3 ms·

I mean. Yes, you're pwned. You need to reflash all possible firmware, dd your disks to zeros and start again.. I wouldn't even trust it then, personally. What'

I mean. Yes, you're pwned. You need to reflash all possible firmware, dd your disks to zeros and start again.. I wouldn't even trust it then, personally. What's the IP address it was talking to? Maybe we can help find out what it was?

wasipwned 4y ago
Yeah. That's definitely the plan, but I want to see if there's anything I can learn from the machine before I even do so. The IP address was 107.122.31.71.
- cyberpunk 4y ago
  It looks like a consumer IP address (AT&T US); ungood. Either your attacker is unsophisticated and they actually had that IP, or they're bouncing through a pwned machine. Kill it. Kill it with fire.
- ehPReth 4y ago
  one open port it seems: https://www.shodan.io/host/107.122.31.71 https://www.shodan.io/host/107.122.31.71
  - deleted 4y ago
    [deleted]
- KomoD 4y ago
  Well, I've dug around, there's no hostname associated with it or pointing to it. There's no obvious connections to any orgs or sites, and no entries in virustotal or abuseipdb, however there is an open port 179 (looks like BGP??).
  - Atlas22 4y ago
    Its a carrier grade NAT IP for ATT's cellular service, the BGP is likely just the ATT router.
    - wasipwned 4y ago
      Yeah, I'm now realizing that this might be multicast traffic I'm seeing from another device, and I do use AT&T which is making me think this may not actually be malicious.
    - wasipwned 4y ago
      Out of curiosity, how do you know it's CGNAT? Is it just because all of AT&T's mobile traffic is through CGNAT?
redleader55 4y ago
If you are to go this far, don't stop at dd-ing disks to zero. Replace the SSD controller firmware as well + BIOS + all firmware everywhere.
- FeistySkink 4y ago
  Why stop at the firmware? Shred the hardware altogether. /s
  - Wistar 4y ago
    … and bury it at least 8 feet deep on land no closer than a mile from your residence.
    - bitwize 4y ago
      Turn off your computer and make sure it powers down, Drop it in a 35-foot hole in the ground, Cover it completely, rocks and boulders should be fine...
      - FeistySkink 4y ago
        Pretty sure you could still recover the flash-based memory. Unless you're dropping into acid or lava.
    - wpasc 4y ago
      seems to be careless not to burn current residence to the ground as well
      - quickthrower2 4y ago
        Then salt the earth
    - guerrilla 4y ago
      I think 6 feet should be enough in most cases, if you're short on time or energy.

wasipwned 4y ago

Yeah. That's definitely the plan, but I want to see if there's anything I can learn from the machine before I even do so. The IP address was 107.122.31.71.

cyberpunk 4y ago
It looks like a consumer IP address (AT&T US); ungood. Either your attacker is unsophisticated and they actually had that IP, or they're bouncing through a pwned machine. Kill it. Kill it with fire.
ehPReth 4y ago
one open port it seems: https://www.shodan.io/host/107.122.31.71 https://www.shodan.io/host/107.122.31.71
- deleted 4y ago
  [deleted]
KomoD 4y ago
Well, I've dug around, there's no hostname associated with it or pointing to it. There's no obvious connections to any orgs or sites, and no entries in virustotal or abuseipdb, however there is an open port 179 (looks like BGP??).
- Atlas22 4y ago
  Its a carrier grade NAT IP for ATT's cellular service, the BGP is likely just the ATT router.
  - wasipwned 4y ago
    Yeah, I'm now realizing that this might be multicast traffic I'm seeing from another device, and I do use AT&T which is making me think this may not actually be malicious.
  - wasipwned 4y ago
    Out of curiosity, how do you know it's CGNAT? Is it just because all of AT&T's mobile traffic is through CGNAT?

redleader55 4y ago

If you are to go this far, don't stop at dd-ing disks to zero. Replace the SSD controller firmware as well + BIOS + all firmware everywhere.

FeistySkink 4y ago
Why stop at the firmware? Shred the hardware altogether. /s
- Wistar 4y ago
  … and bury it at least 8 feet deep on land no closer than a mile from your residence.
  - bitwize 4y ago
    Turn off your computer and make sure it powers down, Drop it in a 35-foot hole in the ground, Cover it completely, rocks and boulders should be fine...
    - FeistySkink 4y ago
      Pretty sure you could still recover the flash-based memory. Unless you're dropping into acid or lava.
  - wpasc 4y ago
    seems to be careless not to burn current residence to the ground as well
    - quickthrower2 4y ago
      Then salt the earth
  - guerrilla 4y ago
    I think 6 feet should be enough in most cases, if you're short on time or energy.