Hacker News Reader

Comment by kminehart | Hacker News Reader

How are these devices being accessed despite most houses having a router with a firewall? I thought IPv4, being so limited in possible IPs, pretty much forced everyone to use a router for NAT? So would mean unless these people who have these devices did something really dumb, they should be behind a firewll, no?

Why are these devices being exposed to the internet?

View on HN

Intentional holes in the NAT so they can review them remotely. Then there are security nightmares like UPNP where it automatically opens a hole in the firewall.

Lastly, even if you're behind a firewall you're still not safe. For example DNS rebinding attacks. The least secure device on your network gets hacked, the attackers then use it to scan and exploit devices on the LAN. In the enterprise I avoid this by putting different classes of devices on different VLANs, but this comes with the side effect of being very expensive hardware wise and not easy for the average user to manage.

NAT is not a firewall. Full stop.

Many home routers are horrifically insecure with numerous remote vulnerabilities. Many IoT devices have vulnerable and accessible interfaces locally and externally.

It reminds me the times when I was on phone with my ISP and he reboots my router remotely, live. In my head: what the * !?

Now, I'm paranoid each time they push an upgrade without warning. It was them or an E.T?

I always use another router after the one by the ISP, for precisely that reason.

I didn't mean to imply that a NAT was a firewall. Most home routers, which are for NAT (mostly) come with a firewall. Albeit a basic one, it still comes with one.

Reply on news.ycombinator.com