HN Explorer

Ask HN: uBlock Origin for the IoT devices in my house?

1 points by rstuart4133 ↗ HN
Ask HN: uBlock Origin for the IoT devices in my house?

My dishwasher has a MAC address. So do dozens of other things in my house, and I have no idea what most of them send home.

Is there a router (OpenWrt or similar) that blocks every new device by default, then lets me unblock it by picking its make and model from a crowdsourced allowlist to let through only what it needs to function?

6 comments

[ 0.28 ms ] story [ 15.4 ms ] thread
[deleted]
(comment deleted)
bix6
AdGuard home maybe?
l0ng1nu5
If you want something simple like ublock, the direct replacement is pihole, it runs on a raspberry pi or other minimal hardware, you setup your dhcp server to point at it for DNS.

Otherwise you can flash pfsense or opnsense on to compatible hardware which can also be configured with pfBlockerNG or similar to provide the same blocking functionality plus firewall functionality but it's probably a bit harder to set up.

rstuart4133
DNS blocks are too easy to bypass. Ideally I'd like to stop Sony sniffing my network for other devices. For wired connections, that means putting each device on its own VLAN when it's are added. Wireless is easier - just ask the AP to isolate guests.

I'm imagining software that does what my router does now - displays all devices connected to my network. When they are attached, they get a DHCP address but all other network access is blocked by default - so they probably don't work. It has a web page showing just blocked devices. You enter the make / model / year. Since devices don't work until you've entered it, there is likely just one, so it should be easy.

The TL;DR is to change the default from "everything is allowed" to "everything is blocked, apart from endpoints required by the device". Blocking is pretty easy software / hardware wise, but knowing "endpoints required by the device" is much harder.

Commercial entities maintaining blocklists are incentivised to sell access to make a little extra on the side - see Adblock Plus’s “Acceptable Ads” programme. Brave is another example - they inserted affiliate codes. The only arrangement I've seen that works over the long term is open source maintained lists - like uBlock Origin.

This would be far safer than what we have now. It would not just make snooping much harder; blocking access by default (even from internal devices) defangs most CVEs. It would probably prevent many devices auto patching - but that doesn't matter so much now the internet can't get to them, and on the upside it makes it hard for Samsung to upgrade their $3,000 fridges to display ads. Getting to keep the device you paid for would be a nice change.

All this seems kinda obvious to me, which is why this is an "Ask HN". If I've thought of it, then it's highly likely someone is already 10 steps ahead and has already done it.

d3Xt3r
GL.Inet routers (based on OpenWRT) have an Allowlist Mode, where any unrecognized MAC address is denied network access by default until you manually switch it to allowed. But once unblocked, it gets unrestricted outbound access. I'm not aware of any uBlock-like functionality or crowdsourced list. But this doesn't make sense in the first place, since this traffic would be encrypted and you have no way to tell if it's nefarious activity or legitimate, unless you root or hack the IoT device in question and install an MITM certificate. But even then, both the nefarious traffic and legitimate traffic could be sent to the same https endpoint, so you wouldn't have any way to block it unless you disable such nefarious activity on the device itself.

So the best option would be to just keep the machine blocked, or limit it to an "IoT" VLAN that doesn't have Internet connectivity. And if the dishwasher needs the Internet to simply work, get rid of it.