11 ms·
150,000 IoT Devices Behind the 1Tbps DDoS Attack on OVH
- dharma1 10y agohttp://blog.level3.com/security/attack-of-things/ http://blog.level3.com/security/attack-of-things/ Getting manufacturers to patch, and users to update these embedded linux devices is going to be pretty hard
- petre 10y agoThen just hijack them and set the default gateway to 127.0.0.1. Problem solved.
- jimjimjim 10y agohow many years until iot manufacturers get sued for producing insecure devices?
- wiredfool 10y agoGood luck finding that vendor on Ali-express or Amazon.
- blunte 10y agoI think the reason we have such bad security is that non-technical end users just don't care. You can try a dozen different approaches to getting them to care about security, but they often cannot be bothered with it. Thus, if you want to go the legal/penalty route, you need to sue the end users. The entity that owns the house/office that installed the unpatched CCTV camera is effectively responsible for the behavior of that camera. If they then want to shift the responsibility to the manufacturer, that's their choice (and effort). What it will do is make users consider a bit more carefully when choosing devices and manufacturers, and it will make manufacturers have to consider (and promote) their security and patching practices to maintain marketshare.
- ge0rg 10y agoI can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. There are already safety standards and according mandatory certification processes in place that (should) prevent electric appliances from burning down your house (CE) or from bringing down airplanes (FCC). What is (urgently) needed is a similar approach to mandatory IT security certification for IoT devices. This is also advocated by Bruce Schneier [0]: Security engineers are working on technologies that can mitigate much of this risk, but many solutions won't be deployed without government involvement. This is not something that the market can solve. Like data privacy, the risks and solutions are too technical for most people and organizations to understand; companies are motivated to hide the insecurity of their own systems from their customers, their users, and the public [...] [0] https://www.schneier.com/blog/archives/2016/07/real-world_secu.html https://www.schneier.com/blog/archives/2016/07/real-world_se...
- icebraining 10y agoI can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. The same way they do for everything else. Ask experts. Demand third-party reviews. Require warranties for security flaws.
- di4na 10y agoWant an answer? The real one? Let corporations attack each other via electronic attack. It will be far worse at the beginning. But once you really threaten the bottom line for free, security will come. I sadly see no other good way to have security in software.
- eternalban 10y agohttp://www.ul.com/newsroom/pressreleases/ul-launches-cybersecurity-assurance-program/ http://www.ul.com/newsroom/pressreleases/ul-launches-cyberse...
- throwaway1974 10y agoSuing users wont work, now suing the manufacturer if the device is possibly a path that we will see pursued. If a precedent is set (after all cars get recalled all time for flaws) then we would endup with a more secure internet.
- zcam 10y agoNot gonna happen. Think of all the insecure windows "devices" out there. How do you draw the line.
- CodeWriter23 10y agoYou draw the line by legally kicking the crap out of a smaller vendor, then they become an example for the bigger guys. Suddenly the industry-wide Cost:Benefit analysis changes such that it is less costly to secure the devices they sell.
- zcam 10y agoIt's not all black/white. Nobody is immune to this problem, even with best efforts/practice, saying "let's sue to death small vendors so that big one react" is kind of ridiculous. Again, it's hard to draw a line.
- INTPenis 10y agoJesus I was just thinking about the consequences of no patch routine in the IoT device world. And, here it is. :) Imagine having to internationally co-ordinate patching of 150000 devices. Because the alternative is that 150000 homes will have their NATed IP-addresses blocked from each service being attacked. Just wow...
- pmontra 10y agoThat would mean blocking the ISP, and every ISP, so it's the end of blocking because there won't be any legitimate traffic left. The manufacturers must be both sued for selling exploitable devices and educated about how to write secure software. There is another post on the home page of HN about the security of the Linux kernel https://news.ycombinator.com/item?id=12589894 https://news.ycombinator.com/item?id=12589894 That's very important for this kind of issues because many of those devices are probably running on some Linux distribution.
- INTPenis 10y agoThis is why a proper and solid patch routine is of utmost importance. I'm a devops guy so I'm basically a sysadmin and I've been an advocate for patch routines for many years now. In a climate where people are almost offended when you tell them they need to patch their servers regularly. So if IoT is really the Internet of things and not the Intranet of things, then they need solid routines for patching their software.
