I keep meaning to address all the shadowserver reports, we get like 5 different ones each day I think now. I wonder if you could write some sort of email parser to pull in the reports and take the data from the attachments to automatically generate rules
On Mon, May 18, 2015 at 11:28 AM, Cassidy B. Larson <[email protected]> wrote: > If you don’t block it, or they don’t fix it, they’ll more than likely > participate in a DDOS. Plus, it could impact their service and they think > it’s your fault :) > I’ve seen a few of those types of DDOS this year. > > -c > > > On May 18, 2015, at 10:18 AM, Ken Hohhof <[email protected]> wrote: > > > > I finally started getting ShadowServer reports which are nice. > > > > One thing I notice is that about 5% of customers still have routers with > SSDP (the discovery protocol for UPnP) exposed on the WAN side. This > despite the fact that I scanned the network earlier this year and sent > notices to every single customer with this vulnerability. It tells me very > few did anything about it. Most of these are DLink DIR-615 routers, and > except for the very last version of that router, there is no FW update, > their only solution is to disable UPnP in the menus. Apparently that's too > difficult for customers. > > > > My question: is this serious enough to worry about? Should I just wait > for those DLink routers (or their owners) to die? > > > > I guess another solution would be to block ports 1900/2049/5783 but > these might be legitimately in use as ephemeral ports and I don't like > blocking high numbered ports. > > > > -- If you only see yourself as part of the team but you don't see your team as part of yourself you have already failed as part of the team.
