2

eBlocker (http://www.eblocker.com) is software that runs on Raspberry Pis and similar architectures (Banana Pi, etc.) with the aim of blocking unwanted web trackers and advertisements.

What surprised me is that the Pi need only be connected to a standard Ethernet port on a consumer router (so not a monitoring port or similar) after which (within a few minutes) it will intercept all HTTP (not HTTPS) traffic on any device on the network, whether connected wired or wirelessly.

There was no need to set the device as a gateway on either the client devices nor the router, nor did I need to make any network changes at all - it just configured itself silently and automatically on all devices, whether they be running Windows, OS X, iOS, Android, Linux, or custom microcontroller network stacks.

I have contacted the manufacturer of the device, but understandably they wish to keep this secret.

I have attempted some research and suspect that UPnP or ZeroConf may be involved, but I understand too little about these technologies to make a firm assessment.

So my two related questions are:

How does eBlocker accomplish this? (I am happy to carry out any investigation needed to arrive at a conclusive answer.) It is concerning that someone with no access to the machines on the network (i.e. no passwords, no access to BIOS, etc.) but with physical-only access to the router could install a device that would capture all network traffic. What methods on a consumer router (running OpenWrt) would defend against this?

Update: here are the installation instructions for eBlocker, in case that helps identify the method.

  1. Connect the Ethernet port of the Raspberry Pi / Banana Pi to your Internet router or to a free Ethernet port of your switch.
  2. Connect the micro-USB cable to the Raspberry Pi / Banana Pi and connect it to the power adaptor.
  3. Wait 5 minutes until the Raspberry Pi / Banana Pi has finished booting up and has configured itself.
  4. Visit a random website with HTTP (not HTTPS). The eBlocker icon will be shown in the upper right corner of the screen. It shows that the eBlocker is active and that you are protected. With a click on the icon, the eBlocker Controlbar will open and allow further configuration

Automatic configuration

If the automatic network configuration doesn’t work in your network environment, we recommend using the eBlocker Network-Wizard for manual configuration...

Automatic configuration only works in the same network segment

The automatic configuration only recognizes network devices in the same network segment (for example: 192.168.1.X and 192.168.2.X are not in the same network segment). When you operate two different network segments and both shall benefit from eBlocker, please configure the eBlocker manually as the gateway for the internet access. In the eBlocker, please set your original Internet gateway as “gateway”.

IPv6 networks and IPv4 networks without DHCP

Home networks using the new IPv6 protocol only aren’t supported yet. In IPv4 networks without DHCP server, the eBlocker needs to be configured manually as a gateway. To do so, please connect to your eBlocker using the IP address http://169.254.94.109:3000/. Your internet client has to be in the same network segment, 169.254.94.0/24.

  • 1
    Can you post the routing table of the Pi? Also, you could check the presence of global variables with the term proxy in them, like this, env | grep -i proxy. Lastly, you should check whether this command: wget -q -O - checkip.dyndns.org \ | sed -e 's/.*Current IP Address: //' -e 's/<.*$//' returns your normal Ip address, or something else. – MariusMatutiae Oct 13 '15 at 14:54
  • "Magic" technology is untrustworthy technology. If they won't explain how it works in terms of standards and techniques, then it is not safe to use. Please provide a link to the product in question. I'm seeing a github site for a russian project called eblocker, but from the little I'm seeing in the source, it will not do what you suggest (it seems to be a chat server with browser plugins for clients). – Frank Thomas Oct 13 '15 at 15:11
  • MariusMatutiae - the Pi that runs the eBlocker software isn't a standard Raspbian OS as far as I can tell, and doesn't offer a UI. I will see if I can SSH into it. In the meantime, would it be worth running those commands on the router itself or on one of the connected devices that is affected by eBlocker? – Matt Duffin Oct 13 '15 at 17:18
  • Frank - I put the address in the original post, but it didn't get turned into a clickable link; hopefully this one will - eblocker.com – Matt Duffin Oct 13 '15 at 17:20
  • Interesting product. Either snake oil, or works by hijacking low-level network functions. Both of which are very, very bad, and unreliable. – qasdfdsaq Oct 15 '15 at 13:03
2

I would guess that it uses ARP cache poisoning to reroute all packets sent to the default gateway to itself. As a man in the middle it would be able to inspect http traffic and forward or drop it. It could also insert html objects into the http (but not https) conversation between lan hosts and internet web sites.

  • Although the manufacturer does not reveal any technical info about how it works (shame on them), this is my guess too. – Marcel Apr 6 '17 at 7:00
0

First eblocker looks for MAC-Adresses of all active IP stations in subnet. then it sends several ARP-response frames to each station telling the MAC adr of the default gateway ist the mac adr of the eblocker.

This will change the arp-cache in all subnet nodes.

Tools like wireshark send warnings: duplicate IP adress detected on different MAC adresses

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.