Hacker News Reader

I don't understand how they can scan IoT devices if IoT devices are behinds a router which is usually our home network setup. So we will expose a public IP, and NAT is usually not enabling by default anyway so how the heck they can telnet/connect to the IoT devices to brute force password?

It seems like somehow we

View on HN

UPnP is enabled on lots of routers by default and enables devices and services behind NAT to forward traffic for specific ports to their internal IP address to allow direct connections from the internet.

I see. I just check mine and luckily DD-WRT disabled it by default.

Just do a quick shodan search for port 23, there are millions of devices directly attached to the web.

Some are intentional, but my guess is the most are just badly configured by people not caring for security. Add all the cheap vendors for IoT devices and "I need to be able to check my lights at home while on the road" and you get an amazingly huge attack surface

Reply on news.ycombinator.com