I Vulnerability Scanned The Entire Internet And Accidentally Made A Botnet

[@dooorrr]

inb4 FBI on Marcus again

[@archersterling4044]

Surely a lot of people in blue will think what he did here was illegal hurr hurr you made my computer send a request Is not an ideal situation to be in

[@dooorrr]

@@archersterling4044 Well, in this particular example it was done in more of a white hat manner but I guess if they really wanted they could make up some convoluted reasoning how it was illegal because muh exploit abuse and such

[@sangeetguha51]

Lol

[@Jorn-sy6ho]

JA! Je hoopt dat de FBI meekijkt

[@UNcommonSenseAUS]

Bro too cool to just shodan

[@graemepennell]

News soon leaks "Kremlin printers suddenly start auto printing".....

[@PvtAnonymous]

well, that's why Runet was created, so that this doesn't happen.

[@w花b]

​@@PvtAnonymouswhat's that

[@PvtAnonymous]

@@w花b it's basically the "Great Firewall" Lite edition. A compilation of apps, services and websites that are supposed to create a sovereign Russian internet that doesn't rely on outside services. That even includes their own root certificates. Many government services or banks won't work outside of Russia even today. Or their access will be very limited (like streaming platforms). That also means, that outsiders can't really do as much anymore since CIDRs outside of Russia will be dropped by default.

[@Ephicx]

@@PvtAnonymous It also has the added "benefit" of russian government being able to decrypt any and all russian traffic using those certificates because they hold the keys. You know, for security reasons...

[@PvtAnonymous]

@@Ephicx yup, that's part of the problem. It goes both ways: they can also take control of domestic services and harvest all the data they need since they don't need to ask foreign companies anymore. It's both a blessing and a curse.

[@mad_mario_]

Hope ppl in charge will hear your call, thanks for your service brother ❤

[@DeviantOllam]

Wow, this certainly is a leg up on the old "change the text string displayed on the HP printer" attack ☺️

[@chilversc]

Ah, I do miss the number of times our college printers would declare themselves to be out of crayons or were having some form of existential crisis.

[@shivkokroo6180]

Link? Can't find a reference.

[@chilversc]

@@shivkokroo6180 used to be (back 2000/2001 at least) there was a utility to change the status display on HP printers, no authentication required.

[@bootha-qv4je]

​@@shivkokroo6180same question here, I wanna make my own printer says one fuckshit lmao

[@CherryKayla]

Holy shit its the guy!!!!

[@ehsnils]

Next up: "I accidentally messed up the entire internet using fake BGP requests"

[@alfonzo7822]

That's something I'm trying to learn more about. So many rabbit holes so little time!

[@warlordkeys]

you are a menace

[@crissuper20]

Im sure, one day, a random Networking guy at a telecom would do that

[@lotarion]

@@crissuper20 it has happened a couple times already, something tells me it can happen again

[@michaelm1]

My server has seen more than 50 recent attempts to connect to CUPS port. This is now being exploited. Anyone who has not secured their systems is probably compromised by now.

[@MalwareTechBlog]

So far I've only caught scanners in my honeypot, but I'm certain there is active exploitation happening. I'm not listed on Shodan, so I'm only seen attempts that scan the entire internet rather than targeting known CUPS servers.

[@D.von.N]

Linux got CUPS patched up very soon after this came out, people just must not ignore the prompts for updates. On my MS system I print via a cable, the printer sitting next to me. I know what it is called so printing only there. And since keyboards and mouses (mice?) Can also be hacked wirelessly, considering going back to a wired mouse. Keyboard already is. Wireless one behaved strangely on Excel from time to time.

[@kirill9064]

@@D.von.N You mean someone broadcasts signal, sends🪟+R, and sends malicious comand?

[@shaggy6249]

Can’t wait for the “I accidentally turned off the internet” video, keep up the good work Marcus!

[@gehirndoper]

If it cameyou would have to wait anyway, given no internet.

[@pidojaspdpaidipashdisao572]

I always knew that that bloody printer will be the end of me.

[@sravanmathangi]

😂😂

[@Google_Does_Evil_Now]

You're a very good teacher. Easy to follow what you're saying. Wonder why the default isn't setup tighter. 0.0.0.0 is full open door. Amazing.

[@patchshorts]

that just means it listens on all network interfaces, he also didn't accidentally make a botnet either

[@Griimnak]

I learned something today because I always thought 0.0.0.0 isn't much different from 127.0.0.1. I just never thought into it much

[@notmyrealname4340]

Bro did not learn his lesson the first time

[@MaddoeGgasvyw]

No he aint he went from white to grey hat 🤣🤣🤣🤣

[@Dygear]

Man, if I had a nickel for every time that happened to me ... I'd be flat broke.

