4 ms·

One thing I don't understand about this attack: Virtually everyone is behind NAT these days, often multiple layers of NAT. So how does the botnet manage to tel

One thing I don't understand about this attack: Virtually everyone is behind NAT these days, often multiple layers of NAT. So how does the botnet manage to telnet or ssh into these set top boxes or lightbulbs or whatever? When I want to SSH into my home computer I have to go through elaborate maneuvers to get it to work.

seany 10y ago
Routers by default shipping with permissive upnp settings?
sjnair96 10y ago
So I may be flat out wrong about this, but I believe the clients, once infected phone home, thus (mostly) removing the need for worrying about NAT, as they router will forward the Server's connections to the correct machine once it sees that a prior outgoing connection has been made.
- hexane360 10y ago
  I think the question is about the initial infection.
jackweirdy 10y ago
I believe UPNP is used commonly by many of the IoT devices that end up in botnets.
- bradleyjg 10y ago
  As I understand it UPNP allows a device to negotiate a port map with a NAT box. But the developer of the IoT device would have to specifically want to map port 22 or 23. It's not something that would happen automatically. So are you saying that these IoT device makers not only hard-coded root usernames and passwords into their devices, but deliberately set up UPnP mappings to those ports? That looks malicious rather than negligent. Am I missing something?
  - SteveNuts 10y ago
    I've heard a lot of routers accidentally or negligently allow upnp on the WAN interface
    - bradleyjg 10y ago
      That's pretty horrifying but if true it answers my question about how this can affect so many devices. It sounds like whether because they were the directly hacked devices or because of this UPnP flaw, home routers are the main villain here. Not smart lightbulbs and webcams which the news media seemed to want to blame -- though the latter may well have been secondary villains.
  - jackweirdy 10y ago
    Your understanding is the same as mine. I don't think that's necessarily malicious though. I also don't think it would have to be to 22/23 - do we know that SSH or Telnet were the attack vector? Thinking about general IOT devices, even if it were SSH this time it well be a web UI with RCE next time.
  - marmot777 10y ago
    A large number of the devices were manufactured by XiongMai Technologies. Judge for yourself whether the backdoor was put in place intentionally. https://krebsonsecurity.com/2016/10/iot-device-maker-vows-product-recall-legal-action-against-western-accusers/ https://krebsonsecurity.com/2016/10/iot-device-maker-vows-pr...
- profmonocle 10y ago
  I'm surprised there are UPNP implementations that even allow mapping to specific, low-numbered ports. (Well, not surprised as much as disappointed.)
justinsaccount 10y ago
A good chunk of the infected devices are shitty NAT routers that had a backdoor...
ProAm 10y ago
Probably uPnP?
viraptor 10y ago
There's still a lot of those on public network. Either via uPNP, or directly. Shodan (https://www.shodan.io/search?query=port%3A23 https://www.shodan.io/search?query=port%3A23) says Total results: 3,957,271 And that's only on the default port.
pixl97 10y ago
And so? There is more than one way to spread a botnet. One particular method is DNS rebinding. They attack your webbrowser, then your browser passes the attack to the device inside the network. Another means is 'the weakest link'. An insecure and compromised device (even if it just a user account on that device) scans your local network behind the firewall , passes information to a command and control server, which downloads and passes an exploits to the devices it discovers on your network.
rajangdavis 10y ago
I commented this in another post, but at least for the affected surveillance cameras and recorders, the firmware for these devices is built on Busy Box. The manufacturers either opened up telnet or left telnet open for these firmwares until about 3 years ago when it started getting exploited. The characteristics for how these surveillance devices were hacked are that the devices are using older firmware with an exploitable telnet feature and that the default credentials are still intact. There are a few vectors (using UPnP, HTTP API, directory traversal) that can be applied to bypass authorization. Throw in a global directory of these devices (shodan.io) and you have the ability to search for these devices with specific firmwares, run every attack vector to compromise these systems, and, once connected, have them do _whatever_you_want_.
ndesaulniers 10y ago
With more uptake of IPv6, do people still use NAT? I thought NAT was just for IPv4?
- compuguy 10y ago
  There are still many corporations and ISP's that haven't configured or support ipv6 yet.
deleted 10y ago
[deleted]
citrin_ru 10y ago
> Virtually everyone is behind NAT these days, often multiple layers of NAT. So how does the botnet manage to telnet or ssh into these set top boxes or lightbulbs or whatever? Infected windows desktop can scan local network and infect IoT devices.

