BSides 2022 - David Manouchehri
Examines BSides 2022 - David Manouchehri and evaluates key implications for security practitioners.
Summary
## From Botnets to Home Routers
David Manouchehri, an independent researcher known for Chrome zero-days, connects the Miri IoT botnet to ISP modem insecurity. Miri spreads by scanning random IPv4 addresses on ports 22 and 23—a crude method that still works at scale.
## Command Injection on Modems
Manouchehri discloses local command injection on consumer modems that should never expose a shell to subscribers. While not remotely reachable by default, anyone on the LAN can execute operating-system commands through the flaw.
## A Cautionary Remediation Tale
After reporting, the ISP changed Telnet from port 23 to 23.23 and applied IPv4-only firewall rules blocking ports 22 and 23. Because IPv6 rules differed, the service became reachable over IPv4 as well—and Telnet ended up exposed to the internet on port 23, worsening the issue.
## Lessons
The talk underscores how rushed fixes create new exposures, why IPv6 parity matters in firewall policy, and how consumer CPE remains a soft target that enables botnets like Miri despite its unsophisticated propagation strategy.
Related talks
BSides Cayman·47 min
Hybrid Cloud · Application Development
Analyzes BSides 2022 - Timothy Dilbert and evaluates key implications for security practitioners.
BSides Cayman·17 min
Outlines BSides 2022 - John Watson and evaluates key implications for security practitioners.
BSides Cayman·40 min
Carlota Sage
Demonstrates BSides 2022 - Carlota Sage - $how Me the Money and evaluates key implications for security practitioners.