do we tell people to do how do we is there any way to know that one of our devices is gone rogue that has become part of a network and then proactively speaking how can I prevent this or what's some good hygiene and rebooting is a big one because a lot of these hacks only live in memory a lot of these devices don't have a hard drive so a lot of these things are only hacked while they're running and if you reboot them they kind of go back to a default state and that the malware tends to go away that's something you've already talked about what what what else can we do to prevent or even detect this there are a number of services that will scan your IP address you can connect to their website and say yes I authorize you to scan my IP address they look at your local IP or excuse me they look at your wide area IP address that's that's the one that's issued by the ISP and they will scan and see like are their ports open and if there are ports open there needs to be a good reason I have a specific device that I'm using to do this thing I trust the device to not be able to be scanned and and then exploited if there are a number of ports that people don't recognize or I mean like most people really don't shouldn't have exposed ports at all right it's so if there if there are multiple ones and you don't understand but but once again if you're the 32 year old school teacher and you see that you know port 1557 is open what does that mean how are they supposed to to know so these scanning services really don't work for a large percentage of people who are on the internet and so you know it's very difficult for these folks to know I mean and then the rest of the advice really requires people to spend money it means that once your once your router goes end of life you replace it yeah a lot of people want to do that for understandable reasons and you know kind of the same thing with uh you know with with TVs or other types of things a lot of the the streaming services that are either obscuring the functionality completely or varying it in their terms of service they're offering free streaming services essentially is pirated material so you know one thing is to steer clear of those you know I mean there's no such thing as a free lunch those types of services are very very enticing because you can save huge amounts of money but they're too good to be true you know there's the proposition is is probably not worth it so unfortunately most of the things that people can do are going to require at least some amount of you know spending money at least periodically beyond that I mean installing router updates you know I mean they're not impossible they've gotten a lot easier over the line it's it's not a bad idea to every three or six months or even 12 to take the time to open up the the web interface for your router and check if there are any updates and you know kind of same thing for your your TV or your streaming device um you know you go into settings and you know you check it does require a little bit of you know extra time and and and learning but it's certainly not it certainly is possible and within the the capabilities of you know this 30-year-old teacher or the 65-year-old retiree to do at least for many of them and you know I mean those there's really nothing that's perfect but those are are probably you know in in a course the OS updates are are them you know in the phone updates most important you really want to make sure that those are installed within a week fortunately a lot of the OS is are now doing it automatically you know set it to do automatically if it's too much of a hassle just do that most of your browsers will update automatically now so a lot of times you don't really need to worry about it but it's not a bad idea to periodically just make sure that the automatic updates are working as as intended all right Dan that's great advice thanks so much for coming on the show it's been great talking to you I would love to have you back in the future okay it's been fun thanks a lot thanks again to Dan for coming on the show I know he was kind of short on time so I was really glad to get an interview in with him I've been wanting to talk to him for a while so I'm glad that happened and I hope we can bring him back in the future so some follow-up notes from that interview first of all gray noise is a great tool I'll put it of course on the show notes and everything I'm about to talk about I'll make sure there's a link in the show notes that can check the reputation of your home IP address and it's one way you might be able to tell if there's some sketchy traffic coming from one of your devices it's not a guarantee thing but it's you know it's a check worth trying and for some reason you don't get the nice green all clear banner at the top that might be a reason for you to go and you know take a look at your devices and make sure they're all doing okay I will say that if you haven't already you should learn how to update your home router's software and keep it up to date if you're lucky your router has an auto update function which may or may not be on by default so you should still check that and if you find that setting and that's not enabled I would definitely turn that on my router actually has a setting that lets me periodically reboot it as well which as we've learned from today can actually be a good hygiene thing sometimes if your router has been compromised just rebooting it will often clear it because most of the malware for these appliance type devices these IoT devices don't have a way to persist like on a hard drive because these devices generally don't have hard drives so the malware just exists in memory and if you reboot the device that will flush the memory but I'll also say it's just good hygiene because your router is is sending packets back and forth constantly because all your