3 ms·
Hey there - author of the article here. The research team behind this has a lot of unanswered questions as well, and a lot of...(like you) conjectures about how
by bmcn2020 6y ago
Hey there - author of the article here. The research team behind this has a lot of unanswered questions as well, and a lot of...(like you) conjectures about how this may have arisen.
Normally, one should not attribute to malice what can simply be attributed to stupidity or probably laziness here.
Even then, however, it's a bit too suspicious though. Of course, we asked the manufacturers behind these devices for comment and -- surprise! -- no comment. In past experience with Chinese vendors, we've had similar results.
Of course, we'll update with any information we get.
Thanks for reading!
- sigmaprimus 6y agoI would start by examining the getWifi.sh file a bit closer, chances are it's part of either a WPS or Network Bridge scheme. Having thought about this story for a while now, I also think it is worth investigation, I might purchase an extender off Amazon. The one part of the story I can't reconcile is how the Chinese IP attacker managed to find the device. I doubt this could have occured just from random port scanning so there must be a call home, possibly by loading a hidden image on the "Backdoor GUI"? The story was well written, just not sure it made me thristy enough to drink the koolaid...or maybe it did! :P
- jml7c5 6y agoRandom attacks are much more frequent than one might expect. If you are unlucky enough to have a device that accepts the default telnet user/pass of 'root'/'xc3511' and you leave it open to the internet, you can expect it to be compromised in less than five minutes. [0] [0]: https://isc.sans.edu/forums/diary/An+Update+On+DVR+Malware+A+DVR+Torture+Chamber/22762 https://isc.sans.edu/forums/diary/An+Update+On+DVR+Malware+A...
- bmcn2020 6y agoIf you are thirsty enough to test it yourself, please let us know if you find anything!