I have this old TP-Link smart lightbulb, it’s the only thing that’s IoT and on WiFi in my house.
Looking through pfBlocker logs for fun, and noticed it’s been trying to connect to the Tor network.
Oh! Also, it’s been uploading and downloading 100+ MB of data a day.
It’s just an NTP pool. The device is trying to update it’s time. Likely it made many other requests to other servers when this one didn’t work.
Maintaining up to date lists of anything is a game of whack a mole, so you’re always going to get weird results.
If you’re actually unsure, pcap the traffic on your pfsense box and see for yourself. NTP is an unencrypted protocol, so tshark or Wireshark will have no problem telling you all about it.
That said, I’d still agree with the other poster about local integration with home assistant and just block that sucker from the Internet.
Agreed. To add to this because the traffic is being blocked it keeps retrying so it’s inflating the traffic size. I have about 14 tplink WiFi switches on a vlan and my pfsense rule for NTP is less than 6 megabytes. OP is conflating legitimate NTP traffic with Tor.
NTP is an unencrypted protocol, so tshark or Wireshark will have no problem telling you all about it.
Wait, it is? Pretty sure chrony.conf has some auth stuff in it.
Authentication != Encryption
Right.
You’re the one that connected an impossible-to-security-update device to the internet. You can do plenty of home automation without it needing to be that way, if you’re open to a little more setup being involved in the process.
It’s on it’s own VLAN from the beginning. Wanted to poke around but never got to it.
I still have it connected, want to use for practice.
I hope you update the post with any info you find.
Egh… More bad info. Seems to be prolific here on Lemmy
And yeah, definitely not Tor (I happen to know the TPLink KASA HS100 protocol too). The chip running on them wouldn’t even have sufficient resources to run tor more likely lol
Plus, as others have said, port 123 is NTP
Ok, it’s not Tor, but why would it generate 100 MB of NTP traffic every day?
How do you know it is? Dpi is often wrong about both protocol. And size
123 isn’t the normal protocol though, so let’s assume it is malicious (I will admit I could be wrong here). Packet dumps is the way to prove it. If op posts packet dumps, that would be useful (as I could be wrong, the normal protocol is a different port generally though).
Also, important to note that if they’re uk hs100 plugs, they have different firmware too… The UK ones have one of the protocols shut off
How do you know it is? Dpi is often wrong about both protocol.
I didn’t mean to say that. My point wanted to be that it is a bit too much traffic for it to be honest NTP traffic (as it was assumed above), unless the program sending it has a honest bug
Dpi on these cheap routers sometimes often doesn’t even calculate the data downloaded correctly. Ie, we can’t even rely on the 100mb figure
I’m a little confused. Why do you think this is a cheap router?
As I know pfBlocker is a component of the pfSense firewall OS, and if OP runs that on their router, it must almost certainly be an x86 machine and have much more RAM than the amount that cheap routers have, according to the minimum reqs.
It’s definitely been popped. Rip.
deleted by creator
