[Leica] collateral damage

[Brian Reid]

Most home computers are not vulnerable to these attacks.

For an attack to succeed, the victim computer must be listening to the 
greater internet, and receive a fraudulent transmission that it responds 
to. With the exception of multiplayer gaming, all home computers are 
behind a router that only allows inbound transmissions that are in 
direct response to an earlier outbound transmission.

When I was a young teenager, I fooled around a lot with telephone 
technology. There was at that time a phone number that you could call to 
get a weather report. 936-1212. If you called that number, you'd get a 
30-second recording about what to expect. I built a box that robotically 
phoned people and played the weather at them. They heard exactly what 
they would have heard if they had called 936-1212.

Most people didn't realize that this was backwards. That you're supposed 
to phone the weather; the weather isn't supposed to phone you. Inbound 
weather reports were to be played only in response to an outbound phone 
call.

Ignoring the issue of multiplayer video games, your home router will 
protect you against all external attacks. That doesn't mean you are 
safe, because for home computers, the criminals try to lure you into 
doing something that will get you in trouble. Fraudulent email, 
fraudulent web pages, etc.

Server computers are a different story. Their job is to respond to 
outside requests, and so it doesn't work to protect them from outside 
requests. They have to be able to detect that a request is malicious and 
handle it appropriately.

The choice of targets is complex. My servers are in a data center that 
also houses a number of critical resources. That means that if the 
criminals study routing (which they do), they can notice that the route 
to my servers is very similar to the route to other more valuable 
services. And they have extra attack capacity; why not use it and see 
what happens? They do not have access to traffic information unless they 
have insider accomplices, which usually they don't.





On 2022-02-27 09:51, Aram Langhans via LUG wrote:
> Hi Brian.  I have no knowledge of how these attacks work but thanks
> for the notice.  Do they look for IP addresses that have a lot of
> traffic and try to access them thinking if there is traffic it might
> be an important site?  Or is it just random?