Hacker News Reader

Comment by hellofunk | Hacker News Reader

I don't understand how the bot net found his camera so instantly when he turned it on or installed it. Within moments/seconds, it was attempting to infiltrate a brand new device.

View on HN

You might be too young to remember Blaster Worm. There was a time in 2003-2004 you couldnt install Windows XP/2000 when directly connected to the internet (no nat/firewall), you got infected (= reboot after 60 seconds) as soon as install process fired up RPC service.

Those were bad times. Trying to get someone updated when you didn't have a firewall to put in front of a friend's box was really hard.

There aren't so many IPv4 addresses and connections are fast enough even for residential users. If considering a botnet, even faster.

There is even services that scan the whole ipv4 in less than 5 minutes: https://zmap.io/

And a list of how to do it: http://www.securitynewspaper.com/2015/10/15/how-to-scan-whol...

I don't get it: how does the attacker initiate contact with a 192.168.0.0/16 address? Is part of the installation instructions "On your WAN router, DNAT your external address and a port to your internal address and telnet port."?

No, but that’s what a novice would do to access the camera remotely.

Yes, except it is all automated by UPNP

https://nakedsecurity.sophos.com/2013/01/29/what-if-your-sec...

https://en.wikipedia.org/wiki/Universal_Plug_and_Play#Proble...

Thank you. Now I know that the first thing to do with any router I have is to disable Internet Gateway Device Protocol.

Sort of. Do you know what uPNP is? It allows a device to automatically do exactly that.

https://en.wikipedia.org/wiki/Universal_Plug_and_Play

I work for an ISP. I fired up a capture one day out of curiosity and instantly saw thousands of packets per second destined for 23/TCP across our address space. There's a LOT of these compromised devices out there that are just constantly scanning the entire IPv4 address space.

There is a lot of scanning going on by a lot of people

Back when I had an ISDN connection, I'd see 5-10 attempts a day (and I would sometimes send emails to the abuse@ address for that IP range). Now I see 5-10 a second and it's pointless to try and stop them at the source.

I'm somewhat curious if all those attempts count against my data cap.

> I'm somewhat curious if all those attempts count against my data cap.

I don't see why they wouldn't. IP (which is really the layer ISPs should operate at) does not distinguish between packets that you have "requested" and unsolicited packets, being connectionless protocol and all.

Same. I have about 500 different IP every month trying to RDP into my servers. I add them automatically to the firewall of my servers.

"Back when I had an ISDN connection, I'd see 5-10 attempts a day (and I would sometimes send emails to the abuse@ address for that IP range). Now I see 5-10 a second and it's pointless to try and stop them at the source."

There is nothing inherently wrong with port scanning and it should not, by default, be considered "abuse".

Reply on news.ycombinator.com