3

Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone was able to connect with Telnet, and upload software to mine bitcoins.

If this is possible, other malware could be installed that tries to infect other computers in the network. Because these devices are not monitored they are ideal for hiding out.

So your average Windows computer is infected with malware, it finds a tv recorder in your network, infects that. The Windows PC is cleaned of its malware, but the recorder stays undetected, and after a while it infects another computer, etc...

How can I detect infected devices on my local network? What methods are there to prevent this from happening?

closed as too broad by Adi, D.W., Xander, Iszi, TildalWave May 6 '14 at 16:10

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

4

Most of the malware in our network is detected by the odd traffic it generates.
For example, when a device on the network is communicating with a known bot command and control network, we know it immediately. Infected devices will also try to communicate in unexpected ways with other devices on the network and this is also detected. We implement (and adjust) rules about what traffic generates alerts. One such rule is attempted communication with addresses that were registered within last 14 days.

Of course, it is an arms race as malware comes up with interesting ways to evade such detection.

Second most common way is the anti-virus scans we do. Brand new malware won't have a signature, but eventually the signatures are known.

I know you are talking about a home network, but the same technique applies. You would have something like Snort installed and write signatures about what traffic is allowed between your Windows machine and that DVR described in the article. Malware communication will hopefully trigger the alert in Snort so you can detect the infection.

  • +1 You detect infections by behavior or by known static signature. – schroeder May 6 '14 at 14:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.