devices even if you're not using them are probably doing background checks for software updates and things like that so there's a lot of traffic running through that and if the routers not doing its job properly you can kind of build up some craft there might be buffers and memory and things that start getting cluttered over time and a reboot will will clean that up and give it a clean slate so it's it's actually a good hygiene not just for security but for performance to periodically reboot your your home router now if you find that your router is so old that the manufacturer is no longer supporting it and no longer making software updates for your router that's you're a kid. that you probably should look for a brand new router. You definitely want a router that you can keep up to date. But as Dan said, if your router supports open source firmware, like OpenWRT, again, check the show notes for a link, then you could reflash it with OpenWRT, gives it your own custom software. It's kind of like installing Linux on an old Windows PC. You could change the operating system. And then if it does support that, then you could get security updates from OpenWRT, you can give your router some extra years of life potentially. Now, I think Dan mentioned some tools that you might use to scan your home router for open ports. And I'm not going to get too technical on that, but your router basically should be a one-way data valve. There should be a firewall there that prevents unsolicited incoming requests. And if your router's old enough, or maybe if you've been using it for gaming, and you might have opened some ports in your firewall, that would let somebody from the broader internet, basically anywhere on the planet, poke around at your router and try to find a way in. And so if you're not sure whether or not you might have open ports accidentally or on purpose that you've forgotten about, there are tools that will help you do that. One that I usually refer people to is called Shields Up from Steve Gibson. It's been around forever. It does a very good job. And if you give it permission, it will scan your router from the outside and tell you whether or not you've got any holes in your firewall, basically. And if you've never done it, that might be fun just to try, just to see what it looks like. But a couple quick caveats. First of all, don't use a VPN while you're doing it 'cause then you won't really be testing your router in that case. And then also note that a lot of ISPs block some well-known ports because they don't want, often don't want people at home running their own servers, like particularly email servers 'cause a lot of times that usually makes them spam servers. So sometimes they will block some well-known ports and that blocking will actually happen at your ISP before you even get to your router. So I guess the net effect is still the same. Your router is unreachable on those ports, but just realize that scanning with Shields Up does have its limitations. But you know, again, it's worth doing and there's a link in the show notes. One more thing that you should realize is happening now that also might interfere with some of these IP reputation tests or port scan from the outside tests is something called carrier grade NAT, CG NAT. So we just talked about what NAT is because there are limited number of IP addresses and we're still kind of bumping up against that limit, some ISPs will actually do a NAT function within their network, meaning that it'll take a group of its customers and put them behind a single IP address such that when those customers, any of them go to a website, the return IP address they see is actually that carrier grade NAT address, which is not even your router's external address. So there's like multiple layers of NAT going on there, which may affect some of these port scans as well. (laughs) The internet is a complicated place and a lot of it has come from workarounds that we've had to put in for either security reasons or just IP exhaustion we've run out of addresses. But the good news is almost all of those are in your favor from a security standpoint, even if it's really just a matter of security through obscurity. All right, so the patron bonus podcast for this week, unfortunately Dan was on a tight schedule so I was not able to keep him around from my usual bonus Q&A. So this week's patron only podcast will be me. (laughs) Probably talking about some behind the scenes stuff and that will come out Thursday morning as usual. And then looking ahead, of course, we'll have a news show next week. And then as far as interviews go, we'll be talking with Tom Kemp next. He is the Executive Director for the California Privacy Protection Agency or Cal Privacy and was behind the Delete Act and drop tool and we're gonna get some updates from him on what's going on with that and just talk about privacy regulation and the current state of privacy and data collection in the US. And then after that, we'll have a really fun interview with Josh Nass. We're gonna be talking about ham radio but also some other interesting radio communication methods some that require licenses and some that don't. We'll talk about emergency communications and just some other fun stuff too. So that's gonna be a very interesting interview. Josh is a great guy and he has his own podcast so he's very good at explaining topics. That's gonna be a fun one. And then shortly after that, we're gonna have my panel for the best and worst gift guide for this year right before the holiday shopping season starts so that's gonna be a lot of fun. A lot of great stuff coming up. If you haven't already, subscribe and then you won't miss that. So there you have it. That's gonna do it for this week. Take care everybody. Stay safe out there. And until next week, as always, don't get caught with your droppin' stuff. (upbeat music)