News for hackers. Stuff that matters.

A comment on Mystery malware destroys 600k routers from a single ISP during 72-hour span. Parent comment

Re:Mystery malware destroys 600k routers from a single ISP d... by codexon on Thursday May 30, 2024 @03:01PM (#40527422)
Lumen is a tier 1 network so a lot of traffic passes through them. They can man-in-the-middle the traffic and see the TCP packets going through their network.
[ Parent | on HN ]
Re:Mystery malware destroys 600k routers from a single ISP d... by perlgeek on Thursday May 30, 2024 @03:09PM (#40527501)
"They can man-in-the-middle the traffic" could be interpreted as them having to actively do something to become the man in the middle, when they already are.

It's likely they just do sampling (think netflow) to get some statistics over the data that's already transiting their network.

[ Parent | on HN ]