Helped uncover a massive cyber incident today affecting multiple residential complexes and built in switches and infrastructure.
It appears the attackers were trying to reroute and intercept numerous individuals WFH residential traffic.
Add this to your threat list
It appears the attackers were trying to reroute and intercept numerous individuals WFH residential traffic.
Add this to your threat list
Residential complexes have their own built in routing for fiber.
After plugging in a new device into the residential facility preconfigured using ISP setup, after 24 hours noticed unknown devices being directly connected to subnet of the victims router.
After plugging in a new device into the residential facility preconfigured using ISP setup, after 24 hours noticed unknown devices being directly connected to subnet of the victims router.
Victims router was then exploited and administrative password was changed, additional devices were allowed by MAC address to join subnet of targeted victim
Looking over pcaps revealed that entire network in residential was turned into a flat network with no guest isolation.
Looking over pcaps revealed that entire network in residential was turned into a flat network with no guest isolation.
Confirmed with ISP today that this was not intentional, and that switch configurations were not in original state and that default remote administrative passwords on many of them were changed.
Another review of pcap logs revealed attempted https spoofing, layer 2 attacks
Another review of pcap logs revealed attempted https spoofing, layer 2 attacks
Being delivered by devices connected remotely who were bridging themselves into each switch and subnet systematically. They spent extra time on a few locations and then allowed themselves to reconnect and join via MAC
They specifically denied VPNs from connecting, changing any victim who connected via VPN a bad gateway.
Got to watch this happen in real time.
This is essentially the same as blasting your victims MFA with requests until they accept. Users turned off VPN to work
Got to watch this happen in real time.
This is essentially the same as blasting your victims MFA with requests until they accept. Users turned off VPN to work
ISP is not throwing out the possibility of hybrid physical and cyber incidents being employed here.
They said they are beefing up the physical protection of this and other units and will be inspecting other properties as well.
They said they are beefing up the physical protection of this and other units and will be inspecting other properties as well.
Reminder: If you plug directly into an ethernet connection in your apartment/condo - that switch is *somewhere* and likely out of your control.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
