Hello, welcome to the Wednesday, November 20th, 2019 edition of the Sandcented Storm Center's

Stormcast. My name is Johannes Ulrich. And I'm recording from Riyadh, Saudi Arabia. When I'm teaching

classes, I'm sometimes going with the students over some recent detects in the internet storm center.

And one thing we came across looking at some of our recent logs was a real marked increase

in scans for port 60,001.

Now this particular port isn't immediately recognized as something well known, so I set up a quick honeypot and well, really only took seconds for a query to arrive, and it was a fairly simple HTTP request that exploited a vulnerability that's well known for a while now in some

cheap Chinese DVRs. Pentest partners originally did write a report about the JAWS web server found

in these DVRs back in 2016, and the report is almost comical in the type of vulnerabilities.

They're finding, like, multiple unauthenticated ways to execute code, either via non-passer

protected telnet servers, very buggy web Cgi's. Oh, and it also does send occasional still images to a hard-coded

email address that's included in the default firmware. Now, for a while now, this vulnerability

has been exploited against Port 80, which appears to be the normal default port for the web server, but apparently the

bad guys have figured out that there is a real good population of these DVRs listening on

port 60,001. Actually, it turns out that currently out of the 100,000 or so DVRs that showed analysts, more than 70,000 are listening

on this high port.

So I guess it was about time for someone to put these DVRs to work.

If you do have one of these DVRs, probably your best bet is to just toss them.

Don't try to patch them.

Whatever firmware you're downloading, it probably just has a new set of similar vulnerabilities.

And in the past, I have reported about the Pone to Own contest, which was put together by the

Saraday initiative, and typically it does offer quite large

sums of money for attackers that find new vulnerabilities in commonly used software.

...