[@NeonVisual]

"Accidently"

[@JimmyMatis-h9y]

came for this comment. 😊 thx for not disappointing!

[@JimmyMatis-h9y]

lol. my first thought as well.

[@wasefmahmud]

A legend like u should be getting millions of views

[@MaddoeGgasvyw]

Faxx he bet white hat

[@5nowChain5]

Hes getting mllions of hits for sure😂😂😂😂

[@MaddoeGgasvyw]

@@5nowChain5 no cap them botnets spread faster den hiv

[@patchshorts]

that is not what 0.0.0.0 means, it means a listen is happening on every ip of the host on that port, the listen mask isn't a firewall

[@m8_981]

yea but he said "if the port is forwarded through the firewall".

[@sablanex]

@@m8_981 which is the real problem here. If the server is behind a nat someone would have to explicitly add a rule to forward the packets to that ip and port. Unless they just plugged the server directly to the internet.

[@terraflops]

someone posted your video on mastodon -> first time watching this channel. really enjoyed your calm and easy to follow along explanation on the CUPS vulnerability.

[@GabrielSykes]

Just wait til you see his Wikipedia page.

[@behindYOUR6]

Open the door 、its FBI

[@MaddoeGgasvyw]

Lmaooo

[@gispry]

an informative video explained calmly with no background music and with a soothing voice. Great production, love your work

[@xCheddarB0b42x]

do not "scan the entire internet" kids unless you know, badged three letter indemnity

[@FreeLovingAmerican]

Ya... guy's a quack really. You don't accidentally install malware to create a botnet either lol.

[@panagiwthspetroulios2075]

@@FreeLovingAmerican you didn't really understand the video

[@javierarzon4853]

You are awesome Mr Marcus, have been looking at your videos for Manny years, and they are are absolutely awesome . My blessings to you 😊

[@dvast4942]

You're a good person, I would have made a lot of money but you aren't me, you'e a good person indeed

[@5nowChain5]

You just created your own Orbitial Ion Cannon. Expect a knock on the door...

[@Chris-cv1ll]

And that is why it was given a high rating…

[@stuffless]

Thank you for explaining every part of the process so clearly. It is thanks to people like you I develop an everdeepening interest in cyber security

[@impulsiveDecider]

Glad someone at my university notified my of that issue. I don't know if I would have heard about it another way.

[@brendanmcgullion9358]

Jail Bait meant something different when I was growing up.

[@MiroslavObrtel]

Thanks Marcus for reigniting my desire to explore and curiosity ♥ This is sick!

[@___aZa___]

4:23 320TB if my math is correct :D

[@elhnston6589]

"Accidentally" .. That's brave.

[@Sellbob]

Would love to see a video covering, how you contacted the respective parties and how someone like me could go about it.

[@einname9986]

That would be really interesting + It'd be interesting how the situation develops. Do the respective governments react? Do these systems stop being vulnerable after some time?

[@Sellbob]

​@@einname9986 Could not agree more!

[@Jimmy_Jones]

Probably just an email form on their websites

[@KG-id3hk]

I LOVE THESE VIDEOS!!! Please keep making more

[@Sam-y5o6j]

Wrote a high performance C++ scanner.. presumably because it's about three decades quicker than understanding massscan configuration.

[@MalwareTechBlog]

Probably 4

[@user2200-t5z]

Nice, U not only great at performing but also great at presenting your work.

[@MaddoeGgasvyw]

Oh he great at performing alright he gunna need to perform new speech for usa after this 😂😂😂😂

[@nanostar6138]

Wow, you better get a Nobel peace prize soon mate!

[@nathanpendergrast6917]

bros trying to go back to jail

[@MaddoeGgasvyw]

He cyber security genius

[@runed0s86]

​@@MaddoeGgasvywNah, anyone can learn this stuff being ignorant doesn't make everyone else a genius.

[@ExperimentalKana]

wait he was in jail?

[@MaddoeGgasvyw]

@@ExperimentalKana he was almost in jail he almost got 10 years back n 2017

[@MaddoeGgasvyw]

@@runed0s86 tbh ill say this hacking u kinda have to be genius not easy hack

[@matinmrv4213]

Wow. Learnt alot. Thank you Marcus.

