Someone is renting out your broadband and keeping the money

There is a category of software that pays you a few pounds a month to let strangers route their internet traffic through your home connection. Pawns.app is one of them, and it is entirely legal. The twist GreyNoise published on 15 October is that someone has been installing it on other people's hardware and pocketing the earnings.

The researchers tracked 143 compromised devices across 34 countries back to a single payout account registered to skynox7@proton.me. The way in is not clever, which is rather the point. D-Link ShareCenter network storage boxes fall to CVE-2024-3272 and CVE-2024-3273, both from 2024. Ubiquiti UniFi Video recorders fall to CVE-2021-44228, the Log4Shell bug that has been patched since December 2021. Hikvision and Dahua video recorders are in the mix too. These are devices nobody logs into for years at a time.

Being a proxy node is worse than the electricity bill suggests. Your home IP address starts carrying somebody else's traffic, which the FBI has warned is the infrastructure behind large-scale password-guessing attacks. Practically, that means you start getting blocked by websites, failing CAPTCHAs, or being asked awkward questions about activity you had nothing to do with. The attacker also left SSH keys behind on some devices, so a reboot does not help.

If you own a network drive or a camera recorder older than about five years, check whether the maker still ships firmware for it. Several of these models do not get updates at all any more, in which case the only real fix is to stop exposing them to the internet. Tendvane's network scan will at least tell you what is sitting on your network, which is usually the part people are vague about.