On: Ask HN: Was I pwned? [resolved]

[cyberpunk]

I mean. Yes, you're pwned. You need to reflash all possible firmware, dd your disks to zeros and start again.. I wouldn't even trust it then, personally.

What's the IP address it was talking to? Maybe we can help find out what it was?

[redleader55 → cyberpunk]

If you are to go this far, don't stop at dd-ing disks to zero. Replace the SSD controller firmware as well + BIOS + all firmware everywhere.

[FeistySkink → redleader55]

Why stop at the firmware? Shred the hardware altogether. /s

[Wistar → FeistySkink]

… and bury it at least 8 feet deep on land no closer than a mile from your residence.

[wpasc → Wistar]

seems to be careless not to burn current residence to the ground as well

[quickthrower2 → wpasc]

Then salt the earth

[guerrilla → Wistar]

I think 6 feet should be enough in most cases, if you're short on time or energy.

[bitwize → Wistar]

Turn off your computer and make sure it powers down,

Drop it in a 35-foot hole in the ground,

Cover it completely, rocks and boulders should be fine...

[FeistySkink → bitwize]

Pretty sure you could still recover the flash-based memory. Unless you're dropping into acid or lava.

[wasipwned → cyberpunk]

Yeah. That's definitely the plan, but I want to see if there's anything I can learn from the machine before I even do so.

The IP address was 107.122.31.71.

[cyberpunk → wasipwned]

It looks like a consumer IP address (AT&T US); ungood. Either your attacker is unsophisticated and they actually had that IP, or they're bouncing through a pwned machine.

Kill it. Kill it with fire.

[ehPReth → wasipwned]

one open port it seems: https://www.shodan.io/host/107.122.31.71

[KomoD → wasipwned]

Well, I've dug around, there's no hostname associated with it or pointing to it.

There's no obvious connections to any orgs or sites, and no entries in virustotal or abuseipdb, however there is an open port 179 (looks like BGP??).

[Atlas22 → KomoD]

Its a carrier grade NAT IP for ATT's cellular service, the BGP is likely just the ATT router.

[wasipwned → Atlas22]

Yeah, I'm now realizing that this might be multicast traffic I'm seeing from another device, and I do use AT&T which is making me think this may not actually be malicious.

[wasipwned → Atlas22]

Out of curiosity, how do you know it's CGNAT? Is it just because all of AT&T's mobile traffic is through CGNAT?