Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Possible Vendetta Behind the East Coast Web Slowdown

bloomberg.com

Post reply on HN
Print view View original

121–130 of 206 posts

Re: Possible Vendetta Behind the East Coast Web Slowdown

#121

Post by pmlnr »

egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

For non-technical users, I'd suggest the following:

Turn off the devices you don't want to check; leave only those up you want to investigate.

Visit your router on the web interface and see if there are any graphs are possible to check for things like requests/second or packets/second. If it's really high while you're not actively doing anything, that's a clue.

Visit the UPnP settings on the router. If there are ports listening for incoming internet connections, turn the UPnP off on the router.

If you can SSH to your router, log in and start collecting data with tcpdump[1]. This later can be analyzed with tools like wireshark[2], which can show you per protocol what is going in. Most of the botnets use telnet- or IRC-like interfaces which are, in most cases, plain text commands, so it's possible to spot them.

Apart from this: reset everything to factory and change all the passwords before letting anything on your network.

[1]: https://www.linux.com/blog/tcpdump-tutorial-beginners

[2]: https://www.wireshark.org/docs/wsug_html_chunked/ChapterIntr...

Re: Possible Vendetta Behind the East Coast Web Slowdown

#122

Post by pmlnr »

dmourati wrote: post #115
egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

The best place to do this is at your border. You probably have a cable modem or router or some such that connects your home to the internet. You would typically install software known as IDS (Intrusion Detection System) such as Snort there and look for anomalous traffic. As for a non-technical solution, it will be difficult to implement. It requires some computer know how and time. Such a secure device could be creat…

The last time I played around with Snort[1] I realized I'm lightyears away from being paranoid compared to the default settings :)

It would be good to have an IDS with bare minimum settings, easy to turn on layer after layer, though I understand it's tricky.

[1]: https://www.snort.org/

Re: Possible Vendetta Behind the East Coast Web Slowdown

#123

Post by avip »

robolange wrote: post #119
Retr0spectrum wrote: post #116

Earlier quoted context omitted.

I might be wrong, but in the case of Mirai I'm fairly sure you're safe if all your devices are behind NAT.

Doesn't Mirai use UPnP IGD to work around NATs/firewalls? I imagine a lot of people have that activated on their router to play video games and whatnot. https://krebsonsecurity.com/2016/10/who-makes-the-iot-things... Edit: I guess it's more accurate to say that a lot of poorly designed devices use UPnP IGD to work around NATs/firewalls and Mirai takes advantage of this to infect them.

If the posted source is legit, then no.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#124

Post by merb »

eric_h wrote: post #118
supergeek133 wrote: post #72

Earlier quoted context omitted.

The problem with these devices in particular is the weak point is the user. As is the case in most attacks. Your average user says "Sure I can setup cameras" then sees "remote access" in the menu, sets it up, maybe it has some UPNP to the router and BOOM. Magic remote login without any type of mitigation.

Indeed. My mom got an internet connected "security camera" kit (for cheap from one of the big wholesalers, can't remember the manufacturer) and asked me to set it up. The hardware was nice, cameras did a reliable 1080p full color, but the whole reason my mom wanted it was so she could check in while she and my dad were traveling (and also sneak a peek at her bird feeders while she was away; avid birder, that one). So…

    Her response, "but it says on the box that it's easy to     
    setup for outside access!". Mine: "It's easy to setup for 
    everyone to access, much more involved if you want to 
    make sure it's only you who has access"
well that was a pretty clever answer, I needed to laught about that :D Basically the commercial was right :D "easy to setup for outside access" that didn' implied a single person ^^

Re: Possible Vendetta Behind the East Coast Web Slowdown

#125

Post by supergeek133 »

redleggedfrog wrote: post #97
supergeek133 wrote: post #72

Earlier quoted context omitted.

The problem with these devices in particular is the weak point is the user. As is the case in most attacks. Your average user says "Sure I can setup cameras" then sees "remote access" in the menu, sets it up, maybe it has some UPNP to the router and BOOM. Magic remote login without any type of mitigation.

