TCP backdoor 32764 – how we could patch the Internet (or part of it)

Re:TCP backdoor 32764 – how we could patch the Internet (or ... by lotsofcows on Wednesday January 22, 2014 @11:36AM (#7103636)

Anyone played with this?

term1$ tcpdump -i en1 -X -n port 32764

term2$ telnet 192.168.0.1 32764

Output doesn't show the expected hex code. Is this naive?

[ Parent | on HN ]

Re:TCP backdoor 32764 – how we could patch the Internet (or ... by ancarda on Wednesday January 22, 2014 @11:40AM (#7103673)

Yeah, I tried but with my external IP:

    $ telnet [redacted] 32764
    Trying [redacted]...
    telnet: connect to address [redacted]: Connection refused
    telnet: Unable to connect to remote host

Does this mean my router has no backdoor? Is it clever enough to avoid detection?

[ Parent | on HN ]

Re:TCP backdoor 32764 – how we could patch the Internet (or ... by sil3ntmac on Wednesday January 22, 2014 @12:32PM (#7104052)

Check your internal IP as well, some models are only vulnerable on the LAN.

Metasploit has a check module for this, and will also get you a shell:

https://community.rapid7.com/community/metasploit/blog/2014/...

[ Parent | on HN ]

Re:TCP backdoor 32764 – how we could patch the Internet (or ... by mhurron on Wednesday January 22, 2014 @11:55AM (#7103796)

Are you running one of the affected hardware models?

[ Parent | on HN ]

Re:TCP backdoor 32764 – how we could patch the Internet (or ... by ancarda on Wednesday January 22, 2014 @02:46PM (#7104892)

No, but I have a fairly uncommon router (not ISP supplied) so I was curious if it also had a backdoor. It doesn't respond on LAN so it seems my DrayTek Vigor 2750N is backdoor-free for now...

[ Parent | on HN ]

Re:TCP backdoor 32764 – how we could patch the Internet (or ... by walls on Wednesday January 22, 2014 @04:29PM (#7105504)

That just means it's free of this particular backdoor.

[ Parent | on HN ]

Re:TCP backdoor 32764 – how we could patch the Internet (or ... by ancarda on Wednesday January 22, 2014 @04:43PM (#7105574)

Hence "for now...". A new backdoor could surface tomorrow.

[ Parent | on HN ]