A random thread for small computing things that don't really warrant a thread of their own

[Feanor]

With most of the great unwashed being behind NAT, how are these devices exploitable?

Who sets up port forwarding to their toaster?

[woollypigs]

Don't you want that lovely fresh toast smell when you get home from work along with a fresh cuppa? I mean you did remember to put a slice of bread in the kettle and fill up the toaster with water as you left at 5am for important meeting you sat up to 1:30am making that PowerPoint presentation for, didn't you?

[David Martin]

With most of the great unwashed being behind NAT, how are these devices exploitable?

Who sets up port forwarding to their toaster?

Router exploit, as most folk are on commodity (SKy, BT, Virgin) routers, then the network is yours.

[Feanor]

But is that really what's being talked about in this current report?

If it were, then there would be a lot of noise about insecure routers.
None allow remote management by default, I think.

The only widespread router exploit I can think of is where a router responds to DNS queries on the WAN port:
http://support.aa.net.uk/Category:Open_DNS_Resolvers

The suggestion here is that it was an exploit on cheap Internet-connected Things, which had default and non-changeable passwords.
These would only be exposed if there was explicit port-forwarding to expose them.

[simonp]

Many such devices use uPnP to enable port forwarding for you.

[Feanor]

Many such devices use uPnP to enable port forwarding for you.

How does that work?
( I've never used uPnP. )

If I have 10 internal webcams, all of which run webservers on port 80...
Obviously, the NAT would need to use different external ports for each.
How does the end user know what external port to connect to?

[Afasoas]

Coincidentally I've been involved in a conversation around running two Xboxen on the same network and a fully uPnP compliant 'hub' being the only way to make them play nicely together with regard to external ports. So I'm guessing there's some voodoo involved. Consequently I've started learning how uPnP really works.

I always disable uPnP on any device I get my hands on. And the only externally available ports on the WAN side of my firewall are for OpenVPN.

In light of the original issue, I've configured the internal DNS server to NXDOMAIN and log and requests for dynect.net. There have been none recorded so far. I'm still none the wiser. I suspect there's a device or an app which has some hard-coded DNS servers and perhaps the requests are not exploitive. I'm thinking of tweaking the firewall to block any traffic on port 53 that doesn't come from the internal DNS server.

In other news, OpenDNS's Umbrella is quite awesome. Their offerings to home users are confusing/baffling and the marketing BS on their website conflates matters. They have two offerings for home users. The first VIP home, which seems to have restrictive reporting, in that it won't tell you when a request was made. And then there's Prosumer which has the full reporting, but doesn't offer a 'full network option'. Instead it's five devices per user, with each device running an app to manage/tunnel DNS requests. Both options seem suitably castrated and the business offerings look prohibitively expensive so they won't be seeing any of my ££.

[Phil W]

Many such devices use uPnP to enable port forwarding for you.

How does that work?
( I've never used uPnP. )

If I have 10 internal webcams, all of which run webservers on port 80...
Obviously, the NAT would need to use different external ports for each.
How does the end user know what external port to connect to?

Very simple you do a port scan to find out which ones are open. Then based on the responses you get you lookup up known or potential exploits and away you go.

[Feanor]

I didn't mean to ask how are open ports exploitable, but rather how are they meant to be used properly.

How is an end user meant to connect to their home webcams if they have poked holes through NAT using uPnP?
How does the end user know what  external port number to connect to?

[Kim]

I didn't mean to ask how are open ports exploitable, but rather how are they meant to be used properly.

How is an end user meant to connect to their home webcams if they have poked holes through NAT using uPnP?
How does the end user know what  external port number to connect to?

End users are running some uPnP-aware webcamming (or gaming, or whatever) application.  The clients connect to a central server in the usual way and exchange such details thorough that.  The user just knows that if they want to play Duke Vapourwear Unlimited against their friends, they need to enable the uPnP tickybox in their router config.

I don't think uPnP helps you much if you want to run something standard on an arbitrary port.

[Feanor]

Ah, a server-in-the-sky.
Yes, that would work.
The uPnP device behind the NAT negotiates with the NAT and then sends the results of the negotiation to a server in the sky which the external client can look up.

[Afasoas]

Universal Plug and Play (UPnP) is a network protocol that allows compliant devices to automatically set port forwarding rules for themselves. (Apologies for telling those in the know to suck eggs etc.)

Also, there's no authorisation baked into UPnP - your router will trust any device on the network. There are standards for that sort of thing, but no bu$$er's implementing them.

[Feanor]

Yes, I know that.
But the question was:

Having used uPnP to automagically set port forwarding rules, how do external clients know what has been negotiated?
Several similar devices may exist inside the NAT.
uPnP must allow for that; so the several devices will all have different external port mappings.

A server-in-the-sky is a solution to that; where each device phones home and it's proprietary server-in-the-sky stores it's connection details ( public IP and negotiated port numbers )
Then the proprietary external clients can query the proprietary server for inbound connection details.

What a monumental fuck-up.
NAT is evil.

