News for hackers. Stuff that matters.

A comment on Over 65,000 Home Routers Are Proxying Bad Traffic for Botnets, APTs.

Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by throwawya1w2 on Monday April 16, 2018 @06:47AM (#16848013)
I thought my home network was secure. Last week, I turned on my Surface and its lock screen had a "remote session active" screen. Before I could do anything, it turned itself off. When I turned it back on, it showed "low battery" and turned off. I have no idea if this was a bug or somebody remotely accessed it. I had everything updated to the latest software/firmware. Remote desktop itself was disabled on the surface (though it had "allow remote assistance" enabled"). I didn't have router web administration enabled. Router admin password as well as wifi password were unique, 15-20 chars long and I never used them anywhere else. Same thing for my Microsoft account that I use for Windows login. Wifi also had MAC address filtering enabled. There was only one more person using my network, and its unlikely they would do this because I don't think they know my password. And I don't think they are that technically knowledgeable other than to use a PC for browsing. I also had a Synology NAS with OpenVPN. Router was configured to forward the VPN port, but Synology's firewall was configured to allow connections only from 2 IP ranges that my phone gets when on mobile network. Strangely, after this incident, I turned off the VPN and now my NAS goes to sleep properly. It never used to sleep before. I sit right next to the NAS and I could hear the HDDs reading/writing all the time, although slowly. I always used to think may be someone was slowly copying files from my NAS.

I had earlier setup a pfsense box purely for ad blocking and to keep out Google/Microsoft creepware. But I had stopped using it because of the learning curve. Now, I am learning how to properly configure it.

Its kind of amusing if you think about it. In olden days, people had to worry about physical attack of their house. Nowadays, I am more worried about these virtual attacks.

[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by tinus_hn on Monday April 16, 2018 @07:44AM (#16848261)
Routers and NAT only protect against incoming connections. If someone can force your computer to make an outbound connection there is no protection.
[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by throwawya1w2 on Monday April 16, 2018 @10:06AM (#16849059)
The Surface was factory reset only a few days back. I don't use it that much except for occasional ebooks. The only software I had in it were Firefox, Chrome, Office and Drawboard if you don't consider all that Candy crush/Soda crush/Animal kingdom bloat that MS likes to push on us (which I promptly uninstalled).

I have to admit that I downloaded the pdf ebooks from piracy sites. So don't know if they had some malware in them. I did scan them with MBAM, Avira, MS Defender before use though. Note that i didn't download them from Surface. I downloaded them using a Ubuntu VirtulaBox VM running on another laptop. I restore the VM to a previous snapshot each time after use.

[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by tinus_hn on Monday April 16, 2018 @01:05PM (#16850642)
It could very well be the original Microsoft software doing this. Check if your Microsoft account and other cloud accounts you are using on that machine have been compromised.
[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by netsharc on Monday April 16, 2018 @08:06AM (#16848346)
And securing houses is easy, with locks, metal parts, and alarms. You know what you're doing network-security-wise but you still don't know if the baddies got in or not...
[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by tbihl on Monday April 16, 2018 @09:45AM (#16848914)
Of course, securing your home is only easy because of geographic separation between yourself and the types of places where thieves will break through a non-reinforced wall while you're out of town.
[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by mondoshawan on Monday April 16, 2018 @11:42AM (#16849728)
The typical aphorism is "Locks only keep honest people honest."

Really, even securing your house is tricky. My place in Florida was built with the hinges to the front door on the /outside/ because of local building codes. Unfortunately, I only realized that after it was built. The locks are nice, but any enterprising thief would simply pop the hinges and remove the door if I hadn't taken steps to prevent it.

Bypassing locks is easy, and security systems are only useful when law enforcement is at the ready (rare in many places).

[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by c22 on Monday April 16, 2018 @07:15PM (#16853824)
I had a girlfriend who would leave her sliding glass door ajar with a 2x4 to prevent it from being opened enough to let a person through. This was until I demonstrated that, unlatched, the door could just be lifted out of its frame and set aside.
[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by epicide on Monday April 16, 2018 @03:25PM (#16851923)
I think their point was that the person has to be at your house. E.g. they can't systematically and remotely try the door handle of homes halfway around the world.
[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by ComodoHacker on Monday April 16, 2018 @10:30AM (#16849213)
Have you looked into Windows logs?
[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by throwawya1w2 on Monday April 16, 2018 @12:37PM (#16850338)
I saw these entries in Event Viewer -> TerminalServices-LocalSessionManager.

I tried to turn it on around 8:50 pm. Here, "SURFACE\name" is my MS account.

> 4/9/2018 8:49:40 PM Remote Desktop Services: Session logoff succeeded: User: SURFACE\name Session ID: 3

> 4/9/2018 8:49:40 PM Session 3 has been disconnected by session 3

> 4/9/2018 8:49:40 PM %s from %S( #0x%x/0x%x )

> 4/9/2018 8:49:40 PM Session 3 has been disconnected, reason code 11

> 4/9/2018 8:49:41 PM Session 4 has been disconnected, reason code 11

> 4/9/2018 8:49:41 PM Remote Desktop Services: Session has been disconnected: User: SURFACE\name Session ID: 3 Source Network Address: LOCAL

> 4/9/2018 8:51:00 PM Begin session arbitration: User: SURFACE\name Session ID: 4

> 4/9/2018 8:51:00 PM End session arbitration: User: SURFACE\name Session ID: 4

>4/9/2018 8:51:00 PM Remote Desktop Services: Session logon succeeded: User: SURFACE\name Session ID: 4 Source Network Address: LOCAL

>4/9/2018 8:51:00 PM Remote Desktop Services: Shell start notification received: User: SURFACE\name Session ID: 4 Source Network Address: LOCAL

I am not sure if the entries at 8:49 pm is what I saw as the "remote session active". Also, I am not sure if this LocalSessionManager is the right place to look.

[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by RaleyField on Wednesday April 18, 2018 @03:27AM (#16865402)
Your post prompted me to check my own Even Viewer. After some frenzied searching for the meaning of "Remote Desktop Services" entries in my own logs I figured that alarm seems to stem only from unfortunate naming of events that LocalSessionManager drops. As this document describes[0] and after confirming with another account the events are generated when one account wishes to run a processes under another account ("Run as administrator/different user" functionality). It might be that Windows Update triggered this on your computer, consider also that Windows Update sometimes updates third party drivers and one wouldn't expect they follow all best practices.

[0] https://docs.microsoft.com/en-us/windows-hardware/customize/...

[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by ComodoHacker on Monday April 16, 2018 @12:46PM (#16850428)
There should be another TerminalServices-something or RemoteDesktop-something log which logs connection attempts in more detail.
[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by throwawya1w2 on Monday April 16, 2018 @07:20AM (#16848147)
Regarding pfsense, I want to add some more info just so that people may not getting any wrong idea about it.

I stopped using pfSense because I had enabled many block lists in pfBlockerNg and it was blocking sites like Github. Now, I am learning how to properly configure it. I also setup an ELK dashboard yesterday night. This is a heatmap of the scans in last 30 minutes.

https://imgur.com/a/cU5F0

[ Parent | on HN ]