Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Possible Vendetta Behind the East Coast Web Slowdown

bloomberg.com

Post reply on HN
Print view View original

111–120 of 206 posts

Re: Possible Vendetta Behind the East Coast Web Slowdown

#111

Post by trhway »

jerf wrote: post #4

For a long time, I've wondered what would finally be the Securitypocalypse, the thing that finally caused our industry as a whole to take security seriously. These IoT DDoS attacks are as good a candidate as any I've seen in a long time. They are fundamentally very difficult to fix in light of the non-updateability of many of these devices, and this is only the beginning, because the IoT has hardly begun to develop.…

>They are fundamentally very difficult to fix in light of the non-updateability of many of these devices

as you proved, fixing the situation by fixing the devices wouldn't be a feasible approach. The traffic from those devices is carried by ISPs and this is there this traffic should be stopped. To me the situation reminds about email spam. We didn't get rid of spammers, instead the email traffic is analyzed and dealt with accordingly. I'm sure that ISPs easily see the patterns of such massive DDoS attacks and could just drop (or throttle down into oblivion, like 100s times down) the participating traffic.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#112

Post by DashRattlesnake »

Jtsummers wrote: post #32
DashRattlesnake wrote: post #15

Earlier quoted context omitted.

I don't think that's necessarily a bad thing. If a company doesn't have the resources to create secure products, then maybe it shouldn't be in that business in the first place.

The problem is not whether they can create a secure product, but whether they can afford to certify their products as secure. From my experience in the aviation software world, we spend a great deal more on demonstrating reliability than in producing it. This forces a huge amount of overhead on our projects. This isn't a bad thing, mind you, but it is a thing to consider. It is hard for a couple engineers to start a…

This is what I was responding to in the original comment:

> forced firmware updating is an area our governments should not be mandating

I think that if a company can't maintain a team to deliver regular security updates to their internet-connected products, then they shouldn't be producing internet-connected products in the first place.

I agree with you that government-mandated aviation-software levels of product certification would be destructive overkill.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#113

Post by egypturnash »

I am a non-programmer who reads HN and keeps up with tech news in general.

And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it.

How can I find this out?

Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advantage of this niche?

There are plenty of tools with a reasonably simple interface that will tell me if my laptop/desktop computer is infected with something. But what can I use to diagnose the health of all of the other computers proliferating around my house?

How can a non-technical user easily monitor the overall health of their connected household? Is this a project anyone is building? Because I think it's definitely something that needs to exist now.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#114

Post by Jerry2 »

drinchev wrote: post #43
elmigranto wrote: post #17

No luck with Google DNS for me, but Yandex seems to work: 77.88.8.8 77.88.8.1 https://dns.yandex.ru

Probably, but I would definitely avoid giving all my DNS resolutions to a *.ru domain. The reputation of the government - shutting down access to websites that hurt them is kind-a no-go for me.

US government is not much better... or have you forgotten all those hundreds of FBI/ICE domain seizures. How many have Russians taken down? If your'e gonna use DNS servers and you don't want someone to track you, use the DNS server based somewhere where your government cannot access them. If you're in the US, it's easy to assume that US DoJ/FBI will not be able to subpoena Yandex or some Chinese internet provider.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#115

Post by dmourati »

egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

The best place to do this is at your border. You probably have a cable modem or router or some such that connects your home to the internet. You would typically install software known as IDS (Intrusion Detection System) such as Snort there and look for anomalous traffic.

As for a non-technical solution, it will be difficult to implement. It requires some computer know how and time. Such a secure device could be created or better yet offered by the manufacturers of the modems/routers frequently deployed in homes.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#116

Post by Retr0spectrum »

egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

I might be wrong, but in the case of Mirai I'm fairly sure you're safe if all your devices are behind NAT.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#117

Post by rfrank »

egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

WireShark is the first thing that jumps to mind, although I'm not sure if easy for non-technical users is the way I'd describe it.

https://www.wireshark.org/

Re: Possible Vendetta Behind the East Coast Web Slowdown

#118

Post by eric_h »

supergeek133 wrote: post #72
gtrubetskoy wrote: post #56

Earlier quoted context omitted.

These attacks are mostly possible because of the complacency of operators at many sites and companies. This is not a new problem and many of RFC's talk about methods for preventing and mitigating them, but most people don't care and prefer to just outsource everything to a single provider, which becomes the weakest link. The Internet wasn't envisioned with a single email provider, single DNS provider, single app cont…

The problem with these devices in particular is the weak point is the user. As is the case in most attacks. Your average user says "Sure I can setup cameras" then sees "remote access" in the menu, sets it up, maybe it has some UPNP to the router and BOOM. Magic remote login without any type of mitigation.

Indeed. My mom got an internet connected "security camera" kit (for cheap from one of the big wholesalers, can't remember the manufacturer) and asked me to set it up.

The hardware was nice, cameras did a reliable 1080p full color, but the whole reason my mom wanted it was so she could check in while she and my dad were traveling (and also sneak a peek at her bird feeders while she was away; avid birder, that one).

So, I hooked that thing up to the network and did a port scan on it... First noticed - it's listening to port 22, auth is a googleable default password. It supports UPnP to punch a hole through the NAT and serve up video on another port. OS on the server box is some slightly customized version of linux with an _old_ kernel.

So I said, "Sure mom, I can set this up for you. We're going to need to get you a new firewall, it'll probably be easiest to put a *nix box in front of your wifi access point, then we can set up a tunnel between the isolated camera server and a locked down outside server that only you have access to so we can be sure that no one else is looking at those cameras. Should only take me a few hours, and we'll need to buy a box to run the firewall, and then a small monthly fee to keep the internet accessible server running"

Her response, "but it says on the box that it's easy to setup for outside access!". Mine: "It's easy to setup for everyone to access, much more involved if you want to make sure it's only you who has access".

Admittedly, it did have some authentication for accessing the video streams, but I didn't trust that thing as far as I could throw it; I'm glad she decided not to go through the trouble of getting it working (but mostly because I'm lazy and didn't want to have to setup and support that damn thing).

I can only imagine that the people who bought that device and didn't have a security paranoid person to help them set it up are all contributing to this most recent DDoS attack.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#119

Post by robolange »

Retr0spectrum wrote: post #116
egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

I might be wrong, but in the case of Mirai I'm fairly sure you're safe if all your devices are behind NAT.

Doesn't Mirai use UPnP IGD to work around NATs/firewalls? I imagine a lot of people have that activated on their router to play video games and whatnot.

https://krebsonsecurity.com/2016/10/who-makes-the-iot-things...

Edit: I guess it's more accurate to say that a lot of poorly designed devices use UPnP IGD to work around NATs/firewalls and Mirai takes advantage of this to infect them.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#120

Post by avip »

egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

To be part of Mirai network, your device needs to have telnet access open to the world AND use default factory credentials (which in turn must be on the lines "admin admin" or "root root").
Post reply on HN