The Lumen blog hosts Black Lotus Labs research on malware, router compromises, and network threats.
HN links it for security research on router malware and CLDAP reflection attacks. A commenter calls one write-up a fascinating read.
Hi OP here
In my experience I think the biggest bottleneck that I've found is filesystem performance. FFS (Fast File System) is pretty freakin slow, and you should really consider redundancy options in case one of the drives fails because its tolerance for recovery from failure isn't the best. It definitely isn't the most optimal or sometimes even viable solution for when you need performance on the filesystem to be high.
Given these things though chances are a lot lower that someone finds something filesystem-level which constitutes a way to hide malicious code or whatever (For example NTFS and hiding malware in Alternative Data Streams [1] or messing around with timestamps [2], or local privilege escalation in Linux's filesystem layer being a big vector for attack lately [3] - Hell even WSL mounting /mnt/c/ as chmod 777 which can wreck some real havok in something as basic as a few lines of python or ruby like stealing your browser session cookies [4] or just wrecking your windows install by deleting system32 like a bad prank from a decade ago [5])
[1] https://www.youtube.com/watch?v=S4MBzeni9Eo
[2] https://www.sciencedirect.com/science/article/pii/S2666281720300159
[3] https://blog.qualys.com/vulnerabilities-threat-research/2021/07/20/sequoia-a-local-privilege-escalation-vulnerability-in-linuxs-filesystem-layer-cve-2021-33909
[4] https://blog.lumen.com/windows-subsystem-for-linux-wsl-threats/
[5]…
TL;DR of Ars: Connectionless LDAP
Actual article that Ars writes about: https://blog.lumen.com/cldap-reflectors-on-the-rise-despite-best-practice/
Actual news (less vague title than Ars'): the number of vulnerable systems has increased ("from the 7K range to over 12K" "over the last 12 months"). Only 15% stays online longer than a year, though, so it seems that most admins catch on after a while. "[T]he Connectionless Lightweight Directory Access Protocol (CLDAP) [has a] Bandwidth Amplification Factor (BAF) of 56 to 70x".
Actionable advice for Windows Server owners is provided at the bottom of both articles.
---
> [heading] A never-ending arms race
Are there still protocols newly put into production that do not take reflection attacks into account? In my experience, it's all legacy. And don't more and more ISPs enforce BCP38 (http://bcp38.info)?
Not sure this headline of Ars' is true.
There's a lot more information in the Black Lotus Labs blog post that Ars links to:
> However, as of the time of this writing, we have only been able to obtain the exploit script for JCG-Q20 model routers. In this case, the actor exploited known CVEs (CVE-2020-26878 and CVE-2020-26879)
> The device types consisted of, but were not limited to: Cisco RV 320, 325 and 420; Asus RT-AC68U, RT-AC530, RT-AC68P and RT-AC1900U; DrayTek Vigor 3900 and unspecified NETGEAR devices.
https://blog.lumen.com/zuorat-hijacks-soho-routers-to-silently-stalk-networks/
If you're vulnerable to attacks from the LAN, you're vulnerable to your wi-fi router (or your coffee shop/workplace's router) being compromised, which is quite common; see e.g. https://www.bleepingcomputer.com/news/security/mirai-botnet-targets-22-flaws-in-d-link-zyxel-netgear-devices/ and https://blog.lumen.com/the-pumpkin-eclipse/
Assuming that most routers are silently compromised, with their command-and-control operators just waiting for an exploit like this one, is almost par for the course these days!
The article from the security researchers is a fascinating read: https://blog.lumen.com/the-darkside-of-themoon/
This is a spam site.
Actual link: https://blog.lumen.com/windows-subsystem-for-linux-wsl-threats/