4 ms·
In this case the IPs probably aren't spoofed, but there's always the chance that you're blaming IPs that didn't engage in the attack but somebody just put it ra
by kpcyrd 10y ago
In this case the IPs probably aren't spoofed, but there's always the chance that you're blaming IPs that didn't engage in the attack but somebody just put it randomly as source address in their packets.
- mirimir 10y agoTrue. But once you have the IP, you can nmap to get the OS, right? That would probably exclude most false positives, where Mirai was implicated.
- Zancarius 10y agoProbably not in cases where the device is behind a NAT/router that happens to forward remote access ports that lead to the initial compromise. Then you'd be nmapping the customer's endpoint. Plus, it'd be too time consuming. Tens of millions of participating IPs spread across countless ISPs...
- mirimir 10y agoGood point. But still, even with risk of false positives, I believe that ISPs should be informed. And ISPs could acknowledge uncertainty when informing customers.
- NetStrikeForce 10y agoBut in many cases you don't even know if the IP addresses are spoofed or not.