Hacked DVR's

[whatchel1]

Well a new place that hackers are hitting. In the article it shows a Dish net OTA DTV Pal. I just says cable so don't know which type DVR really it is talking about. http://www.techhive.com/article/2013790/dvrs-are-being-targeted-by-hackers-says-security-expert.html#tk.nl_today

 

[whatchel1]

I just wonder how easily hack the Dish VIP & hoppers are to hack. I know they are Linux so I would think they would be reasonable safe.

 

[mike123abc]

Well as the article mentioned it is not something that TV box designers consider. The advantage to hackers is that the DVR is connected to an internal network, so they can use it to attack from within. But, I wonder how they get the hack on to the DVR to start with? Not many will surf the internet.

 

[Hall]

I just wonder how easily hack the Dish VIP & hoppers are to hack. I know they are Linux so I would think they would be reasonable safe.

Don't be so foolish to think the Linux is more "secure" than other operating systems out there. Linux will always have many, many security flaws and bugs. Why would a "hacker" target or put a lot of effort towards Linux though when such a small number of machines are out there (in comparison to Windows machines) ?

Well as the article mentioned it is not something that TV box designers consider. The advantage to hackers is that the DVR is connected to an internal network, so they can use it to attack from within. But, I wonder how they get the hack on to the DVR to start with? Not many will surf the internet.

Surfing the internet and having internet access are two different things. You, like myself, have Dish and I presume your boxes are connected to the internet (mine are). If they are and there's an unpatched exploit, hackers can find it and access it.

 

[whatchel1]

Don't be so foolish to think the Linux is more "secure" than other operating systems out there. Linux will always have many, many security flaws and bugs. Why would a "hacker" target or put a lot of effort towards Linux though when such a small number of machines are out there (in comparison to Windows machines) ?

Surfing the internet and having internet access are two different things. You, like myself, have Dish and I presume your boxes are connected to the internet (mine are). If they are and there's an unpatched exploit, hackers can find it and access it.

I agree w/ you on Linux as well as OSX. I had a guy today trying to tell how little Mac & Linux doesn't really need anti-virus s/w because that are built on Unix. I told him he was full of it. He went on forever about this and that. Then he finally said he got out of HS 10 yrs ago. That's when I gave up talking to him. I realized that he probably never even saw a computer before Win XP maybe 2K at the earliest so he has no history before. So since probably has never seen a Mac before OSX he really believes the crap is near perfect and talking to him is a waste of time. I've worked IT in TV stations and trust me all the OS's need A/V s/w. Talent and editors can get almost anything infected. Trust me have seen it happen.

 

[mike123abc]

DHCP probably protects most TV boxes.

 

[Hall]

DHCP probably protects most TV boxes.

No. Using that logic, 90% of home PCs would never get malware as they're DHCP as well.

 

[mike123abc]

No. Using that logic, 90% of home PCs would never get malware as they're DHCP as well.

But the computers are out browsing the web and doing downloads. They go to a bad (or corrupted legitimate site) and are tricked into downloading software or other exploit. Of course the hackers could get into your computer and then use that to set up operations in your DVR....

More like the DVR needs protection from computers on the same network, than they are being attacked from the internet at large.

 

[Hall]

No, if a machine is connected to the internet, it's potentially vulnerable. Internet access is a two-way street - you don't need a web browser, you don't need to download anything, you don't even need a user ! Look at websites that get hacked or database servers that have data stolen from them. There's no user surfing the web on those machines. Many virii, malware, etc are come looking for machines to attack and the user does nothing to initiate the infection.

 

[cave1376]

If someone is going to hack your dvr, what are they going to get? The programs you have recorded, past purchases, last channels watched? At most they will order a ton of ppv which will be charged to your account, which you can call and dispute the charges. It's not like the dvr has your S.S.#, d.o.b., cc# or other vital information on it.

 

[mike123abc]

No, if a machine is connected to the internet, it's potentially vulnerable. Internet access is a two-way street - you don't need a web browser, you don't need to download anything, you don't even need a user ! Look at websites that get hacked or database servers that have data stolen from them. There's no user surfing the web on those machines. Many virii, malware, etc are come looking for machines to attack and the user does nothing to initiate the infection.

You do not understand DHCP/PAT. With DHCP/PAT you have to have an outgoing port for incoming traffic to match to it - the computers on the internal network are assigned fake ip address like 192.168.1.xx, addresses that are private, not on the nternet. A computer sitting behind a router with DHCP cannot be contacted from the internet unless the computer initiates it or a port is opened on the router to that machine. Programs on the PC have to go out to the internet. If you computer has the address 192.168.1.2 the router rewrites the address as it goes through the router to a real internet address and then remember it so that when a packet comes back addressed to it, it knows to send the packet to 192.168.1.2.

In the case of web server and data base servers they are exposed directly to the internet, hence you can talk to them without human interaction.

If someone is going to hack your dvr, what are they going to get? The programs you have recorded, past purchases, last channels watched? At most they will order a ton of ppv which will be charged to your account, which you can call and dispute the charges. It's not like the dvr has your S.S.#, d.o.b., cc# or other vital information on it.

If they leverage the DVR hack they get unrestricted access to your internal network and any vulnerable PCs or other equipment is vulnerable. Sort of like an infected PC on your network attacking the other PCs on your network to try to infect them too.