seany 10y ago

Routers by default shipping with permissive upnp settings?

sjnair96 10y ago

So I may be flat out wrong about this, but I believe the clients, once infected phone home, thus (mostly) removing the need for worrying about NAT, as they router will forward the Server's connections to the correct machine once it sees that a prior outgoing connection has been made.

hexane360 10y ago
I think the question is about the initial infection.

jackweirdy 10y ago

I believe UPNP is used commonly by many of the IoT devices that end up in botnets.

bradleyjg 10y ago
As I understand it UPNP allows a device to negotiate a port map with a NAT box. But the developer of the IoT device would have to specifically want to map port 22 or 23. It's not something that would happen automatically. So are you saying that these IoT device makers not only hard-coded root usernames and passwords into their devices, but deliberately set up UPnP mappings to those ports? That looks malicious rather than negligent. Am I missing something?
- SteveNuts 10y ago
  I've heard a lot of routers accidentally or negligently allow upnp on the WAN interface
  - bradleyjg 10y ago
    That's pretty horrifying but if true it answers my question about how this can affect so many devices. It sounds like whether because they were the directly hacked devices or because of this UPnP flaw, home routers are the main villain here. Not smart lightbulbs and webcams which the news media seemed to want to blame -- though the latter may well have been secondary villains.
- jackweirdy 10y ago
  Your understanding is the same as mine. I don't think that's necessarily malicious though. I also don't think it would have to be to 22/23 - do we know that SSH or Telnet were the attack vector? Thinking about general IOT devices, even if it were SSH this time it well be a web UI with RCE next time.
- marmot777 10y ago
  A large number of the devices were manufactured by XiongMai Technologies. Judge for yourself whether the backdoor was put in place intentionally. https://krebsonsecurity.com/2016/10/iot-device-maker-vows-product-recall-legal-action-against-western-accusers/ https://krebsonsecurity.com/2016/10/iot-device-maker-vows-pr...
profmonocle 10y ago
I'm surprised there are UPNP implementations that even allow mapping to specific, low-numbered ports. (Well, not surprised as much as disappointed.)

justinsaccount 10y ago

A good chunk of the infected devices are shitty NAT routers that had a backdoor...

ProAm 10y ago

Probably uPnP?

viraptor 10y ago

There's still a lot of those on public network. Either via uPNP, or directly. Shodan (https://www.shodan.io/search?query=port%3A23 https://www.shodan.io/search?query=port%3A23) says Total results: 3,957,271 And that's only on the default port.

pixl97 10y ago

And so? There is more than one way to spread a botnet. One particular method is DNS rebinding. They attack your webbrowser, then your browser passes the attack to the device inside the network. Another means is 'the weakest link'. An insecure and compromised device (even if it just a user account on that device) scans your local network behind the firewall , passes information to a command and control server, which downloads and passes an exploits to the devices it discovers on your network.

rajangdavis 10y ago

I commented this in another post, but at least for the affected surveillance cameras and recorders, the firmware for these devices is built on Busy Box. The manufacturers either opened up telnet or left telnet open for these firmwares until about 3 years ago when it started getting exploited. The characteristics for how these surveillance devices were hacked are that the devices are using older firmware with an exploitable telnet feature and that the default credentials are still intact. There are a few vectors (using UPnP, HTTP API, directory traversal) that can be applied to bypass authorization. Throw in a global directory of these devices (shodan.io) and you have the ability to search for these devices with specific firmwares, run every attack vector to compromise these systems, and, once connected, have them do _whatever_you_want_.

ndesaulniers 10y ago

With more uptake of IPv6, do people still use NAT? I thought NAT was just for IPv4?

compuguy 10y ago
There are still many corporations and ISP's that haven't configured or support ipv6 yet.

deleted 10y ago

[deleted]

citrin_ru 10y ago

> Virtually everyone is behind NAT these days, often multiple layers of NAT. So how does the botnet manage to telnet or ssh into these set top boxes or lightbulbs or whatever? Infected windows desktop can scan local network and infect IoT devices.