gatekeeper.tss.net

[xxcriticxx]

@mitchellkrogza or @funilrys what is this domain used for? my pihole went crazy on it. when was this added?

[mitchellkrogza]

@xxcriticxx what do you mean it went crazy? I will have to see which input source this came from.

[mitchellkrogza]

@xxcriticxx it comes in from this source

https://raw.githubusercontent.com/eladkarako/hosts.eladkarako.com/master/build/hosts_adblock.txt

[mitchellkrogza]

./_HOSTS_AdBlock/domains.txt:cdn.gatekeeper.tss.net
./_HOSTS_AdBlock/domains.txt:gatekeeper.tss.net
./_HOSTS_AdBlock/domains.txt:www.gatekeeper.tss.net

[xxcriticxx]

what is this domain used for? my pihole block about 2000 connections from domain

[xxcriticxx]

google vaguely talks that this maybe spyware so i need to know if should worry or not

[mitchellkrogza]

Can you install rkhunter on your Pi and make sure everything is OK and it has never been compromised.

[mitchellkrogza]

Possibly even also scanning with clam too

[mitchellkrogza]

@xxcriticxx not sure if this is related or not > https://forums.malwarebytes.com/topic/191746-removal-instructions-for-tss-vince/

[mitchellkrogza]

@xxcriticxx it is malware > Trojan Kuluoz --- See: http:https://www.malwareurl.com/ns_listing.php?as=AS7385

[mitchellkrogza]

I suggest inspecting all your PC's, phones, tablets on your network very carefully to see if one of them is infected. Trojan seems aimed at Windoze systems so I would start there if you have any.

[xxcriticxx]

i got pihole running on regular pc not pie3

[xxcriticxx]

any recommendation on program?

[mitchellkrogza]

Suggestion to download one or more of these bootable live antivirus / malware CD's and check the pc is not infected > https://www.lifewire.com/free-bootable-antivirus-tools-2625785 with a live CD you can boot from it and scan the entire drive without the OS loading. Only proper way to check as any malware will evade any malware scanners you try to load into the OS

[xxcriticxx]

let me try first see what malwarebytes finds. then i go for live cd for deeper cleaning.

[smed79]

let me try first see what malwarebytes finds.

Check also using AdwCleaner https://www.malwarebytes.com/adwcleaner/

[xxcriticxx]

@smed79 thats part of malwarebytes now right?

[mitchellkrogza]

@xxcriticxx If you never had your pihole and this list you would never have discovered this. When you say it went crazy it sounds like any malware that when you block it's outgoing conections it goes absolutely mental. Can you provide me with a full log of all things it blocked when it went crazy so I can analyze that.

[xxcriticxx]

we still dont know what it is lets hope i find it

this connection for right now

[xxcriticxx]

4 connections every 5 minutes or so

Oct 17 11:18:18 dnsmasq[4737]: /etc/pihole/gravity.list gatekeeper.tss.net is 192.168.1.131
Oct 17 11:18:18 dnsmasq[4737]: /etc/pihole/gravity.list gatekeeper.tss.net is 192.168.1.131
Oct 17 11:18:18 dnsmasq[4737]: /etc/pihole/gravity.list gatekeeper.tss.net is 192.168.1.131
Oct 17 11:18:18 dnsmasq[4737]: /etc/pihole/gravity.list gatekeeper.tss.net is 192.168.1.131

[funilrys]

Hello there,

All suggestion are great but are we talking about windows ? 🤔

If we're talking about windows then, you should execute netstat -b to get the PID of the program initiating the outgoing connections...

[xxcriticxx]

@funilrys this send every 5 min i dont think connection would stay open that long

[funilrys]

@xxcriticxx Well with netstat -b 5 >> C:\connections.txt you can set the timeout (in this example 5 seconds)

[xxcriticxx]

@funilrys i still dont know what am looking for gatekeeper ip?

