Skynet Skynet - Router Firewall & Security Enhancements

[OKLY]

https://otx.alienvault.com/indicator/ip/50.200.136.108
https://www.hybrid-analysis.com/sam...f9b2d087cffe2341030533d64f5?environmentId=100

What’s the other ip? Seems to be malicious... like from some torrent apps. What apps you have installed in your tv. Have u tried removing them?

213.34.167.254 is the other IP I have seen it trying to contact. Apart from stock apps, I have installed Aptoide, Kodi, Terrarium and Mobdro.

Update: It just switched to another IP, 195.35.245.30 for now.

 

[DonnyJohnny]

213.34.167.254 is the other IP I have seen it trying to contact. Apart from stock apps, I have installed Aptoide, Kodi, Terrarium and Mobdro.

Update: It just switched to another IP, 195.35.245.30 for now.

I see.. likely due to all those streaming app as they using P2P technology for the streaming and somehow the video has node to these malicious ip.
I assume it only try to connect when u try watching streaming video.
But if it also try to connect while you are not watching. Then maybe you are infected. Maybe try uninstall all those app and see if it stop. Then install back one by one to see which app is the culprit.

 

[agilani]

213.34.167.254 is the other IP I have seen it trying to contact. Apart from stock apps, I have installed Aptoide, Kodi, Terrarium and Mobdro.

Update: It just switched to another IP, 195.35.245.30 for now.

Its most likely the apps you installed like kodi. Consider using a vpn for them.

 

[gwopman]

Hello everyone,

I need to block facebook messenger on my network at a certain time period, like parental controls.

Could anyone help me figure out what i should be blocking?

Thanks in advance!!

 

[Adamm]

Hello everyone,

I need to block facebook messenger on my network at a certain time period, like parental controls.

Could anyone help me figure out what i should be blocking?

Thanks in advance!!

While in theory it sounds like a good idea, its very easy to bypass and any teenager is going to know what a proxy/vpn is. I think you're better off looking for alternative methods.

 

[DonnyJohnny]

Hello everyone,

I need to block facebook messenger on my network at a certain time period, like parental controls.

Could anyone help me figure out what i should be blocking?

Thanks in advance!!

Confiscated the phone and computer. Install spy app on phone and computer. Remote control the devices.

 

[gwopman]

While in theory it sounds like a good idea, its very easy to bypass and any teenager is going to know what a proxy/vpn is. I think you're better off looking for alternative methods.

Confiscated the phone and computer. Install spy app on phone and computer. Remote control the devices.

Thanks for the replies guys, but it's not actually a major issue like with children and i have no need to spy on anyone - my wife's in school and asked if i could have facebook and facebook messenger 100% blocked during a few hours every night on the week days. If she really wants to bypass it she can go on 4G, Its half to keep the messages from showing up on her devices during study time.

I wasnt sure i would be able to block messenger with the domain alone but im going to give it a try first. I need to figure out how to do scheduling with skynet too.

 

[DonnyJohnny]

Thanks for the replies guys, but it's not actually a major issue like with children and i have no need to spy on anyone - my wife's in school and asked if i could have facebook and facebook messenger 100% blocked during a few hours every night on the week days. If she really wants to bypass it she can go on 4G, Its half to keep the messages from showing up on her devices during study time.

I wasnt sure i would be able to block messenger with the domain alone but im going to give it a try first. I need to figure out how to do scheduling with skynet too.

If for own use, just temporary disable the app on android phone?

 

[OKLY]

I see.. likely due to all those streaming app as they using P2P technology for the streaming and somehow the video has node to these malicious ip.
I assume it only try to connect when u try watching streaming video.
But if it also try to connect while you are not watching. Then maybe you are infected. Maybe try uninstall all those app and see if it stop. Then install back one by one to see which app is the culprit.

Its most likely the apps you installed like kodi. Consider using a vpn for them.