The real problem here, and this isn't going to be a popular position, is that you're relying on the internet for important things. The original engineering and architecture of the the internet (and the web) was not intended to create something you put all your eggs in. It was for sharing information, not building your mission critical business operations on. Right now, if you dumped your business into a cloud service…

Even still, if indeed it is the cameras doing this, it's a problem of our own creation. The internet 'is fine' without a botnet of dvrs.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#126

Post by cmdrfred »

NetStrikeForce wrote: post #110
cmdrfred wrote: post #82

Earlier quoted context omitted.

Exactly, I have tons of IOT devices. I put them on a separate subnet that does not have a gateway to the internet then I VPN into that network to access them. Perhaps a product that makes that a simple process will solve the problem?

We partly do that at Wormhole. I say partly because you still have to be able to access one of our addresses. Port of last resort is 443/TCP, so it works on lots of tricky networks out there. The idea is that all your IOT stuff establishes a connection to this server, creating an encrypted network between them. You then add your control servers to that network and job done. You devices don't need any inbound access t…

Interesting, I have a few thoughts. Perhaps you could sell a preconfigured pfsense box (or make a raspberry pi image to start with) that when plugged into the customers router creates a reverse tunnel via your service as well as a WiFi hotspot. Then offer the user a very simple firewall control panel and they can choose what devices to allow to the open internet and what to keep private and accessible via some sort of authenticated channel. Thus devices that contain sensitive data or require enhanced security (cameras, private network attached storage devices, home automation) and devices that require internet access (Amazon Echo) can both be served by the service.

Very nice service by the way. I have used ngrok in the past and found it invaluable for a few odd applications. I'll give it a try in future.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#128

Post by davidhowlett »

kakarot wrote: post #5

Unfortunately, forced firmware updating is an area our governments should not be mandating. That puts unnecessary strain on small companies and creates a larger gap that companies must cross to become commercially viable

I think that the negative externalities of poorly secured IoT devices scale linearly with the number attached to the internet whereas the cost of writing more secure software and keeping it updated scales much much more slowly with the number of installs. I think this means that the best solution is to have tiered levels of certification and regulatory burden based on the number of times a piece of software is installed. Ideally tiering would be done on the total bandwidth of all devices with a piece of software installed but this would be much more difficult to measure and enforce then counting installs.

If no product with less then X thousand installs has to deal with the regulatory overhead of certification then experiments and early stage companies are less likely to be squashed. I would also exempt open source software from having forced audits or minimum standards for security. This would have the side effect of encouraging more companies to publish their firmware open source which would also not be a bad outcome.

To prevent companies manufacturing lots of almost identical product lines each individually under the limit for audits I think it would also be necessary to count all products that share more then half their code as one product.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#129

Post by empath75 »

matthewmacleod wrote: post #88
Jtsummers wrote: post #75

Earlier quoted context omitted.

While technically accurate to describe them as such, the vast majority of consumers (and internet service subscribers) lack the actual technical expertise to be network administrators. Where these devices are being attacked inside, ostensibly, professional organizations (companies, schools, government buildings), I agree. But there you have, again ostensibly, an actual network administrator capable of dealing with th…

I think that's okay. We don't expect all homeowners to be, say, experts in electrical wiring, or gas supply, plumbing, drainage, or waste management. But all of these things—if they are poorly modified, managed, or maintained—can cause impacts on third parties. In the case of networked devices, the possible impact on third parties is even greater. We also enforce strong regulation on these systems – defining what may…

I feel like Amazon, Best Buy and new egg could get together and create a standard for IoT devices, no? Though I guess they'd get hit with antitrust.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#130

Post by empath75 »

Jtsummers wrote: post #84
zzleeper wrote: post #69

Earlier quoted context omitted.

Why can't everyone else then block the customer? Get the big 5 tech companies to block IPs that are shown to do DDOS, for say a 24hr period, and you will see how quickly they unplug that IOT Toaster

Speaking as not-me, the average, non-technical homeowner who just installed his new internet connected washing machine at home. Great, now I can throw in a load and get a notice on my phone when it's done. This is awesome! (3 hours later) Wait, why can't I get to the internet? I call my ISP, they tell me that my connection is fine (it's tech support, they aren't security experts). But, I tell them, Google doesn't wor…

From my point of view as someone who is no longer ddos'd, I don't have a problem with this.
Post reply on HN