Abuse of CPE Devices and Recommended Fixes
summary
Carnegie Mellon measurement finds roughly 21 million open DNS resolvers, nearly half sitting on DSL home links, and many misconfigured inside cheap home routers; scans use IP geolocation and connection-speed data from Newar and analysis with pmap and silk tools tied to the Open Resolver Project. Findings link these boxes to DNS amplification (Spamhaus-scale DDoS) and Operation Ghost Click DNS hijack. Recommendations: forced automatic firmware updates, device expiration or UL-like security certification, and universal source-address validation (BCP38).
AI-written summary · about
chapters (4)
- 0:00Abuse of CPE Devices and Recommended Fixes
- 2:04The home router is a network proxy for most things on your home network So own that and you control even well-defended devices on the home network DNS changer botnet
- 6:16It's hard to say exactly what device is the open resolver. But the link speed of the connection gives a good clue as to if it is a home or small business user as compared to an enterprise
- 9:11Device manufacturers need a path for continuous upgrades Implement source address validation Reconfigure each device so it can't be leveraged quite so effectively Responsibility to manufacturers and providers
related talks
40mAll Your LAN are Belong to Us. Managing the Real Threats to Remote Workers.
34mPractical Steps for Reducing Exposure and Detecting Compromise
25mDark Side of the DNS Force
29mGlobal Measurement of DNS Manipulation
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
47mDNS On Fire
20mEnd-Users Get Maneuvered: Empirical Analysis of Redirection Hijacking in Content Delivery Networks
34mUsing DNS as a layer of defense