- ge0rg 10y agoYeah, and having an automatic, secure, reliable patching routine for embedded devices is not trivial (and thus really expensive). What's even worse, we already have millions of deployed devices, and some of these probably don't support upgrading the firmware at all, or require manual intervention from users who have no idea they are part of the botnet.
- bcook 10y ago
- deleted 10y ago[deleted]
- ge0rg 10y agoFinally, the WiFi router invasion that we were warned of as early as 2007 is coming: https://www.flickr.com/photos/dullhunk/3109815261 https://www.flickr.com/photos/dullhunk/3109815261 (original source from 2007 is 404)
- nacnud 10y agoAs system administrator of my home network, it worries me that a device on my network might be involved in an attack like this, and I would never know. Maybe the target of such an attack could gather a list of IP addresses used in the attack, then pass them to Google, who might warn on their search homepage if you browse from one of the IPs on the list? (e.g. "Some of your internet devices may be at risk, click here to find out more") I know IP addresses are a poor proxy for identity, but it could be a step in the right direction.
- ge0rg 10y agoGoogle already has a similar mechanism in place where they require captchas from IP addresses that abused Google APIs previously. The combination of that with Google Shield might actually work to inform the users, but then again users are confronted with similar warnings from abusive ad networks all the time, and probably learned to click them away fast and forget about it.
- deleted 10y ago[deleted]
- vadiml 10y agoSimply set up your firewall to drop outgoing packets with source address not belonging to your subnet. The DDOS slaves are usually sending packets with spoofed source ip addresses
- martin_ 10y agoIt's unfortunately way too easy to find such devices. A quick scan of the (less scary) end of the ipv4 address space and I was able to find ~15k cameras and I was only searching for a couple of models for fun... Here was the result: http://opencam.ma.rtin.so/ http://opencam.ma.rtin.so/ -- most of the pins probably wont work anymore, as it's a couple of years old.. Still crazy.
- DanBC 10y agoI was able to find a few still working - in England: leamington spa, birmingham, Bradford (appears to be covered in cobweb!) Carlisle, etc. EDIT: I'm going to be spending hours on this today!
- Retr0spectrum 10y agoYou should also be aware that you just admitted to breaking the law in most countries. Edit: I take that back. I assumed "open" meant a default or insecure password
- Grangar 10y agoWait, aren't these public?
- kefka 10y agoUnfortunately in the hacking world, "access" doesn't mean legal access. Even, if it's there on a webserver with no login/password and directly on /index.html It's a completely fucked situation we're in, with the CFAA law. It allows the feds to charge anyone they like, cause they used a network. I guess we're supposed to fax the owners before we submit a TCP connection with their machines, but we'd probably run aground of fax spam laws.....
- martin_ 10y agoHeh, it looks like ShodanHQ now has a section entirely dedicated to this... https://www.shodan.io/search?query=Server%3A+SQ-WEBCAM https://www.shodan.io/search?query=Server%3A+SQ-WEBCAM -- using their API, and a geoip database (eg: maxmind) you could build something similar in a couple of hours.
- vadiml 10y agoThe problem is that that there are ISP's who are not implementing BCP38 (http://www.bcp38.info http://www.bcp38.info)
- Retr0spectrum 10y agoThis will only take us so far. Many of these botnets are large enough that they don't need any spoofing/amplification to be effective.
- thesehands 10y agowe need customers to want BCP38 implementing routers in their homes
- unethical_ban 10y agoBut... the routers and IoT are the ones often compromised. The ISP needs to enforce it. Also, anyone who understands networking (everyone on HN, for this purpose) should have a default-deny firewall for at least their IoT devices, if not every device on their network.
- pixl97 10y agoHow does that stop spoofing addresses inside the segment? If I am 8.8.8.8 and I fake 8.8.4.4, you still get my traffic, and someone else gets the complaint.
- nordsieck 10y agoIt won't stop spoofing, but if you assume that the botnet hosts are evenly distributed across the address space, you're going to cut the spoofed traffic to 1/(256^2). At that point, you might not even notice the DDOS.
- craigsmansion 10y agoIf you are 8.8.8.8 and you fake 8.8.4.4, it's likely the same person getting the complaint. If you just picked those two addresses at random from the entire range just to serve as an illustration, you should have bought a lottery ticket instead.
