Mystery malware destroys 600k routers from a single ISP during 72-hour span

Re:Mystery malware destroys 600k routers from a single ISP d... by luma on Thursday May 30, 2024 @12:48PM (#40525832)

Presumably, Windstream is logging customer traffic as a matter of course. It might just be metadata (NetFlow/sFlow/IPFIX/etc), but one way or the other the only way they have this information is if they are recording and retaining it.

Hopefully this is made clear in Windstream's contract terms.

[ Parent | on HN ]

Re:Mystery malware destroys 600k routers from a single ISP d... by londons_explore on Thursday May 30, 2024 @12:59PM (#40525982)

These aren't likely 'top flows', since the C&C data will probably only be a few kilobytes.

So to capture this, you at a minimum need to be logging every TCP connection's SRC IP and DST IP.

And they seem pretty confident in their worldwide map and fairly exact counts, so I would guess they must have probes covering most of the world doing this monitoring, and it likely isn't just 1-in-a-million sampling either...

[ Parent | on HN ]

Re:Mystery malware destroys 600k routers from a single ISP d... by luma on Thursday May 30, 2024 @02:38PM (#40527201)

For whatever it's worth, what you describe above is specifically what IPFIX/NetFlow etc does. Not full-take, just metadata for each flow such as the time, src/dst ip/port, tcp sequence #, octets sent, etc.

This is common in datacenters for traffic and flow analysis for troubleshooting, capacity planning, and the occasional incident response.

More details: https://en.wikipedia.org/wiki/IP_Flow_Information_Export

[ Parent | on HN ]