Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Possible Vendetta Behind the East Coast Web Slowdown

bloomberg.com

Post reply on HN
Print view View original

171–180 of 206 posts

Re: Possible Vendetta Behind the East Coast Web Slowdown

#171

Post by cpncrunch »

Jtsummers wrote: post #95
guelo wrote: post #91

Earlier quoted context omitted.

That's fine, if you connect some cheap webcam and it causes you to be knocked off the internet you're going to be mad, leave a bad review for the camera, and not buy from them again. Market forces would then incentivize better security to be built into these devices.

But the average consumer won't realize, especially when the installation and network failure aren't temporally adjacent, that the camera is the cause of the problem. The solutions available (and there are more, just enumerating some): IPv6 so everything is directly on the internet or not hidden behind a common router like they are now. This allows direct blocking of bad actors. Security certifications for all softwar…

>But the average consumer won't realize, especially when the installation and network failure aren't temporally adjacent, that the camera is the cause of the problem.

In theory the user could be presented with a "here is why you've been blocked" explanation when they try to browse any site. They could then (probably) figure out what is the offending device, take it off the network, then click "please let me back on the internet, the bad device has been removed". (Somewhat similar to how the MX blacklists work at present).

Re: Possible Vendetta Behind the East Coast Web Slowdown

#172

Post by nradov »

rrggrr wrote: post #89

These attacks are possible because the US Congress hasn't extended tort liability to manufacturers of software and network hardware. The full weight of the US products liability bar will quickly and rapidly motivate manufacturers to ship secure devices. The lack of accountability is enabling vulnerability.

Who is the "manufacturer" in the case of FOSS?

Re: Possible Vendetta Behind the East Coast Web Slowdown

#173

Post by niftich »

nradov wrote: post #172
rrggrr wrote: post #89

These attacks are possible because the US Congress hasn't extended tort liability to manufacturers of software and network hardware. The full weight of the US products liability bar will quickly and rapidly motivate manufacturers to ship secure devices. The lack of accountability is enabling vulnerability.

Who is the "manufacturer" in the case of FOSS?

Whoever puts the FOSS on the device

Re: Possible Vendetta Behind the East Coast Web Slowdown

#174

Post by smartbit »

egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

Dowse is trying to help you out http://dowse.eu/#sec-2-2 Dowse is a transparent proxy facilitating the awareness of ingoing and outgoing connections, from, to, and within a local area network. ... Dowse communicates with users in various ways: via a web interface, but also pushing messages via audio (synthesized speech), Bonjour and simple apps interfacing with personal mobile devices.

You can even hook up Dowse to your TV set and show a live animation of where on the your internet your devices connect to https://youtu.be/vquh3IXcduc?t=74

Re: Possible Vendetta Behind the East Coast Web Slowdown

#175

Post by paulddraper »

eric_h wrote: post #118
supergeek133 wrote: post #72

Earlier quoted context omitted.

The problem with these devices in particular is the weak point is the user. As is the case in most attacks. Your average user says "Sure I can setup cameras" then sees "remote access" in the menu, sets it up, maybe it has some UPNP to the router and BOOM. Magic remote login without any type of mitigation.

Indeed. My mom got an internet connected "security camera" kit (for cheap from one of the big wholesalers, can't remember the manufacturer) and asked me to set it up. The hardware was nice, cameras did a reliable 1080p full color, but the whole reason my mom wanted it was so she could check in while she and my dad were traveling (and also sneak a peek at her bird feeders while she was away; avid birder, that one). So…

> Admittedly, it did have some authentication for accessing the video streams, but I didn't trust that thing as far as I could throw it

So...you wanted to have authentication and it has authentication...I must be missing something.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#176

Post by rasz_pl »

NKCSS wrote: post #37
jerf wrote: post #4

For a long time, I've wondered what would finally be the Securitypocalypse, the thing that finally caused our industry as a whole to take security seriously. These IoT DDoS attacks are as good a candidate as any I've seen in a long time. They are fundamentally very difficult to fix in light of the non-updateability of many of these devices, and this is only the beginning, because the IoT has hardly begun to develop.…

It's easy to fix; back in the day when a machine was infected; an ISP would just block outgoing traffic, contact line owner and re-enable when the issue is resolved.

and dont forget the part where user is charged $ for violating contract.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#177

Post by rasz_pl »

rev_bird wrote: post #47
NKCSS wrote: post #37

Earlier quoted context omitted.

It's easy to fix; back in the day when a machine was infected; an ISP would just block outgoing traffic, contact line owner and re-enable when the issue is resolved.

"Fix" is a relative term, especially if IoT devices are in play – yes, turning off the internet to customers stops the attack, but then (at least?) thousands of people lose internet connectivity because of a vulnerability that they could very well be powerless to fix. I'm not saying it's ok with me that an army of smart refrigerators could be taking out big chunks of the web, but it's a lot easier to tell someone, "H…

When a pipe breaks in your condo and starts flooding all the people below nobody asks which appliance might be leaking. Water is cut and you get the bill for _all of the damages_.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#178

Post by stephen_g »

paulddraper wrote: post #175
eric_h wrote: post #118

Earlier quoted context omitted.

Indeed. My mom got an internet connected "security camera" kit (for cheap from one of the big wholesalers, can't remember the manufacturer) and asked me to set it up. The hardware was nice, cameras did a reliable 1080p full color, but the whole reason my mom wanted it was so she could check in while she and my dad were traveling (and also sneak a peek at her bird feeders while she was away; avid birder, that one). So…

> Admittedly, it did have some authentication for accessing the video streams, but I didn't trust that thing as far as I could throw it So...you wanted to have authentication and it has authentication...I must be missing something.

It may not have been over HTTP, so possible to be sniffed. Or, even if it did have HTTPS, it might not generate keys in a secure way (or might use the same certificate as other devices). And you don't know if there are hidden backdoor accounts that might be found eventually...

So, yeah, it makes sense to block it - personally I block IOT devices from the Internet entirely (and don't let them initiate requests to my local network even) and use a VPN (IPSEC/IKEv2). That wouldn't work for devices that connect to cloud services, so I'd have to set up new firewall rules if I got one of them.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#179

Post by patrickg_zill »

I think even basic home routers these days, have enough cpu power to handle egress filtering.

If you have an iot device, by its nature it only needs to connect to a few services and hosts.

The manufacturer can provide this in their docs, and give an automatic config url that the router uses to load its egress rules.

The rules to load are displayed and the user checks they are legit by comparing to the printed version in the manual, then clicks ok. Or something like that.

Rate limits in terms of packets per second, total bandwidth both instantaneous and over time, are set also.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#180

Post by rabboRubble »

egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

My reading of Krebs On Security (krebsonsecurity.com), Mirai scans for factory default passwords or hardcoded default admin credentials. Going at this as a non-technical person, I would:

* Inventory all IOT devices in your possession.

* Find the device manuals and make sure you've changed the default password(s). Note there may be devices where it appears you've updated, but that have secret credentials you can't modify.

* Make note of which of your devices do not have an obvious way to change the factory default password.

* Keep an eye out for lists of devices that are known problems, here is one such sample list: https://blog.sucuri.net/2016/09/iot-home-router-botnet-lever...

* Check each manufacturer to see if they have issued a firmware upgrade to address security issues. Apply update.

* Think about retiring devices that appear on the "bad" hardware lists or the devices with unchangeable factory defaults.

Hope this helps.

Post reply on HN