Hacker News Reader

Comment by bigiain | Hacker News Reader

Similarly, I have a B+ doing Pihole duties. It also runs a few scripts looking for unexpected new devices on the network and mails me when it first sees them (which has never actually caught anything bad going on, but does remind me of lots existence when I get a new phone or give a friend the wifi password).

View on HN

I used to do something similar with hook scripts from DNSMasq and sending notifications to my phone. The next step was to allow me to click a button in the notification and kick that device from the network, but I never did get around to figuring out how to do that; I expect it wouldn't be done in DNSMasq, but I don't know which service _is_ responsible for kicking/blocking devices (by MAC presumably)?

I also have a B+ running PiHole. It's perfectly usable, and even the web interface is genuinely very fast and usable, even on this single core Pi with the limit memory it has. It's very impressive. The only thing that broke in over 5 years is the power supply (phone adapter).

I've been running PiHole on Pi Zero with ethernet hat i.e. whole network stack is going through the GPIO pins and it works fine. So there should be no issues running this on basically anything.

same but i dont have a ethernet hat so i just do wifi on pi zero. it works.....

recently i found a strange issue. i can access rustdesk on a device connected at home which goes through pihole. so the pc says no internet connection, triangle on the network icon (win10) and firefox does not work. restarting didn't help either.

it was troubling because i could use rustdesk just fine, only problem was the machine thought it could not access internet.

checked pihole address and it was not responding. sent remote hands to unplug and plug pi-zero to the router usb itself and everything worked.

Hm great idea. I am setting up a local toy system to monitor public predator domains since the Greek gov is using to monitor literally everyone alive these days.

If these "predator" domains are of a serious concern, would it not be advantageous to your fellow Greek to add them to a public block list so that all can benefit? I assume they serve no legitimate purpose other than to track? If that's the case, a blanket block list for all people who run PiHole/AdGuard/uBlock et al could be useful!

Good idea, did not thought about this.

what is a predator domain?

A predator domain is a domain name used by the predator mobile phone malware. There was a publicly available list of such domains released a while back in the GR media. Ofc it’s safe to assume that these domains are bit used anymore but given the fact that Greek gov did everything to avoid real investigations might worth monitoring these domains anyhow. By the way it appears that although using predator is expensive has been used more extensively that initially thought to target journalists, politicians and businesses men.

Would you mind sharing the detection script?

Probably not much use to you, it just logs in to the admin web pages on my TPLink router and scrapes the html of the connected devices list with a little bit of Perl and regexes. Full of the usual PoC (I wonder if I can make this work?” hard coded web admin and email passwords and everything, and it’s been just working like that for about 5 years now.

(yeah yeah, I know, you can’t parse html with regexes. For a super tightly controlled web page like this one it works just fine.)

I get you - that's given me an idea to do the same, but I'd probably use a HTML scraping library like AngleSharp. Thanks for the explanation!

Reply on news.ycombinator.com