- CommanderData 10y agoIt should be easier managing devices that have access to the Internet on the router level. Most can't understand access restrictions, IP Tables or installing custom firmware. There needs to be a common standard, API on each router to manage devices connecting to the Internet and seeing which devices do and don't. This would open the doors to creating apps etc and possibly help mitigate threats from unknown Chinese IoT devices.
- dehef 10y agoI manage a huge fleet of raspberry pi in my jobs. There are geographically everywhere. I wish that there will not be found by some bad guy, but I know our system and I'm 100% sure that will happen one day. We have a basic level security, like so many other startup in that field though.
- ffggvv 10y agoAnd you do nothing? Because of you many business could loose their reputation and money.
- jessaustin 10y agoAt last, a legitimate reason to use a green-bean HN handle.
- dax1928 10y agoThere needs to be an international standard to avoid things like this.
- throwaway1974 10y agoI remember when the ntp exploit came out few years ago datacenter where we have a rack contacted me saying the Supermicro IPMI devices on the Supermicro servers were participating in an amplification attack. I was like wtf! Matter was quickly resolved of course, also they learned a lesson and moved ipmi ips to 10mbit limited connnections not 1gbit. Tho ideally a local ip that accessible only via a vpn would have been the best option for remote management but yeh, little steps I suppose with some providers.
- fivesigma 10y ago@internetofshit will have a field day with this. In all seriousness, this is only going to become worse in the future. Can't wait until the day when smart fridges, toasters and bicycle locks join in on a multi-Tbps attack and break the entire internet.
- FilterSweep 10y agoYou can't have "Intelligent" without "Intelligent(ly sending over personal data to servers you don't own for fun and profit)" in your devices. Because connecting your toaster and fridge over a local network, and running updates via your PC/laptop would be just too complex
- M_Grey 10y agoI wonder if at some point a government or two will just decide that the dubious benefit of a wired fridge isn't worth the national security risk of increasing existing botnets by an order of magnitude?
- praptak 10y agoInternet providers will curb it by reverse-firewalling all consumer connections, maybe with support from the copyright abuse lobby, so as to kill P2P and any other advanced internet usage for that matter.
- api 10y agoThe unfortunate and dangerous thing here is that nobody really has an incentive to fix this. The Internet doesn't belong to anyone. This really needs to be fixed at the national or international (IANA?) level by mandating the deployment of anti-DDOS source quench and anti-spoofing measures. Any owner of an IP block should be able to register a key and then send source quench messages and this needs to be deployed uniformly. But I'm not holding my breath. It's like herding cats, and as a general rule nobody anywhere cares about security unless their house is on fire (and then they go back to not caring after the fire is out). Another thing that needs to be done is to cut off support for this activity. It needs to be made illegal to pay ransom for DDOS or ransomware for that matter. If you get ransomwared or DDOSed that sucks, but that doesn't mean you should be allowed to reward the behavior and finance it being done to others.
- andrewalan 10y agoI am Andrew Alan a hacker who has built a very good reputation and undeniably one of the best hackers you can come across.i have got access to hack into any account and also get to generate passwords for accounts like Facebook,Instagram,Twitter,gmail,yahoo mail,whats-app,we-chat,etc..I also have logins for bank like BOA,welsfargo,chase,credit union,capital one, and many other different banks for transfers and credit card top ups,Retrieving hacked social media accounts,clearing criminal records,increase credit scores,CC hack,hacking computer systems,Website hack,Catch hacker scammers,Phishing emails, that's to mention a few ... You can contact me on.......... andrewalanhacks@gmail.com.
- pinaceae 10y agoAnd now let's apply such a scenario to autonomous vehicles, on land and in air. but rather than causing a virtual DDOS, now in physical space. shutting down a whole city, for the lulz. IoT and AV show that the "Facebook" method of software development - move fast, break things, agile/scrum, whatever label is used for non-engineering, will not work for the next stage. ditto the skills of most young CS grads. most companies can't even secure their shitty email services - but cars is easier? a whole new supply chain for code needs to be developed, from languages to curriculums. take what the airline industry has been doing and commoditize it, it must be braindead easy to build a secure and robust piece of code for this new world.
- gravypod 10y agoI wonder if you use the DVRs for bitcoin mining how much you could produce per day.
