TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

The Pumpkin Eclipse

355 点作者 alexrustic12 个月前

20 条评论

Scoundreller12 个月前
&gt; These reports led us to believe the problem was likely a firmware issue, as most other issues could be resolved through a factory reset.<p>My dream is to intercept the write-enable lines on the flash chips holding these firmwares so I can lock out updates. And schedule a daily reboot for any memory-resident-only crap.<p>That’s what we used to do on, ahem, satellite receivers, 20 years ago and maybe we all need to treat every device attached to the internet as having a similar susceptibility to “electronic counter-measures”.<p>Or at least monitor them for updates and light up a light when an update happens if it was my own equipment and I’d know if it should go off or not.
评论 #40526002 未加载
评论 #40526161 未加载
评论 #40525638 未加载
评论 #40525911 未加载
评论 #40525735 未加载
评论 #40526770 未加载
评论 #40526273 未加载
评论 #40525697 未加载
评论 #40525447 未加载
nisa12 个月前
Article is light on the interesting details. How did they came in? Do these routers have open ports and services by default and answer to the Internet in a meaningful way?<p>Couldn&#x27;t someone grab different firmware versions and compare them?<p>Looks like they are doing what everyone else is doing and using OpenWrt with a vendor SDK: <a href="https:&#x2F;&#x2F;forum.openwrt.org&#x2F;t&#x2F;openwrt-support-for-actiontec-t3200m&#x2F;154720" rel="nofollow">https:&#x2F;&#x2F;forum.openwrt.org&#x2F;t&#x2F;openwrt-support-for-actiontec-t3...</a><p>What&#x27;s interesting here is speculated the vendor send a malicious&#x2F;broken update: <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;Windstream&#x2F;comments&#x2F;17g9qdu&#x2F;solid_red_light_on_t3200_modem&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;Windstream&#x2F;comments&#x2F;17g9qdu&#x2F;solid_r...</a><p>So why is there no official statement from the ISP? If it was an attack shouldn&#x27;t there be an investigation?<p>I&#x27;m not familiar with how this is handled in the USA but this looks really strange.<p>Maybe these machines were bot infested <i>and</i> the vendor pushed an update that broke everything?<p>Maybe it&#x27;s like in the article and it was a coordinated attack maybe involving ransom and everyone got told it&#x27;s a faulty firmware update, keep calm?<p>which is also kind of bad, as the customer I&#x27;d like to know if there security incidents.<p>Has anyone links to firmware images for these devices? Or any more details?
评论 #40533480 未加载
londons_explore12 个月前
&gt; Lumen identified over 330,000 unique IP addresses that communicated with one of 75 observed C2 nodes<p>How does Black Lotus Labs global telemetry know which IP communicated with which other IP if they have control of neither endpoint? Who&#x2F;what is keeping traffic logs?<p>If these guys can do it, remind me again how Tor is secure because nobody could possibly be able to follow packets from your machine, through the onion hops, to the exit node where the same packet is available unencrypted...
评论 #40528077 未加载
评论 #40526333 未加载
评论 #40525810 未加载
评论 #40525832 未加载
评论 #40530807 未加载
评论 #40525959 未加载
评论 #40527422 未加载
ronnier12 个月前
For a few years now I only buy a small x86 box with dual nics and run OpenWRT. I love it. It&#x27;s open source, lots of support, good community. It supports wireguard. Latest version allows you to even run docker containers.
评论 #40525841 未加载
评论 #40525845 未加载
评论 #40525772 未加载
评论 #40533487 未加载
Kiboneu12 个月前
Well if you backdoor 600k routers and introduce a firmware bug with one of your patches, this is what happens.<p>Can&#x27;t they just stage their updates? Surely, malware authors and users must be too cool for adopting standard prod practices.
评论 #40527517 未加载
bostonpete12 个月前
What is the significance of the article&#x2F;post title...?
评论 #40527293 未加载
评论 #40529966 未加载
pragma_x12 个月前
For anyone else that was confused by the headline, this is about the destruction of 600,000 individual (small) routers. Not routers that are worth $600,000 (each or combined).