[@Shenepoy]

your ISP in knocking on the door for espionage concerns 🤣🤣

[@ellehooq]

Thanks for such high quality content.

[@bliskenx7239]

Great video mate. Legend!

[@sim00ps]

That amplification is incredible. Nice job chief

[@BryanEnsign]

This needs more views. Great work. The world is in trouble 🤦‍♂️

[@evilmortyofficial]

NSA field day

[@budgetarms]

Isn't this the guy that stopped one of the most infamous virusses of all time, ...

[@zhornz]

as an c2 owner (botnet but more powerfull). whould say this is not "accidental"

[@stevenstark-com]

it seems to me that you likely just stumbled onto an existing botnet

[@DaneSchell]

Bro just gave the government back door access to those systems (if they didn't already have it) lol

[@exodeus7959]

I would bet you they already know. He just stumbled onto this thinking it is some unknown exploit. Meanwhile our government’s probably have been using this exploit on their own citizens for years.

[@ilyasessar7267]

🤣🤣🤣

[@tonycarter8440]

Great breakdown Marcus! Now do ipv6 :-)

[@anonuser2640]

10/10 video I watched it without skipping a second

[@computerpastiche]

amazing video and discovery! you're a natural for deftly presenting complex ideas in a digestible manner; this is endlessly interesting, thanks for sharing :·)

[@Synflood-dot-txt]

Love your videos dude, thanks!

[@rogerkell4964]

As a hearing impaired user, this was a really fun video to attempt to listen to.

[@bdm1019]

There are captions but you need to turn them on.

[@ryanpaaz]

Marcus, any thoughts on the frustration of the vulnerability disclosure process and how responsible disclosure was dismissed the the researcher had to prove their technical prowess? It looked like a no-win. From the story I heard he told the Devs and they dismissed it as something that wasn't a concern to them and had a less than productive discourse. Researcher posts results and a proof of concept and the Dev's are all bent out of shape that this happened. It didn't appear there was much way for the researcher to win, except let 'security through obscurity' reign.

[@tagKnife]

Wait... This wouldnt happen to be the 3.8Tbps "ddos" cloudflare detected?

[@brandonb5394]

student here: so does this mean that this vulnerability for network-printer discovery gave access to these peoples networks or no? If so could someone explain how so.

[@NiklasTerhorst]

"Obviously i not do this" Not sure how many ppl will create a botnet with some chatgpt knowledge just from your video about the cups exploit

[@FragileMaleEggo]

Was IPv4 or IPv6 blast

[@guilherme5094]

Marcus's lawyer now: 👀! I feel a slight tingling in my arm.

[@OGB2]

"Hey guys look what I figured out how to do! Pretty cool huh? Guys?..."

[@NotSure416]

You should have posted notice to these systems by sending a message to their printer.

[@nagi603]

A subset could be some distributed/microservice pdf/etc printers that were open to all instead of just the service/users they are supposed to provide capability for. Like an open bucket. e.g.: "hey, we need to have our xls export also output pdf, and I don't where to start, so I spun up a pdf printer docker and as networking is also not my cup of tea, opened the firewall. Task done, next ticket please!"

[@starnumber_alt]

Now you gotta destroy another ransomware

[@lfcbpro]

Total noob here, but why would the systems have this port open in the first place? Is it for network printing or something along those lines? I wouldn't even know how to contact all of the authorities you had to, that is going above and beyond, well done sir.

[@jacobcourtney5778]

Yeah FBI, he is at it again

[@shadowlord0162]

is it already time to create the blackwall?

[@sunsaktayho]

so unfortunate to know you just have 100k subscriber while I just came to know you as a WannaCry Hero.

[@ocsanik502]

Why are people not firewalling the cups port?!

[@flavio6179]

Good video Marcus , thanks for sharing

[@kevinnyawakira4600]

I want to be like you when i grow up. I like how you do amazing things accidently😂

[@0xphk]

Still searching for the printer to finally pickup my printouts :D well done

[@obtFusi]

Which ISP allows so many connections from one source?

[@ilex8015]

Dude just accidently showed anyone how to ddos

[@RandoWisLuL]

id love to set up 2 servers on different network connections and see what the 30,000+ servers would do to a setup.

[@GoldenOni.]

You Are my Hero!

[@ThisisFerrariKhan]

Bro must like them awkward conversations with the alphabets boys 🤣

[@polymathx_]

bro is building his own case file edit : his

[@cracisn]

yoo arnt u that geezer who stopped that one ransomware or smng

[@_GhostMiner]

*4:34** Rookie mistake of not using a real language.*

[@RobertElliotPahel-Short]

Love your content, commenting for more

[@Hexachroma]

This might be the reason behind IA DDOS attack :(

[@blackmennewstyle]

The map with all the potential victims is definitely quite worrisome... Definitely something other malicious actors have definitely taken advantage of...

