News for hackers. Stuff that matters.

A comment on Mirai Botnet Linked to Dyn DNS DDoS Attacks. Parent comment

Re:Mirai Botnet Linked to Dyn DNS DDoS Attacks by soneil on Saturday October 22, 2016 @07:27AM (#12768280)
I'd like to see someone actually name & shame the devices involved. With evidence, of course.

I've had a quick poke around my house, and the couple of devices I have (wemo, philips hue) are holding pretty persistent outbound http connections - not dropping their trousers and exposing telnet.

Persistently exposed telnet sounds more to me like industrial control devices, network appliances, etc. But "IoT" is so vague that we're immediately jumping to blaming consumer devices.

[ Parent | on HN ]
Re:Mirai Botnet Linked to Dyn DNS DDoS Attacks by travanx on Saturday October 22, 2016 @11:44AM (#12769124)
Dahua. And then there are the Alibaba Chinese Hikvision cameras that generally can't be firmware updated. Seems like plenty of people port forward to their cameras as most of the camera forums say over and over to use VPN and not port forward.

"The specific Dahua IPC-HFWxxx old type vulnerable password was the one used to let this in, but that depends on how we apply our traps." http://blog.malwaremustdie.org/2016/10/mmd-0058-2016-elf-lin...

[ Parent | on HN ]