How does malware, like the software used to create the botnet that recently DDoS'd Dyn, get past NAT? On a computer, I can see the user can be tricked into downloading untrusted code, or browser vulnerabilities can be exploited. But on internet-connected devices like security cameras, I can't imagine how it would ever connect to an untrusted server without malicious physical access. I'd expect most of them to be behind a NAT router, so how does the malware get in?
1
-
1I believe it was because of UPnP enabled on the routers.– INV3NT3DNov 21, 2016 at 20:33
Add a comment
|
1 Answer
A lot of these devices will use Universal Plug and Play (UPnP), a service that runs on many consumer routers and devices, allowing network devices to effectively add port forwarding rules on the router. Many consumers are unaware of this behavior and will thus have their devices exposed to the internet. This is just another example of IoT manufacturers choosing convenience over security.
answered Nov 21, 2016 at 20:35
-
3And of course the consumers want their security camera to be reachable from the internet so they can check their homes when they're not home. So even if UPnP wasn't there to do the job, they might follow instructions to set up port forwarding manually. Nov 21, 2016 at 22:06
-
Also you can do some pivoting. Let's say I find someone using a vulnerable Windows 7 and compromise the machine. From there I have a look around in the network and could possibly even manipulate firewall and NAT rules to make sure I can access any machine, like a camera. The reason would be that I estimate such devices to be much less monitored than e.g. a Desktop PC.– DraugrNov 22, 2016 at 10:17