4 ms·

I don't understand how the bot net found his camera so instantly when he turned it on or installed it. Within moments/seconds, it was attempting to infiltrate a

I don't understand how the bot net found his camera so instantly when he turned it on or installed it. Within moments/seconds, it was attempting to infiltrate a brand new device.

woliveirajr 10y ago
There aren't so many IPv4 addresses and connections are fast enough even for residential users. If considering a botnet, even faster. There is even services that scan the whole ipv4 in less than 5 minutes: https://zmap.io/ https://zmap.io/ And a list of how to do it: http://www.securitynewspaper.com/2015/10/15/how-to-scan-whole-internet-3-7-billion-ip-addresses-in-few-minutes/ http://www.securitynewspaper.com/2015/10/15/how-to-scan-whol...
- thyrsus 10y ago
  I don't get it: how does the attacker initiate contact with a 192.168.0.0/16 address? Is part of the installation instructions "On your WAN router, DNAT your external address and a port to your internal address and telnet port."?
  - fuzzy2 10y ago
    No, but that’s what a novice would do to access the camera remotely.
  - gvb 10y ago
    Yes, except it is all automated by UPNP https://nakedsecurity.sophos.com/2013/01/29/what-if-your-security-camera-were-an-insecurity-camera/ https://nakedsecurity.sophos.com/2013/01/29/what-if-your-sec... https://en.wikipedia.org/wiki/Universal_Plug_and_Play#Problems_with_UPnP https://en.wikipedia.org/wiki/Universal_Plug_and_Play#Proble...
    - thyrsus 10y ago
      Thank you. Now I know that the first thing to do with any router I have is to disable Internet Gateway Device Protocol.
  - theandrewbailey 10y ago
    Sort of. Do you know what uPNP is? It allows a device to automatically do exactly that. https://en.wikipedia.org/wiki/Universal_Plug_and_Play https://en.wikipedia.org/wiki/Universal_Plug_and_Play
VodkaHaze 10y ago
There is a lot of scanning going on by a lot of people
- chiph 10y ago
  Back when I had an ISDN connection, I'd see 5-10 attempts a day (and I would sometimes send emails to the abuse@ address for that IP range). Now I see 5-10 a second and it's pointless to try and stop them at the source. I'm somewhat curious if all those attempts count against my data cap.
  - zokier 10y ago
    > I'm somewhat curious if all those attempts count against my data cap. I don't see why they wouldn't. IP (which is really the layer ISPs should operate at) does not distinguish between packets that you have "requested" and unsolicited packets, being connectionless protocol and all.
  - cm2187 10y ago
    Same. I have about 500 different IP every month trying to RDP into my servers. I add them automatically to the firewall of my servers.
  - rsync 10y ago
    "Back when I had an ISDN connection, I'd see 5-10 attempts a day (and I would sometimes send emails to the abuse@ address for that IP range). Now I see 5-10 a second and it's pointless to try and stop them at the source." There is nothing inherently wrong with port scanning and it should not, by default, be considered "abuse".
rasz_pl 10y ago
You might be too young to remember Blaster Worm. There was a time in 2003-2004 you couldnt install Windows XP/2000 when directly connected to the internet (no nat/firewall), you got infected (= reboot after 60 seconds) as soon as install process fired up RPC service.
- mentat 10y ago
  Those were bad times. Trying to get someone updated when you didn't have a firewall to put in front of a friend's box was really hard.
jlgaddis 10y ago
I work for an ISP. I fired up a capture one day out of curiosity and instantly saw thousands of packets per second destined for 23/TCP across our address space. There's a LOT of these compromised devices out there that are just constantly scanning the entire IPv4 address space.

I don't understand how the bot net found his camera so instantly when he turned it on or installed it. Within moments/seconds, it was attempting to infiltrate a brand new device.

woliveirajr 10y ago

There aren't so many IPv4 addresses and connections are fast enough even for residential users. If considering a botnet, even faster. There is even services that scan the whole ipv4 in less than 5 minutes: https://zmap.io/ https://zmap.io/ And a list of how to do it: http://www.securitynewspaper.com/2015/10/15/how-to-scan-whole-internet-3-7-billion-ip-addresses-in-few-minutes/ http://www.securitynewspaper.com/2015/10/15/how-to-scan-whol...

thyrsus 10y ago
I don't get it: how does the attacker initiate contact with a 192.168.0.0/16 address? Is part of the installation instructions "On your WAN router, DNAT your external address and a port to your internal address and telnet port."?
- fuzzy2 10y ago
  No, but that’s what a novice would do to access the camera remotely.
- gvb 10y ago
  Yes, except it is all automated by UPNP https://nakedsecurity.sophos.com/2013/01/29/what-if-your-security-camera-were-an-insecurity-camera/ https://nakedsecurity.sophos.com/2013/01/29/what-if-your-sec... https://en.wikipedia.org/wiki/Universal_Plug_and_Play#Problems_with_UPnP https://en.wikipedia.org/wiki/Universal_Plug_and_Play#Proble...
  - thyrsus 10y ago
    Thank you. Now I know that the first thing to do with any router I have is to disable Internet Gateway Device Protocol.
- theandrewbailey 10y ago
  Sort of. Do you know what uPNP is? It allows a device to automatically do exactly that. https://en.wikipedia.org/wiki/Universal_Plug_and_Play https://en.wikipedia.org/wiki/Universal_Plug_and_Play

VodkaHaze 10y ago

There is a lot of scanning going on by a lot of people

chiph 10y ago
Back when I had an ISDN connection, I'd see 5-10 attempts a day (and I would sometimes send emails to the abuse@ address for that IP range). Now I see 5-10 a second and it's pointless to try and stop them at the source. I'm somewhat curious if all those attempts count against my data cap.
- zokier 10y ago
  > I'm somewhat curious if all those attempts count against my data cap. I don't see why they wouldn't. IP (which is really the layer ISPs should operate at) does not distinguish between packets that you have "requested" and unsolicited packets, being connectionless protocol and all.
- cm2187 10y ago
  Same. I have about 500 different IP every month trying to RDP into my servers. I add them automatically to the firewall of my servers.
- rsync 10y ago
  "Back when I had an ISDN connection, I'd see 5-10 attempts a day (and I would sometimes send emails to the abuse@ address for that IP range). Now I see 5-10 a second and it's pointless to try and stop them at the source." There is nothing inherently wrong with port scanning and it should not, by default, be considered "abuse".

rasz_pl 10y ago

You might be too young to remember Blaster Worm. There was a time in 2003-2004 you couldnt install Windows XP/2000 when directly connected to the internet (no nat/firewall), you got infected (= reboot after 60 seconds) as soon as install process fired up RPC service.

mentat 10y ago
Those were bad times. Trying to get someone updated when you didn't have a firewall to put in front of a friend's box was really hard.

jlgaddis 10y ago

I work for an ISP. I fired up a capture one day out of curiosity and instantly saw thousands of packets per second destined for 23/TCP across our address space. There's a LOT of these compromised devices out there that are just constantly scanning the entire IPv4 address space.