Insights on using a Cloud Telescope to observe internet-wide botnet propagation activity

The talk opens with internet background radiation, the unsolicited traffic that reaches any publicly addressed host, and explains how traditional network telescopes are passive sensors usually run by universities. The presenters' alternative is a Cloud Telescope: a Terraform-defined fleet of small virtual machines spread across AWS regions, opened to all inbound traffic and recording packet captures. Spot pricing keeps the fleet cheap and ephemeral.

The middle section covers a 45-day capture in 2023 across 26 regions, with ten sensors each. Most unsolicited traffic was TCP, and Telnet was the most targeted port, which the speaker linked to low-cost IoT devices. Some services answered attacker sessions so the team could record commands run after infection. Captured payloads pointed to Mirai and its variants, typically 32-bit embedded Linux binaries, and the most exploited weakness was an old CCTV device flaw. Source concentration in certain hosting and anonymization networks was noted, with the speaker's explanation presented as a guess.

The takeaway is that IoT devices currently face the heaviest exploitation in this traffic. The packet captures have been published so others can study them. Whether the activity has a geopolitical motive remains open, and the presenters invited collaboration on that question.