Anyways, to get back to the original topic...
What is actually happening with these Lucky Dragon Happy Finish Uncle webcams?

Are they punching holes in NAT via uPnP? Perhaps.
What external port are they opening?  Perhaps it doesn't matter.
Are the bad guys port scanning and attempting to use compromised HTTP logins on every port that responds in the off-chance it's a port-mapped weak webcam?

[Afasoas]

Having used uPnP to automagically set port forwarding rules, how do external clients know what has been negotiated?

Cloud magic and/or checking a range of ports. The latter is certainly true with some xbox games. Running multiple xboxen* behind the same behind the same NAT (technically PAT?) address is often a ropey affair because lots of routers don't properly support UPnP.

Are the bad guys port scanning and attempting to use compromised HTTP logins on every port that responds in the off-chance it's a port-mapped weak webcam?

I believe so. There are search engines that will show you lists of IPs with known easily-compromisable devices.

*I don't personally own multiple xboxen but a friend does, hence researching the issue.


On a different note, I think I'm left with disabling IPv6 to ensure guarantee of email to Gmail accounts. And using a relay for delivery to Microsoft accounts - or paying hefty sums for whitelisting via ReturnPath. It really does seem like the large email providers are stitching up the market so you're forced to pay for their email services (GSuite, Office365) if you want to send email from your own domain. This makes me want to swear lots.

[simonp]

I once made the mistake of plugging a windows PC directly into a cable modem. Infected within seconds. The attacks were basically continuous.

[Pickled Onion]

My Time Machine backups are failing. I've tried all the usual suggestions, it's looking like I'm going to have to trash it and start with a fresh one. A worrying prospect, of course I have copies of everything important but nowhere convenient to temporarily store a full restore image while I delete the 3 years of backup and re-image. It's a TB so is going to take some time...

[perpetual dan]

I've got an (infrequently used) second backup disk. I wanted to use it to back another machine up before upgrade. So, why can't I find the power supply?

[Afasoas]

Dearest little Intel NUC. Why do you insist on powering on at 12:17pm every day?

[David Martin]

WTF? https://blogs.technet.microsoft.com/odfb/2016/11/02/onedrive-crash-on-launch/

How can this be a serious effort at a robust system?

[Wombat]

My Time Machine backups are failing. I've tried all the usual suggestions, it's looking like I'm going to have to trash it and start with a fresh one. A worrying prospect, of course I have copies of everything important but nowhere convenient to temporarily store a full restore image while I delete the 3 years of backup and re-image. It's a TB so is going to take some time...

You should try using Acronis True Image on windows!  I think I've only ever once done two backups in succession without it all turning to custard and having to do a full one and reconfigure the whole thing.  It keeps on saying it can't find the backup destination when it is clearly and obviously looking right at it.  It seems to cope with the PC having 3 SSD drives, but can't cope with the one backup drive.  It also insists on setting scheduled backups for times the PC is never likely to be on, despite being told not to.

[mrcharly-YHT]

WTF? https://blogs.technet.microsoft.com/odfb/2016/11/02/onedrive-crash-on-launch/

How can this be a serious effort at a robust system?

Onedrive is an effing virus.

I work in a company where any automated copy to external system (dropbox, et al) is forbidden.

You can't uninstall onedrive

We've worked out a way to disable it, but that's it.

[ian]

My Time Machine backups are failing. I've tried all the usual suggestions, it's looking like I'm going to have to trash it and start with a fresh one. A worrying prospect, of course I have copies of everything important but nowhere convenient to temporarily store a full restore image while I delete the 3 years of backup and re-image. It's a TB so is going to take some time...

USB drives are cheap and capacious these days. I'm not sure why the TM is failing, is it the drive itself? I had one that got inexplicably corrupted, all the old data was there but it just wouldn't write to it any more. Rather than faff around (Google had a million suggestions for fixing it, but life is too short), I just backed up to a new drive and then once I was sure I had everything, deleted the corrupted TM and replaced it with the new one (I don't, tbh, need several years of incremental backups and everything important is copied to my NAS anyway). That drive is still running several months later, so it wasn't a hardware issue.

[Mr Larrington]

What the Wombat said.  Acronis True Image is a big pile of poo.  Macrium Reflect Free does everything I expected from Acronis, including working.

[Afasoas]

One Drive, Google Drive, Dropbox etc. are a nightmare when it comes to keeping data secure.

http://www.techrepublic.com/blog/it-security/dropsmack-using-dropbox-to-steal-files-and-deliver-malware/

[mrcharly-YHT]

One Drive, Google Drive, Dropbox etc. are a nightmare when it comes to keeping data secure.

http://www.techrepublic.com/blog/it-security/dropsmack-using-dropbox-to-steal-files-and-deliver-malware/

Interesting.
Important to note that on reading that article, it is apparent that the Dropbox db is secure (it was penetrated by the hacker getting the user's password and access to their laptop when on an unsecure network). Once they had access to the user's computer, they were able to use Dropbox as a vector to deliver a package into a machine in a secure network. It still relied on the user manually opening the file when in the network.

So the major flaw is still the user.