bk99.de entertain the web since 1997

bk99.de
KrebsOnSecurity · NetworksCurated

The internet of already dangerous things

Summary

Brian Krebs does not warn of a distant IoT risk but of millions of devices that were already reachable and could amplify DDoS attacks. For the report quoted, Arbor Networks surveyed almost 300 organisations. 38 percent reported more than 21 DDoS attacks per month.

Ideas

  • Default services that are switched on quietly turn consumer devices into public attack tools.
  • SSDP and open resolvers amplify small requests into large floods of traffic.
  • Spoofed sender addresses direct the responses of many systems to a single victim.
  • DDoS for hire lowers the cost and expertise needed for effective attacks.
  • The consequences of vendor decisions persist globally long after products have been sold.
  • Cleaning up devices requires coordinated action across operator and national borders.

Insights

  • Insecure defaults shift product costs onto the entire internet.
  • Millions of small misconfigurations together form critical attack infrastructure.
  • Network hygiene resembles public health, because individual inaction has collective consequences.

Quotes

  • The real threat is from The Internet of Things We Already Have That Need Fixing Today. – Brian Krebs

Habits

  • Krebs links measurement data from network operators with attacks on the blog’s own infrastructure.

Facts

  • Akamai found 4.1 million internet-facing UPnP devices that could potentially be abused.
  • The Open Resolver Project recorded more than 28 million devices that could be abused at the time.

References

Critique

  • The figures are a historical snapshot and do not describe today’s device population.
  • The disease metaphor explains coordination well but only roughly names who is responsible.

Remarks

  • The article appeared more than a year before Mirai’s publicly visible escalation.
  • Many problems of the time live on in new device classes and protocols.

Recommendations

  • Disable WAN services and automatic port forwarding you do not need.
  • Filter spoofed source addresses at network borders according to BCP 38.
  • Take inventory of reachable device services and monitor configuration changes.

Read the original article

Search the Web Archive

hß · 2015

Free Wi-Fi: Freifunk volunteers provide internet for refugees

In 2015 Freifunk initiatives provided refugee accommodation in Hamburg, Stuttgart, Hanover, Dortmund and other cities with free Wi-Fi. There was often no internet connection there; the Freifunk volunteers built the infrastructure, partly using directional radio, and financed it through donations. Authorities held back because of the German “Störerhaftung” (secondary liability), which the volunteers circumvented by routing the traffic via VPN to their own provider.

hß · 2008

IETF discusses transition scenarios for the new internet protocol IPv6

In Dublin in 2008 the IETF discussed how IPv4 devices could continue to communicate during the transition to IPv6, since all 4.3 billion IPv4 addresses were expected to be allocated in around three years. Comcast engineer Alain Durand presented “Dual-Stack Lite”: IPv4 is tunnelled through the provider’s IPv6 network and translated there using carrier-grade NAT. Experts such as Fred Baker and Gert Döring warned that such NAT could delay IPv6 and called for native deployment.

g · 2004

T-Com wants to switch the telephone network to the internet protocol

In January 2004 T-Com, Telekom’s fixed-network division, announced that it would switch its entire telephone network to internet technology, well before 2020. With internet telephony, lines no longer have to be switched exclusively between two parties; allocating bandwidth is enough. The technology also needs less space and power than classic exchanges.