Bitcoin Forum
May 07, 2024, 12:17:33 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: potential Multicast DNS vulnerability.  (Read 215 times)
calkob (OP)
Hero Member
*****
Offline Offline

Activity: 1092
Merit: 520


View Profile
January 16, 2020, 02:36:13 PM
Merited by ABCbits (1)
 #1

i set up a Node running over Tor last week and am now receiving a message from my ISP that i am vulnerable to a potential Multicast DNS vulnerability.  I have read that this is something to do with using 127.0.0.1 but don't really get why.  Anyone understand whats going on here?

I have put the text from the ISP provider below for reference.


Letter Text

Your home devices could be at risk

We're writing to let you know that a device connected to your home network has been identified as having a potential Multicast DNS vulnerability.

Multicast DNS is commonly used to share music and video streaming services between devices on your home network. When exposed to the wider Internet, it can be misused by 3rd parties in order to commit abuse.

It is therefore important that you follow the advice in this letter.

What has happened?

We suspect the device may have been misconfigured by you, someone in your household or without your knowledge. If the settings are left unchanged they can be exploited to unwittingly participate in malicious activities, for example a Distributed Denial of Service (DDoS) attack.
1715084253
Hero Member
*
Offline Offline

Posts: 1715084253

View Profile Personal Message (Offline)

Ignore
1715084253
Reply with quote  #2

1715084253
Report to moderator
1715084253
Hero Member
*
Offline Offline

Posts: 1715084253

View Profile Personal Message (Offline)

Ignore
1715084253
Reply with quote  #2

1715084253
Report to moderator
1715084253
Hero Member
*
Offline Offline

Posts: 1715084253

View Profile Personal Message (Offline)

Ignore
1715084253
Reply with quote  #2

1715084253
Report to moderator
Unlike traditional banking where clients have only a few account numbers, with Bitcoin people can create an unlimited number of accounts (addresses). This can be used to easily track payments, and it improves anonymity.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
AdolfinWolf
Legendary
*
Offline Offline

Activity: 1946
Merit: 1427


View Profile
January 16, 2020, 03:36:39 PM
Last edit: January 16, 2020, 04:53:29 PM by AdolfinWolf
Merited by ABCbits (1)
 #2

We suspect the device may have been misconfigured by you, someone in your household or without your knowledge. If the settings are left unchanged they can be exploited to unwittingly participate in malicious activities, for example a Distributed Denial of Service (DDoS) attack.
I'm not sure if this is 100% the case here; but often when people do things such as running nodes on their home network (and especially anything to do with tor/ other "nefarious" traffic)- these are send out in "error" -

 they simply see a huge influx of traffic going through your network, due to the node you have running over tor, and because it's running over tor, it's often seen by the internet provider as "malicious" traffic. Hence, they ask you to close your ports, and check your firewall, as is mentioned here; https://www.virginmedia.com/help/multicast-dns-vulnerability-alert

You could try to do so (and by that i mean fixing the multicast "vulnerability") but i'm afraid you'll break your node in the process of doing so. (As running your node is most likely what sent out the warning in the first place; but; as i said; i'm not 100% sure.)


DaveF
Legendary
*
Offline Offline

Activity: 3472
Merit: 6264


Crypto Swap Exchange


View Profile WWW
January 16, 2020, 10:56:59 PM
 #3

You did not say where you are or who your provider is but:
Is your modem / router whatever provided by you or your ISP?
If not what is the make / model?

Same with your router / firewall. Yours or theirs?
If yours make / model?

If they supplied it it's their problem if you did that is usually the device they see.

Moving into your network have you added anything? Wi-Fi speakers that were a Christmas gift?
Other things? Smart bulb controller?

PDF talking about it (long read) https://tinyurl.com/sqsczcz

-Dave

█▀▀▀











█▄▄▄
▀▀▀▀▀▀▀▀▀▀▀
e
▄▄▄▄▄▄▄▄▄▄▄
█████████████
████████████▄███
██▐███████▄█████▀
█████████▄████▀
███▐████▄███▀
████▐██████▀
█████▀█████
███████████▄
████████████▄
██▄█████▀█████▄
▄█████████▀█████▀
███████████▀██▀
████▀█████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
c.h.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀█











▄▄▄█
▄██████▄▄▄
█████████████▄▄
███████████████
███████████████
███████████████
███████████████
███░░█████████
███▌▐█████████
█████████████
███████████▀
██████████▀
████████▀
▀██▀▀
calkob (OP)
Hero Member
*****
Offline Offline

Activity: 1092
Merit: 520


View Profile
January 17, 2020, 10:07:01 AM
 #4

Thanks for the replies guys much appreciated.  I am certain that the problem is due to the Tor node but was just looking to see if anyone else had experience in why this would be. 

Cheers
calkob (OP)
Hero Member
*****
Offline Offline

Activity: 1092
Merit: 520


View Profile
January 24, 2020, 02:26:25 PM
 #5

Thanks, just as i thought.  Wink
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!