thimkerbell12 个月前
@dang, if there are karma points at HN, you could add some for submitters who improve upon the oft-execrable original clickbait headlines&#x2F;titles. (Here, I see present verb tense being used for an incident from October of last year.)
评论 #40540577 未加载
sgtaylor512 个月前
related article from Ars Technica: <a href="https:&#x2F;&#x2F;arstechnica.com&#x2F;security&#x2F;2024&#x2F;05&#x2F;mystery-malware-destroys-600000-routers-from-a-single-isp-during-72-hour-span&#x2F;" rel="nofollow">https:&#x2F;&#x2F;arstechnica.com&#x2F;security&#x2F;2024&#x2F;05&#x2F;mystery-malware-des...</a>
评论 #40525551 未加载
steelframe12 个月前
For my home network I&#x27;ve purchased a networking appliance form-factor computer, which is basically a regular old an i3 with VT-x support in a fanless case and 4 2.5GiB NICs. I&#x27;ve installed my favorite stable Linux distro that gets regular automated security updates in both host and a VM, and I&#x27;ve device-mapped 3 of the NICs into that VM. The remaining NIC remains unattached to anything unless I want to SSH in to the host. I&#x27;m running UFW and Shorewall in the VM to perform firewall and routing tasks. If I want to tweak anything I just SSH in to that VM. I have a snapshot of the VM disk in case I mess something up so I can trivially roll back to something that I know works.<p>I&#x27;ve purchased a couple of cheaper commercial WiFi access points, and I&#x27;ve placed them in my house with channels set up to minimize interference.<p>Prior to this I&#x27;ve gone through several iterations of network products from the likes of Apple, Google, and ASUS, and they all had issues with performance and reliability. For example infuriating random periods of 3-5 seconds of dropped packets in the middle of Zoom conferences and what not.<p>Since I&#x27;ve rolled my own I&#x27;ve had zero issues, and I have a higher degree of confidence that it&#x27;s configured securely and is getting relevant security updates. In short, my home network doesn&#x27;t have a problem unless some significant chunk of the world that&#x27;s running the same well-known stable Linux distro also has a problem.
评论 #40528504 未加载
评论 #40527223 未加载
xacky12 个月前
Reminds me of the CIH virus. It&#x27;s only a matter of time for ransomware authors to start using firmware blanking as a new technique.
jslakro12 个月前
Useful recommendations from the canadian government<p><a href="https:&#x2F;&#x2F;www.cyber.gc.ca&#x2F;en&#x2F;guidance&#x2F;routers-cyber-security-best-practices-itsap80019" rel="nofollow">https:&#x2F;&#x2F;www.cyber.gc.ca&#x2F;en&#x2F;guidance&#x2F;routers-cyber-security-b...</a>
jeffbee12 个月前
&quot;Router&quot; being used to mean customer premises equipment, it seems.
评论 #40525847 未加载
its-summertime12 个月前
Is the &gt;2x increase in other devices addressed in any form?
localfirst12 个月前
this along with other recent security incidents suggest somebody is rehearsing for massive campaign tied to another geopolitical ambitions.
评论 #40529040 未加载
评论 #40526274 未加载
评论 #40526219 未加载
scrps12 个月前
I read the lotus labs blog post they linked and they mentioned no analysis of the actual firmware payload that actually bricked them, is this out there or a sample?<p>I&#x27;d be curious to know if it was actually meant to brick or someone f&#x27;ed the image and accidentally bricked them trying to be clever.<p>Also if it was a nation state why would you so publically burn your capability bricking residential routers on an ISP that seems to mostly serve rural areas, if they did it for testing that&#x27;d be real dumb.
hcfman12 个月前
Which routers are affected ?
评论 #40525453 未加载
评论 #40525364 未加载
评论 #40525378 未加载
bitnasty12 个月前
Why would someone build a botnet this complex then brick it?
ChrisArchitect12 个月前
[dupe]<p>Discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40525130">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40525130</a>
mistrial912 个月前
do they say what US ISP was targeted ? these are the routers in people&#x27;s homes basically?
评论 #40536957 未加载