- deftnerd 10y agoMost IoT devices wouldn't produce any significant revenues from Bitcoin Mining because they don't have anywhere near the computational power of dedicated Bitcoin mining devices. A DVR might have a chance to make an impact if it had a GPU that was used to encode video that could be co-opted to mine Bitcoin, but I think most DVR's use special video encoding chips rather than a general purpose GPU. I think the only hardware they would have that could mine Bitcoin would be their general purpose CPU, which is probably under-powered anyway. A DVR would be more easily monitized as a node in a Botnet that does DDoS attacks, email spamming, or network scanning. One resource they do have though is drive space. a DVR botnet could sell unused DVR HD space using a service like Maidsafe [1] [1] https://maidsafe.net https://maidsafe.net
- justinsaccount 10y agoOnly 150,000 ? We see upwards of 2 million unique ipv4 sources scan us on port 23 every day. These are all compromised IoT devices and routers. In the past hour we saw 350k+ unique sources. In just the past 3 minutes that number is 168,230 Top sources in the past 3 minutes: 848 211.201.69.50 840 180.66.99.72 838 222.121.157.61 759 95.17.97.136 639 171.248.123.112 542 189.78.49.194 511 176.109.222.124 386 60.249.84.179 378 118.161.69.18 377 61.75.42.129 252 125.142.55.218 252 183.102.221.85 245 106.186.20.183 233 112.162.191.217 203 121.143.65.181 199 115.86.134.94 190 89.163.242.12 183 91.205.123.37 181 86.90.10.151 179 91.240.140.14 177 191.103.72.251 173 185.129.2.236 169 218.201.74.122 168 116.99.113.72 164 82.119.65.190 160 118.129.105.9 158 194.88.205.101 156 77.88.202.60 156 82.79.75.5 155 112.165.227.205 We see 2000pps of this shit all day every day. No one cares.
- khc 10y agoIs there a database of this so people can check if their devices are compromised?
- justinsaccount 10y agoI could publish it somewhere.. The problem is people just don't care. I dumped the ASN owners for a bunch of sources, the top 3 are: 15664 BR TELEFNICA BRASIL S.A, BR 15215 VN VNPT-AS-VN VNPT Corp, VN 15112 CN CHINANET-BACKBONE No.31,Jin-rong Street, CN You think TELEFNICA BRASIL gives a shit that they have 15k+ compromised customers? I'd say if you can telnet to your wan IP and get a login prompt, you have a shitty router that exposes telnet to the world and you're probably compromised :-)
- ansible 10y agoYou think TELEFNICA BRASIL gives a shit that they have 15k+ compromised customers? Shouldn't they? It eats a lot of their outbound bandwidth. Even if they have peering agreements that they don't have to pay for, there's still the cost of the equipment and their internal network bandwidth to consider.
- 10y ago
- mjevans 10y agoThis isn't bad enough, not yet, for some kind of protocol that allows source quench / notify a remote ISP of a suspected infected host and suppress traffic from said host. It would need to be out of band, and I suggest it use OpenPGP for signatures (chain of trust from IP allocating bodies), actually it would also need to query a database of allocated IP ranges.
- api 10y agoIoT = Internet of Targets Something needs to be done about DDOS at the backbone and tier-1 level of the Internet or we are going to lose the public Internet.
- solotronics 10y agothe problem is more complicated than you make it out to be. DDoS aren't always some special kind of packet or traffic that is easy to identify, it is just a flood of normal looking traffic from a ton of compromised sources
- api 10y agoI didn't say it was easy. I just have the impression that nobody is even really trying to do anything about it Internet-wide. Instead we just have protection as a service (Cloudflare, etc.) which provide protection but do not actually solve the problem. (... and I wonder if these DDOSes are going to get big enough to take them down eventually?) Source quench would help. It's not a silver bullet but it would make this a lot harder. In many cases (including ours) there are ways to ID legitimate traffic vs. junk.
- SG- 10y agoAny idea why OVH is being targeted? What customer is OVH hosting that they're trying to hit so hard?
- zodPod 10y agoHow are they able to identify that these were IoT devices?
- erpellan 10y agoFeels like how things might have been when home electricity was first becoming pervasive. Lots of dubious devices and a laisez-faire approach to eg. electrocution risks and fire hazards. After enough public outcry regulation is introduced, standards are developed and enforced and your television is no longer at risk of bursting into flames or frying the cat. Or, in today's world, of being conscripted into a global botnet and DDOS'ing your neighbours.