Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.networking > #3876
| From | Moe Trin <ibuprofin@painkiller.example.tld.invalid> |
|---|---|
| Newsgroups | comp.os.linux.networking |
| Subject | Re: What should I change my DNS to? (combined response) |
| Date | 2016-09-07 21:52 +0000 |
| Organization | This mind intentionally left blank. |
| Message-ID | <slrnnt1301.mar.ibuprofin@planck.phx.az.us> (permalink) |
| References | (4 earlier) <nqlslb$2ct$1@gioia.aioe.org> <slrnnsudm2.aik.ibuprofin@planck.phx.az.us> <0mt3ad-3jc.ln1@minas-tirith.valinor> <nqoigo$2e3$1@dont-email.me> <ojc5ad-4hl.ln1@minas-tirith.valinor> |
On Wed, 7 Sep 2016, in the Usenet newsgroup comp.os.linux.networking, in article
<ojc5ad-4hl.ln1@minas-tirith.valinor>, Carlos E. R. wrote:
>William Unruh wrote:
>> Carlos E. R. <robin_listas@invalid.es> wrote:
>>>> The usual problem - the customer has done "something" to the router,
>>>> so the ISP hell-desk people reach in (if they can) and reset things
>>>> to the factory defaults. Not a reflection on you, but most
>>>> customers haven't any idea what they are doing, and resetting things
>>>> to the factory default will get things "running". May not be safest,
>>>> but is easiest for them.
>>> Ah, I did not consider that one.
>> Except that having your router open to "resetting" from outside is a
>> HUGE security hole, since they can do so much more than just resetting.
Depends - but many manufacturers go further, giving administrative access
from outside. Quoting from TWO YEAR OLD web-page from TrendMicro.com:
Routers manufactured by Netcore, a popular brand for networking
equipment in China have a wide-open backdoor that can be fairly
easily exploited by attackers. These products are also sold under
the Netis brand name outside of China. This backdoor allows
cybercriminals to easily run arbitrary code on these routers,
rendering it vulnerable as a security device.
What is this backdoor? Simply put, it is an open UDP port listening
at port 53413. This port is accessible from the WAN side of the
router. This means that if the router in question has an externally
accessible IP address (i.e., almost all residential and SMB users),
an attacker from anywhere on the Internet can access the backdoor.
This backdoor is "protected" by a single hardcoded password located
in the routers's firmware. Netcore/Netis routers appear to have the
same password. This "protection" is essentially ineffective, as
attackers can easily log into these routers and users cannot
modify or disable this backdoor.
Can we all slap our foreheads and say "DUH!!!" (Shadowserver.org says
a ZMap scan found most of the 2 million-plus devices are in China, but
they're also found in Korea, Taiwan, Nepal, Pakistan, Hong Kong, and
elsewhere.) In August, I saw hundreds of such connection attempts here
in Arizona. "Duh!!!", indeed.
>Not from outside, but by the ISP personnel and from the ISP office.
And how exactly is such access restricted to ONLY the ISP office? Do
you really think the ISP has put a filter that knows the IP of the
office systems on each and every router/modem/what-ever? I don't
think so! Perimeter firewalls can filter access "from the world" but
what about the skript-kiddiez and wanna-be's who are customers of that
ISP (or others who have r00ted/zombied some idiot customer of the ISP)?
And as pointed out elsewhere, there are a terrifying number of systems
out there with a "secret" username/password of admin and admin.
You may want to look at recent issues of the Digest of the "A.C.M. Forum
on Risks to the Public in Computers and Related Systems" (the Usenet
newsgroup "comp.risks"). As stupid governments are NOT learning, an
open back-door for "them" is an open back-door for all.
Old guy
Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
What should I change my DNS to? F Volker <here@home.net> - 2016-09-06 06:32 +0700
Re: What should I change my DNS to? Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-06 03:35 +0000
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-06 13:48 +0700
Re: What should I change my DNS to? William Unruh <unruh@invalid.ca> - 2016-09-06 07:25 +0000
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-06 14:53 +0700
Re: What should I change my DNS to? Dan Purgert <dan@djph.net> - 2016-09-06 09:40 +0000
Re: What should I change my DNS to? William Unruh <unruh@invalid.ca> - 2016-09-06 10:35 +0000
Re: What should I change my DNS to? Dan Purgert <dan@djph.net> - 2016-09-06 11:09 +0000
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-07 08:53 +0700
Re: What should I change my DNS to? William Unruh <unruh@invalid.ca> - 2016-09-07 08:24 +0000
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:02 +0200
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-08 06:42 +0700
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-08 03:10 +0200
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-08 09:43 +0700
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-06 21:36 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 00:48 +0200
Re: What should I change my DNS to? (combined response) William Unruh <unruh@invalid.ca> - 2016-09-07 08:18 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:08 +0200
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 21:52 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-08 00:52 +0200
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-07 09:13 +0700
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 04:26 +0200
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-07 09:41 +0700
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:11 +0200
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-07 10:59 +0700
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 06:53 +0000
Re: What should I change my DNS to? (combined response) Dan Purgert <dan@djph.net> - 2016-09-07 11:02 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:21 +0200
Re: What should I change my DNS to? (combined response) Dan Purgert <dan@djph.net> - 2016-09-07 14:09 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 21:53 +0200
Re: What should I change my DNS to? (combined response) Dan Purgert <dan@djph.net> - 2016-09-08 11:06 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-08 15:22 +0200
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 06:55 +0000
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-07 14:27 +0700
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:28 +0200
Re: What should I change my DNS to? (combined response) Stefan Monnier <monnier@iro.umontreal.ca> - 2016-09-07 09:32 -0400
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 21:50 +0000
Re: What should I change my DNS to? (combined response) William Unruh <unruh@invalid.ca> - 2016-09-07 08:29 +0000
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-08 10:15 +0700
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-08 19:34 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-09 03:56 +0200
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-09 20:55 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-10 02:47 +0200
Re: What should I change my DNS to? (combined response) Bit Twister <BitTwister@mouse-potato.com> - 2016-09-10 08:27 +0000
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-10 22:53 +0000
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-06 13:35 +0200
Re: What should I change my DNS to? Aragorn <thorongil@telenet.be.invalid> - 2016-09-06 14:06 +0200
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-06 14:27 +0200
Re: What should I change my DNS to? Dan Purgert <dan@djph.net> - 2016-09-06 13:03 +0000
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-06 17:01 +0200
Re: What should I change my DNS to? Dan Purgert <dan@djph.net> - 2016-09-06 16:25 +0000
Re: What should I change my DNS to? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2016-09-06 21:37 +0300
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-06 23:42 +0200
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-07 09:26 +0700
Re: What should I change my DNS to? Roger Blake <rogblake@iname.invalid> - 2016-09-06 12:54 +0000
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-07 09:28 +0700
Re: What should I change my DNS to? William Unruh <unruh@invalid.ca> - 2016-09-07 08:25 +0000
Re: What should I change my DNS to? Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 03:29 +0000
csiph-web