A 100k Botnet Turns Home Routers to Email Spammers

blog.netlab.360.com

121–122 of 122 posts

Re: A 100k Botnet Turns Home Routers to Email Spammers

#121

Post by stevenicr » Wed, Nov 14, 2018, 1:42 AM UTC

heavenlyblue wrote: post #115

stevenicr wrote: post #92

I think it's time for windows, and ios, and firewall / antivirus companies to scan for info about the routers used and alert people that their network is easily hacked, may already be hacked, and is in danger of being used by criminals to attack other countries and companies. Extra info such as, the router you are using has not had any available firmware updates for 3 years and likely needs to be replaced. It's obvio…

What about building an ethical hacking company that hacks these routers, closes the holes and then shows a warning to the user? This would quickly bypass any resources hackers have anyway, and could work closely with the governments IFF the hacking is purely ethical. The amount of inefficiency due to these devices being freely available to the user should be a huge money-saver.

There have been times I wondered if such a group was formed, or only working from a spot in international waters or, what would be some country names that would avoid any kind of legal or treaty or anything. What would those places be that could have such a hive running without major recourse?

Re: A 100k Botnet Turns Home Routers to Email Spammers

#122

Post by achillean » Fri, Nov 16, 2018, 1:52 AM UTC

chopin wrote: post #116

achillean wrote: post #106

Earlier quoted context omitted.

We actually offer such a monitoring service at Shodan, though it's largely aimed at companies so you need to use the API. Here's an article on how to setup a real-time monitor for your network: https://help.shodan.io/guides/how-to-monitor-network

How would this work for a consumer network which doesn't have a fixed public IP?

In that case you're probably better off w/ a cronjob that checks Shodan for information on your IP once a day. Doing direct IP lookups is free so you wouldn't need to pay. You won't get the immediate, real-time feedback but it's fairly straight-forward to do a daily IP lookup.

You could also change/ update your private firehose every day though that would require a bit more technical skill. You could basically do:

    MYIP=`shodan myip`
    shodan alert create home-network $MYIP
    shodan stream --alerts=all

That would create an alert for your current IP and then subscribe to any events.

Post reply on HN