I have been using node.js and running live-server package in my project for a while with the following command:

node node_modules/live-server/live-server.js . --ignore=\"css/sass\" --open=./ --cors

Which uses the default http://127.0.0.1:8080/ address. The laptop I am using has "Norton Security" installed and today, without doing any change to the project's files, the program popped up a high severity alert with the following:

  • Name: Web Attack: CCTV-DVR Remote Code Execution
  • Action performed: No action is required
  • Attacker's computer: 192.168.1.84, 50473
  • Attacker's URL: 192.168.1.7:8080/language/Swedish${IFS}&&ping$IFS-c1$IFS-s41${IFS}192.168.1.84>/dev/null&&tar${IFS}/string.js "MY_PC_NAME (192.168.1.7 8080)
  • Destination address: MY_PC_NAME (192.168.1.7)
  • Origin address: 192.168.1.84
  • Traffic's description: TCP, Port 50473
  • Origin: \DEVICE\HARDDISKVOLUME3\PROGRAM FILES\NODEJS\NODE.EXE
  • Notes: the attack matches the signature of a known attack.

I am on wi-fi (WPA2-Personal) and just ran nslookup 192.168.1.84 and confirmed that this is one of the PCs in the network I'm connected. I am not in Sweden, but this is a place where different foreigners come to use the network, and I can tell by the attacker's computer name that the person is not likely to be Swedish either.

I don't know this person and what this kind of attack attempts to do. The Norton Security program I have installed is finishing its trial period in 4 days, and I was planning to use the default Windows Defender (Windows 10) after that. Any suggestions on how to proceed which doesn't require me cutting off the wireless?

  • I just disabled private network discovery in Control Panel\Network and Internet\Network and Sharing Centre\Advanced sharing settings (guest/public were already disabled)... Not sure if this will prevent these attacks though. – CPHPython Jan 5 at 12:57
  • @duskwuff thanks but I don't believe it is, since that "attack happens simply by providing an URL which points to the router's default network name". When the attack happened, I was not navigating or using any web service that called any URL. – CPHPython Mar 27 at 8:29

Which uses the default http://127.0.0.1:8080/ address.

127.0.0.1 is localhost and not reachable from outside. If you would really only bind to this address then the attacker would not be able to connect to this server from another computer but only connections from your computer itself would be possible.

But the software you are using does not use the default address of 127.0.0.1 as you claim. To cite from the documentation:

--port=NUMBER - select port to use, default: PORT env var or 8080
--host=ADDRESS - select host address to bind to, default: IP env var or 0.0.0.0 ("any address")

Thus, it will not bind to 127.0.0.1 but to 0.0.0.0 by default. This means your server is reachable by default also from outside your own computer. To fix this you should

  • set --host=127.0.0.1 when starting the server. This will make the server only accessible from the local machine.
  • and better also enable firewall on your machine in case you have other services running which should not be reachable from outside.
  • Thank you! I had no idea that that my local server could be seen from outside. I am now running it with that parameter and Norton also comes with a firewall embedded. I just added the attacker's IP to the list of the devices with restricted access. I also changed the trust-ability of the network from "public" to "restricted" (which they say it prevents other devices to access my PC). – CPHPython Jan 5 at 13:26
  • "I just added the attacker's IP to the list of the devices with restricted access" - and then the attacker changes its IP. You should better not blacklist systems but you should deny all incoming traffic, maybe except for a few explicitly whitelisted systems. – Steffen Ullrich Jan 5 at 13:31

As Steffen Ullrich helpfully suggested I restricted my live-server executions with the --host=127.0.0.1 parameter, only allowing it to deploy to my local IP address (limiting its chance of being deployed to other addresses).

Norton Security has an almost permanent active firewall, but I still did a few adjustment steps:

  • I modified the trust-ability of the specific network I am connected to from Public to Restricted, which prevents all direct access to my PC from other network devices.
  • I added to the list of "trusted" devices the attacker's IP address, and set its access to restricted. I am aware that this may be redundant, since the last step should prevent all communication from it, and its network's IP may change in the future. For now, it's mostly for logging purposes.

Since Norton's trial is ending in 4 days for me, I found that a similar operation can be done through Windows Firewall Advanced Security Inbound Rules:

  1. Add a "New Rule...";
  2. Choose the Custom option;
  3. On the Program tab, choose "All programs";
  4. On the Protocol and Ports tab, choose Any in the Protocol type field (this automatically considers All Ports, local and remote);
  5. On the Scope tab, choose Any IP address for the local field (you can define IP addresses ranges in the remote access, if you want some remote inbound connections);
  6. On the Action tab, choose Block the connection;
  7. On the Profile tab, make sure this rule applies to the group which the wi-fi network belongs to (or just leave them all selected: Domain, Private, Public);
  8. Give an obvious Name to the rule for remembering it later, just in case you need to change the range of IP addresses to block, e.g. "CUSTOM: BLOCK ALL INBOUND (private networks)"

I guess this is another way to solve the problem and seems to do what Norton does behind the scenes.

However, I am still curious to know more about this type of attack. If it wasn't for the development I am doing with node.js, I would probably haven't written the question and this answer. So I still appreciate any explanation about what the attack may attempt to do.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.