We've all read a lot about the scans and exploits of UPNP (Universal Plug N Play), on UDP port 1900. Jens, one of our readers, pinged us this morning with a question about an uptick he was seeing in TCP/5000, which is also listed as UPNP - who knew? (not me, that's who!)
Or if anyone has a sample of the attack software or any malware involved, we'd of course love a sample of that as well !
=============== |
Rob VandenBrink 579 Posts ISC Handler Mar 5th 2014 |
Thread locked Subscribe |
Mar 5th 2014 8 years ago |
Captured a load of packets here. By far and away most are Synology NAS exploits, based on a vulnerability announced towards the end of of last year. CGI exploits based on default HTTP server listening on hyatt at port. Mentioned this on Twitter earlier in the week as well.
|
Anonymous |
Quote |
Mar 6th 2014 8 years ago |
Edited -- double post.
|
tillo 7 Posts |
Quote |
Mar 6th 2014 8 years ago |
Port TCP/5000 may be listed as UPnP but it's also the default HTTP administration interface of any Synology equipment.
Since the discovery of a couple of remotely exploitable critical vulnerabilities this year, I'm not surprised it gets targeted. |
tillo 7 Posts |
Quote |
Mar 6th 2014 8 years ago |
Sign Up for Free or Log In to start participating in the conversation!