I don't understand how the bot net found his camera so instantly when he turned it on or installed it. Within moments/seconds, it was attempting to infiltrate a brand new device.
There is a lot of scanning going on by a lot of people
New security camera compromised by worm within minutes of installation
11–20 of 94 posts
Re: New security camera compromised by worm within minutes of installation
#12So you're saying these get instantly infected when anyone plugs them in? That's insane
Re: New security camera compromised by worm within minutes of installation
#13This is why the appliance market - Dropcam in this case - is often safe from the DIY enthusiast market. Setting these up is one hurdle. After that's done there's any combination of: network maintenance, security patches, updates, hosting a local server, DNS, troubleshooting etc. For some people, it's just worth $150 + 10/mo to not have something else to think about.
So is Dropcam reasonably secure then?
Re: New security camera compromised by worm within minutes of installation
#14Note that this was a deliberate setup. The safest thing to do for home routers is to kill UPNP, so that random devices on the inside can't open listening ports to the outside.
Possibly stupid question:
How can I verify that upnp is really disabled? (I don't trust my router to do it correctly)
Re: New security camera compromised by worm within minutes of installation
#15I don't understand how the bot net found his camera so instantly when he turned it on or installed it. Within moments/seconds, it was attempting to infiltrate a brand new device.
There aren't so many IPv4 addresses and connections are fast enough even for residential users. If considering a botnet, even faster. There is even services that scan the whole ipv4 in less than 5 minutes: https://zmap.io/ And a list of how to do it: http://www.securitynewspaper.com/2015/10/15/how-to-scan-whol...
I don't get it: how does the attacker initiate contact with a 192.168.0.0/16 address? Is part of the installation instructions "On your WAN router, DNAT your external address and a port to your internal address and telnet port."?
Re: New security camera compromised by worm within minutes of installation
#16Note that this was a deliberate setup. The safest thing to do for home routers is to kill UPNP, so that random devices on the inside can't open listening ports to the outside.
Hmm, what do you mean by "deliberate setup"? Reading through it, it looks like the behavior any naive user would do while setting up the camera.
Re: New security camera compromised by worm within minutes of installation
#17Note that this was a deliberate setup. The safest thing to do for home routers is to kill UPNP, so that random devices on the inside can't open listening ports to the outside.
While you're correct that there are ways to prevent this kind of thing happening, how many end consumers will do it? I think it was a valid experiment, he got it out of the box and did a minimal setup to prevent his network from being compromised, but not the "IoT" device per-se, and then just waited on the bait to catch something.
Re: New security camera compromised by worm within minutes of installation
#18Note that this was a deliberate setup. The safest thing to do for home routers is to kill UPNP, so that random devices on the inside can't open listening ports to the outside.
Possibly stupid question: How can I verify that upnp is really disabled? (I don't trust my router to do it correctly) edit: https://www.grc.com/su/UPnP-Rejected.htm
Probably sniffing the packets should work.
But even if you do that properly there is always a high chance your router will be compromised and you won't be able to fix it.
To be extra sure just treat it as such and put a firewall between it and your LAN. That requires time to configure, but may satisfy the paranoid.
Re: New security camera compromised by worm within minutes of installation
#19Earlier quoted context omitted.
There aren't so many IPv4 addresses and connections are fast enough even for residential users. If considering a botnet, even faster. There is even services that scan the whole ipv4 in less than 5 minutes: https://zmap.io/ And a list of how to do it: http://www.securitynewspaper.com/2015/10/15/how-to-scan-whol...
I don't get it: how does the attacker initiate contact with a 192.168.0.0/16 address? Is part of the installation instructions "On your WAN router, DNAT your external address and a port to your internal address and telnet port."?
No, but that’s what a novice would do to access the camera remotely.
Re: New security camera compromised by worm within minutes of installation
#20Earlier quoted context omitted.
There aren't so many IPv4 addresses and connections are fast enough even for residential users. If considering a botnet, even faster. There is even services that scan the whole ipv4 in less than 5 minutes: https://zmap.io/ And a list of how to do it: http://www.securitynewspaper.com/2015/10/15/how-to-scan-whol...
I don't get it: how does the attacker initiate contact with a 192.168.0.0/16 address? Is part of the installation instructions "On your WAN router, DNAT your external address and a port to your internal address and telnet port."?
Yes, except it is all automated by UPNP
https://nakedsecurity.sophos.com/2013/01/29/what-if-your-sec...
https://en.wikipedia.org/wiki/Universal_Plug_and_Play#Proble...