Hacker News Reader

Comment by justinsaccount | Hacker News Reader

Only 150,000 ?

We see upwards of 2 million unique ipv4 sources scan us on port 23 every day. These are all compromised IoT devices and routers.

In the past hour we saw 350k+ unique sources.

In just the past 3 minutes that number is 168,230

Top sources in the past 3 minutes:

  848 211.201.69.50
  840 180.66.99.72
  838 222.121.157.61
  759 95.17.97.136
  639 171.248.123.112
  542 189.78.49.194
  511 176.109.222.124
  386 60.249.84.179
  378 118.161.69.18
  377 61.75.42.129
  252 125.142.55.218
  252 183.102.221.85
  245 106.186.20.183
  233 112.162.191.217
  203 121.143.65.181
  199 115.86.134.94
  190 89.163.242.12
  183 91.205.123.37
  181 86.90.10.151
  179 91.240.140.14
  177 191.103.72.251
  173 185.129.2.236
  169 218.201.74.122
  168 116.99.113.72
  164 82.119.65.190
  160 118.129.105.9
  158 194.88.205.101
  156 77.88.202.60
  156 82.79.75.5
  155 112.165.227.205

We see 2000pps of this shit all day every day. No one cares.

View on HN

Is there a database of this so people can check if their devices are compromised?

I could publish it somewhere.. The problem is people just don't care.

I dumped the ASN owners for a bunch of sources, the top 3 are:

  15664 BR TELEFNICA BRASIL S.A, BR
  15215 VN VNPT-AS-VN VNPT Corp, VN
  15112 CN CHINANET-BACKBONE No.31,Jin-rong Street, CN

You think TELEFNICA BRASIL gives a shit that they have 15k+ compromised customers?

I'd say if you can telnet to your wan IP and get a login prompt, you have a shitty router that exposes telnet to the world and you're probably compromised :-)

You think TELEFNICA BRASIL gives a shit that they have 15k+ compromised customers?

Shouldn't they? It eats a lot of their outbound bandwidth. Even if they have peering agreements that they don't have to pay for, there's still the cost of the equipment and their internal network bandwidth to consider.

shodan.io

Some kind of IoT realtime block list like we have for spammers would be nice

It's ultimately not very useful for that sort of thing.. 326,160 addresses in the past 38 minutes. What would you do with this information?

Chrome, Firefox, IE, could all check your IP against that list, and inform you, "Looks like you have an unsecured device which is attacking the internet, and slowing down your connection. Here's a site that can help you fix the problem..."

I suppose, but that would require you to install the add-on that does that, or for it to be included by default.. both of which seem unlikely.

Having google or facebook check REMOTE_ADDR for every client would work though, but most people wouldn't understand what the notification means. Plus, on a network that isn't using nat you'd never get the alert since the IoT device itself would never be REMOTE_ADDR.

True, but it still would be a step in the right direction for home users.

Can you please explain or provide a reference link to provide more explanation:

>We see upwards of 2 million unique ipv4 sources scan us on port 23 every day. These are all compromised IoT devices and routers.

What is the unique connection between port 23 and IoT devices? Genuinely Curious.

Thanks.

Shitty underpowered devices that ship with telnet enabled instead of ssh.

One of the observations I read in the aftermath of the Krebsonsecurity DDOS was that the vulnerable IOT devices often permit telnet (port 23 and non-encrypted) connections. A common approach to take over one of these devices starts with brute-forcing the login prompt.

Once compromised and running malware, the device proceeds to probe random IP addresses for open telnet ports to spread further. The uptick in port 23 connection attempts has coincided with the perceived spread of IOT malware.

I wonder if someone should grey hat this and scan and kill vulnerable hardware.

Once one of these botnets finds a device with admin:admin credentials the first thing it can do is change the password.

We run a distributed network of PoPs in the cloud and get easily many times this, as well as massive ssh brute force attempts and other more bizarre forms of scan/attack. I sometimes look up the IPs and check them out and they are ancient cameras, routers, and things like Windows 2000 Server instances sitting on the Internet running malware.

Can you share what is the methodology you are using for determining the source IP is an IoT device? Are you just nmap'ing them and using OS/TCP finger printing?

I had the same question for how OVH was determining that X amount were IPs cameras vs X amount were DVRs etc.

It's just what they are. Routers and IoT devices exposed with telnet running and default credentials.

It's probably mostly routers, but the botnet doesn't care. If they can connect to you, send root\nroot or admin\nadmin and get a shell, they will.

How do you tell the difference between a router and some device sitting behind the router?

OK I see, so the router the IoT devices are in back of as well as the IoT device have both been compromised. And the owners of the botnet have made sure that these IoT devices have proper NAT/PAT mappings on these routers.

No.. separate incidents. People often forward ports to IoT devices or stick them on public interfaces in the first place.

Some idiot has been attacking me all month:

127.0.0.1

I keep counter-attacking him, but he's always one step ahead of me!

I'd try SSHing into them - maybe they have the same login credentials as you?

I got a kick out of this, thanks!

A lot of people including numerous EU regulators would think that posting such a list of IPs is very tacky. At Google I would be reprimanded and probably fired just for producing a list like this, or even writing a tool that was capable of producing a list of non-anonymized IPs of clients.

Now that I got that out of my system: where's all the v6 traffic?

Those are not "clients". They are random hosts on the internet trying to compromise hosts on our network.

Even a light bulb has inalienable rights in the EU, comrade.

Reply on news.ycombinator.com