I have tried uninstalling 3rd party apps and no luck, it was still trying to contact several IP addresses on its own. So I reset the TV to erase everything and it has stopped. I believed previously I have installed a 3rd party app which may have installed some sort of malware on my TV.

Now I just install apps that are available on Google Play Store, so far so good. Thanks to Skynet I discovered this issue with my TV.

 

[DonnyJohnny]

I have tried uninstalling 3rd party apps and no luck, it was still trying to contact several IP addresses on its own. So I reset the TV to erase everything and it has stopped. I believed previously I have installed a 3rd party app which may have installed some sort of malware on my TV.

Now I just install apps that are available on Google Play Store, so far so good. Thanks to Skynet I discovered this issue with my TV.

Yup.. lots of IOT being infected by malware. Especially when u jailbreak/root or install unknown source app.
Thanks for doing your part in preventing yourself from being use as bot. Lol..

 

[gwopman]

I am just going to find the exact addresses needed to block with Wireshark. Thanks guys

Does skynet do scheduled blocking, so i don't have to ssh in to disable and re-enable this rule?

 

[agilani]

I am just going to find the exact addresses needed to block with Wireshark. Thanks guys

Does skynet do scheduled blocking, so i don't have to ssh in to disable and re-enable this rule?

Not really an option chief, facebook like everyone else uses a CDN, chances are you are talking about blocking hundreds of CIDR blocks and it will disable a whole list of other sites as well. Unless facebook has a dedicated anycast block of addresses which i doubt.

 

[Adamm]

Not really an option chief, facebook like everyone else uses a CDN, chances are you are talking about blocking hundreds of CIDR blocks and it will disable a whole list of other sites as well. Unless facebook has a dedicated anycast block of addresses which i doubt.

Another good point, CDN's aren't meant to blocked. You will be better off with a DNS based solution with common domains using something like AB-Solution.

 

[OKLY]

Does the skynet.log file gets purged after a certain period time or will the file just grow bigger until the drive runs out of free space?

 

[FadgewackeR]

Does the skynet.log file gets purged after a certain period time or will the file just grow bigger until the drive runs out of free space?

I'm fairly sure it's purged, after a user defined period... Not at home to double check that, so someone more learned will I'm sure back me up or shoot me down!

 

[M@rco]

@Adamm Have you ever considered something like

firewall --help

to show a list of the available command line options? I find myself typing the command above very often, only to realise that I need to visit the first post of this thread to find out the exact syntax of the command I'm looking for... Maybe I'm the only one but (at least to me) it would sure be a nice addition.

 

[Adamm]

Does the skynet.log file gets purged after a certain period time or will the file just grow bigger until the drive runs out of free space?

Once it hits 10Mb it gets automatically purged. Depending on your usage this can be days or weeks worth of logs.

 

[Adamm]

@Adamm Have you ever considered something like

firewall --help

to show a list of the available command line options? I find myselfing typing the command above very often, only to realise that I need to visit the first post of this thread to find out the exact syntax of the command I'm looking for... Maybe I'm the only one but (at least to me) it would sure be a nice addition.

The menu will display any CLI equivalent command when you choose an option.

 

[M@rco]

The menu will display any CLI equivalent command when you choose an option.

I guess that's true, but (if I understand you correctly) you can only see the command which is executed after it's chosen from the menu. I meant more of a syntax / command line options explanation without the need to run commands from the menu. More like a '--help' style overview of command line options. I don't know whether that makes any sense, I'm having trouble explaining it, sorry.

 

[Adamm]

I guess that's true, but (if I understand you correctly) you can only see the command which is executed after it's chosen from the menu. I meant more of a syntax / command line options explanation without the need to run commands from the menu. More like a '--help' style overview of command line options. I don't know whether that makes any sense, I'm having trouble explaining it, sorry.

I know what you mean, its just there are so many various options its hard to present neatly in such a format. So people instead are directed to the readme or the commands can be generated from the menu.