Death of the Internet, Film at 11

bzs at bzs at
Sun Oct 23 18:47:50 UTC 2016

I think you make a very good point with the TRS80 etc comment, at
least implicitly: it's not just the vulnerable IoT devices, some sort
of infrastructure is needed to get the attack going at the volume
we've seen.

And perhaps therein lies an answer.

On October 22, 2016 at 16:47 jfmezei_nanog at (Jean-Francois Mezei) wrote:
 > Generic question:
 > The media seems to have concluded it was an "internet of things" that
 > caused this DDoS.
 > I have not seen any evidence of this. Has this been published by an
 > authoritative source or is it just assumed?
 > Has the type of device involved been identified?
 > I am curious on how some hacker in basement with his TRS80 or Commodore
 > Pet would be able to reach "bilions" of these devices to reprogram them.
 >  Vast majority of homes are behind NAT, which means that an incoming
 > packet has very little chance of reaching the IoT gizmo.
 > I amn guessing/hoping such devices have been identified and some
 > homweoners contacted ans asked to volunteer their device for forensic
 > analysis of where the attack came from ?
 > Is it more plausible that those devices were "hacked" in the OEM
 > firmware and sold with the "virus" built-in ? That would explain the
 > widespread attack.
 > Also, in cases such as this one, while the target has managed to
 > mitigate the attack, how long would such an attack typically continue
 > and require blocking ?
 > Since the attack seemed focused on eastern USA DNS servers, would it be
 > fair to assume that the attacks came mostly from the same region (aka:
 > devices installed in eastern USA) ? (since anycast would point them to
 > that).
 > OPr did the attack use actual IP addresses instead of the unicast ones
 > to specifically target servers ?
 > BTW, normally, if you change the "web" password on a "device", it would
 > also change telnet/SSH/ftp passwords.

        -Barry Shein

Software Tool & Die    | bzs at             |
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*

More information about the NANOG mailing list