How can I spy on myself?

Comments

• maf@szmer.info ⁨7⁩ ⁨months⁩ ago

  Oh, this the exact use case for a tool that I’m writing right now! It’s a daemon that runs on the gateway and acts as a DNS + DHCP + Firewall to monitor the activity of IoT devices.

  github.com/mafik/gatekeeper

  In the 1.6 (expected next weekend) I’m adding traffic graphs for each device and remote domain that it talks to.

  source

  • Gooey0210@sh.itjust.works ⁨7⁩ ⁨months⁩ ago

    I’m using adguard home, but your UI is a different level

    source

    • fox2263@lemmy.world ⁨7⁩ ⁨months⁩ ago

      It reminds me of the 90s. And that’s a compliment.

      source

      • -> View More Comments
• MigratingtoLemmy@lemmy.world ⁨7⁩ ⁨months⁩ ago

  Since we’re talking specifically about network traffic, let’s clarify the scope of the problem for reference.

  You want to see what is being sent outside, to the wide internet from your network, and how might you be compromised by this traffic.

  The logical method would be to snoop on this information. The question is, how would you do that?

  1. There are network analysis tools, including DPI, that might be able to help you in this journey. Suricata/Snort and Splunk are three such applications, although perhaps you’d also like to consider an application suite like Security Onion.
  2. The second problem is, how do you get the outward facing traffic to analyse it? The easier way to do this is to utilise port-mirroring - mirror the traffic through your WAN-facing port into an analyser to check just what is it that you’re sending out. Note that this will likely require extensive effort and time since everyone has different traffic they would like to check, and coming up with robust checks is entering the field of security professionals.
     • forum.openwrt.org/t/…/8929
     • superuser.com/…/mirroring-all-router-traffic-open…

  Some considerations:

  • As you know, most x86 computers have a backdoor installed in hardware. This is either the Intel ME or AMD PSP (if you know what this is and are worried about your privacy, I suggest looking at AMD’s OpenSIL initiative slated to release in 2027).
  • This is a problem since these backdoors utilise the same hardware NIC of your computer but act as a completely different system (different MAC, encrypted traffic using different keys, and a different style of traffic).
  • The problem manifests like so: one would reasonably expect to find the traffic from said processes in the traffic that one analyses, however, how would one find them (perhaps through logging their MAC address)? It is possible that Intel already uses dynamic MAC addresses, which makes it harder to find them - although, in theory, one should be able to script this.
  • Now that you’re enraged about such atrocious behaviour on your network, let me point you towards the fact that people who run mini PCs with x86 processors in them (for OPNSense/PFSense) should also be running into this problem, theoretically. It is a bigger issue for them however, since the network edge itself is reasonably compromised. How are you sure that the ME/PSP processor isn’t going to mask its traffic from the port-mirroring setup you have got running? How can one be sure of the capabilities of such proprietary systems and how they can mask their traffic?

  ---

  I know people will come up with “but they don’t spy on you! It needs to be explicitly turned on to spy on you!” and “get a thinkpad bro, modify the HAP bit!”, however, both arguments don’t hold much weight considering the hardware readily available to the common user (bit of a fallacy, but we’ll go with it). The point stands; such behaviour shall not be tolerated in a self-aware user’s network, and needs to eradicated the second the user gets a whiff of such mischief playing out. I hope my note has ignited a willingness in you to prevent such rabid deanonymisation attempts to one’s self in this age, and will spur you to fortify your network to prevent such malice from breaking anonymity and trust on hardware.

  source

  • s38b35M5@lemmy.world ⁨7⁩ ⁨months⁩ ago

    +1 for snort or securityonion.

    source
  • fiat_lux@kbin.social ⁨7⁩ ⁨months⁩ ago

    I appreciate you. 🙏 I have been considering looking into hardening my home network, but I dreaded the idea of figuring out which tools weren't just sponsored SEO-optimising AI-generated time-wasting network-snooping bullshit. This gives me somewhere to start.

    source

    • MigratingtoLemmy@lemmy.world ⁨7⁩ ⁨months⁩ ago

      I am happy to know this helped you. Good luck in securing your network!

      source
• e0qdk@kbin.social ⁨7⁩ ⁨months⁩ ago

  I've used Wireshark when I want to inspect the traffic going through my computer. I've found it particularly handy for debugging my own networking code. I've also used netstat to see active connections and programs listening for traffic when I don't care about the packet contents specifically.

  source
• archy@lemmy.world ⁨7⁩ ⁨months⁩ ago

  I’m surprised no one has mentioned NtopNG - that is THE tool to spy on youself

  source
• greybeard@lemmy.one ⁨7⁩ ⁨months⁩ ago

  Often you can mirror ports on routers and switches, this lets you send the same packets to a device as gets sent to your router. This will allow you to use something like wireguard to capture the packets and inspect them. Unfortunately for you, the vast majority of traffic is encrypted these days. So most of the time you can see how much data is being transmitted to Google, but not what data. Tools like Fiddler will help you on a specific machine, where it can decrypt it on the fly.

  source
• kokesh@lemmy.world ⁨7⁩ ⁨months⁩ ago

  AdGuard home is quite a nice thing to have a look at what phones home in the network.

  source

  • walden@sub.wetshaving.social ⁨7⁩ ⁨months⁩ ago

    I have a few devices that don’t show up in Adguard Home because they ignore the DNS that they’re told to use.

    They have hard coded DNS that can’t be changed, ensuring they can reach the outside world (unless completely blocked).

    Some Google devices and some Amcrest cameras I have are guilty of this.

    source

    • GlitzyArmrest@lemmy.world ⁨7⁩ ⁨months⁩ ago

      You can redirect all DNS traffic to your own DNS server to get around this.

      source

      • -> View More Comments
• Granixo@feddit.cl ⁨7⁩ ⁨months⁩ ago

  Look at the mirror. 👨‍🦱

  source
• Decronym@lemmy.decronym.xyz ⁨7⁩ ⁨months⁩ ago

  Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

  Fewer Letters	More Letters
  DNS	Domain Name Service/System
  HTTP	Hypertext Transfer Protocol, the Web
  HTTPS	HTTP over SSL
  IP	Internet Protocol
  IoT	Internet of Things for device controllers
  SSL	Secure Sockets Layer, for transparent encryption

  ---

  [Thread #201 for this sub, first seen 8th Oct 2023, 23:35] [FAQ] [Full list] [Contact] [Source code]

  source
• WhatsHerBucket@lemmy.world ⁨7⁩ ⁨months⁩ ago

  What OS are you using?

  source
• abominable_panda@lemmy.world ⁨7⁩ ⁨months⁩ ago

  Someone might suggest something more elegant but one solution is a managed switch which every devices traffic passes through, then allocate one port as a trunk port and connect that to wireguard on your server?

  source
• nbailey@lemmy.ca ⁨7⁩ ⁨months⁩ ago

  SPAN port on the switch, send it all into a server running Suricata which can analyze, classify, and log all the traffic. Don’t run it in IPS mode online unless you’re willing to suffer a little…

  source