[funilrys]

Yes repeating IP (from gatekeeper) then you get the PID of the programm :)

Once you got the PID you can get the program name with something like tasklist /fi "pid eq PIDOFTHEPROGRAM" (I used that only once in my life and it wasn't in the most recent build of Windows 😹 )

[xxcriticxx]

its going be very funny if i dont find shit

[xxcriticxx]

3 hr of scanning and found nothing :(

[xxcriticxx]

@mitchellkrogza any order ideas How to catch this something

[xxcriticxx]

@funilrys netstat only shows local ip not external

[xxcriticxx]

ok this works going do rest of computer now

[xxcriticxx]

file removed gatekeeper still in the logs

[mitchellkrogza]

My only solution and honest advice would be a clean slate. Wipe the box and reinstall Ubuntu. I would not honestly go any further not knowing my main Ubuntu box has a problem. Sorry not good news but that is what I would do personally.

[xxcriticxx]

i dont think its ubuntu or windows its one of the iot calling home

[mitchellkrogza]

But they were all turned off NO?

[mitchellkrogza]

I can’t be any clearer

1. Turn off everything
2. Only have Ubuntu box running with pihole and monitor to see if any connections to gatekeeper
3. If NONE then turn on one device and ONE device only and monitor to see if there are any connections to gatekeeper.
4. If None, turn off device
5. Turn on next device and monitor to see if any connections to gatekeeper

Leave each device up and running for at least 10-20 minutes while monitoring but then shut it down again before testing next one.

This takes time and patience and is the ONLY way you will find the infected device.

[xxcriticxx]

@mitchellkrogza i cant turn off fire alarms and thermostats they dont have off option

everything that could off been turn off was turn off

[mitchellkrogza]

@funilrys any ideas here? This is showing the real downside of IOT devices and how problematic they can be and potential dangers of insecure ones

[xxcriticxx]

@funilrys asleep by now by this long post

[funilrys]

Hello guys,

Let me resume a bit ...

• Pi-Hole detect outgoing connection to that domain
• After all machine has been taking down only ubuntu (pi-hole) get the log

So if we are at that level, we have 2 options, monitor all the home or monitor each machine to find which one is "infected"

So in ubuntu, it's simple if it's an outgoing connection:

$  netstat -cnputw

give us a real-time outgoing connection (from that machine)

For other machines it depends if you know the system and has access to them. Otherwise for the second point, to monitor all the house we need to understand how your router is set up which information we don't have if I read right ...

P.S Is Pi-Hole connected directly to the router or is it the router? 🤔

P.S2 Our goals is to find an IP, a MAC, o program or everything related to that domain

[xxcriticxx]

Pihole is plugin one of the ports on the back of the router

Pihole ip is enter I dhcp field in the router

[xxcriticxx]

@funilrys can we save this to txt file?

[mitchellkrogza]

@xxcriticxx you can also see all connected devices on your network by running nmap -sP 192.168.1.1/24 if your network IP addressing is different like 10.0.0.1 etc just change the command line to nmap -sP 10.0.0.1/24

[funilrys]

Well you can keep it runing and output with >> output at the end of the command !

[xxcriticxx]

I will try both shortly

[xxcriticxx]

nmap only gives me list of my current clients not where they connect

[xxcriticxx]

i think am going have to use pihole dhcp in order to assign ip to my clients so i can see what connects where

[mitchellkrogza]

@xxcriticxx probably a good idea. Does piHole (sorry never used it) not show you all local IP's and where they are connecting to ?

[xxcriticxx]

Not right now. Router does dhcp right now. I have switch it around and let pihole do it.

[mitchellkrogza]

Great, keep us updated and really hope you find the culprit.

[xxcriticxx]

plus i need to format few system as they are supper slooooooooooooooooow

@mitchellkrogza you can install pihole on most linux system i recommend for weekend project

[mitchellkrogza]

@xxcriticxx

[xxcriticxx]

@mitchellkrogza please provide me link to this article

[mitchellkrogza]

https://youtu.be/Op0tHjExST8 subscribe to their channel they talk a lot about IOT device hacking.

This one might also interest you

https://motherboard.vice.com/en_us/article/aekj9j/internet-of-things-ransomware-smart-thermostat

[xxcriticxx]

db.local.clamav.net 514

clamav calls home over 500 in last hour probably update out

[funilrys]

@eladkarako Is there any recommendation out there? Cause I read elsewhere:

I don't recommend adding/using ANY those list anywhere anymore.