[@MrPyro91]

FBI warrant round 2

[@SY1Mella]

Mad how much of a ballache it is to connect to my OWN printer sometimes

[@morgan_bowe]

Was that cloudflare mitigating your botnet last week? PC Per podcast said it was something like 8 gigabits per second.

[@hew34]

I thought binding to 0.0.0.0 didn’t mean any address could connect but any local IP could service that port.

[@yzz__]

i’m just commenting to annoy the guy who got pissed at me for saying first

[@2fated]

First

[@kkuriboh]

easiest botnet tutorial I've found, thanks for the information. now I must collect my billion dollars from the russian gobberment.

[@scrapycholo2659]

When will you make skynet?

[@Lebensgott]

thanks for that informative video. i really have to check if anything is port forwarded, which shouldnt be forwarded... ^^

[@defeatSpace]

Oh god I see myself on the map

[@bluemajestic9580]

Dam Africa is pretty secure

[@hashfors]

Yeah it’s ridiculous how good at network security these ppl are..

[@potatocrispychip]

Did he just abuse a CVE 9.9 bug that was technically safe outside the local network?

[@BFG_10G]

Don't let the FBI see this video.😆

[@chrisridings9544]

It's interesting. But I think there's a problem that another title for this video could be "How to DDoS without a botnet".

[@janfkarel92]

I’m not tech wavy how Di I check my own printer or wifi iv this vulnerability is patch able ?

[@cli]

if you don’t have more or less a newer “dumb” printer and not a complex configuration on it and just have a regular one then you are _probably_ going to be fine, CUPS requires a more or less custom setup

[@janfkarel92]

@@cli ah thanks

[@mrhassell]

Making the Case for Elixir, in the least practical way.

[@SNSISNSJISEJSJS]

Does anyone know where can i find that ui that worked in the browser I saw it was soo cool Does anyone have idea or i fo where can i get that dashboard glob very cool ui ? I searched a while but didn't find anything yet ..

[@SimonZerafa]

Oh No! Not again?! 😉🤷‍♂️

[@LordOdin]

Pretty decent video other than the python statement being complete bullshit. I’ve made many pythons web servers that are capable of over 10GB/s on a single thread.

[@MalwareTechBlog]

It's basic common sense that the less time spent per system call, the higher the throughput. I don't necessarily doubt that someone could create a 10gb/s web server in Python, but based on your response to the discussion at hand, I do doubt that you could.

[@LordOdin]

🤷‍♂️ I’ll take that as a complement I guess I wasn’t saying that python isn’t slow. I was saying that it’s not a bad tool for this specific task. You said your self it took 40 minutes for the c code to run.. 1.8 million requests per second is 100% achievable with python if you are halfway decent at python. At least on the hardware you mentioned. We can make this a bit more constructive instead of an argument, I’ll write some code to do it when I get back from my trip to Europe.

[@MalwareTechBlog]

It's nothing about "being decent with python" it's an interpreted language, there is a massive overhead with each call. It's not going to even come close to C in terms of requests per second given identical hardware. If the hardware is maxing out at 1.8 million RPS, how are you going to increase that by adding more CPU cycles?

[@LordOdin]

@@MalwareTechBlog it is possible to write bad c code… Language is irrelevant if you write a pile of unoptimized slop. Good logic is more important than the speed of the language most of the time, especially in networking. The metrics you mention are fairly within reach from python based on my past experience. You are only doing 37,500 requests per second per thread on that system. If you are correct you would let me write the code and prove my self wrong.

[@MalwareTechBlog]

You're free to prove yourself as wrong as you want. I already know my C code will be faster.

[@nsacyber]

Ah, so it was YOU. FBI will be there shortly. ;)

[@BruxoCp13]

A laughed my arse off all the way through this lol

[@Interminableable]

Hi Marcus, love your content and your in-depth explanations. Your description how the binding IP address varies stuff is somewhat inaccurate/misleading. Was this deliberate comment bait for network nerds?

[@farhanrejwan]

thanks for your comment, it really helps the channel grow.

[@Google_Does_Evil_Now]

It looked accurate to me, but I'm just average user. What did you see inaccurate about it? 0.0.0.0 means no restrictions on the IP. Is that not right?