Hackers Hijack D-Link, Ubiquiti Devices To Resell Your Stolen Bandwidth (bleepingcomputer.com) 35
An anonymous reader quotes a report from BleepingComputer: A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners' consent.
Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. By installing the app on multiple systems, the attacker likely accumulated larger payouts. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. According to researchers, the attacker exploited known vulnerabilities in D-Link ShareCenter NAS (CVE-2024-3272 and CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), and SAP NetWeaver Visual Composer (CVE-2025-31324) to install the Pawns.app software.
Hikvision and Dahua DVR/NVR devices were also targeted, though the specific vulnerabilities exploited were not identified. In some cases, the report says the attackers configured SSH key authentication to maintain backup access to the compromised systems.
Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. By installing the app on multiple systems, the attacker likely accumulated larger payouts. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. According to researchers, the attacker exploited known vulnerabilities in D-Link ShareCenter NAS (CVE-2024-3272 and CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), and SAP NetWeaver Visual Composer (CVE-2025-31324) to install the Pawns.app software.
Hikvision and Dahua DVR/NVR devices were also targeted, though the specific vulnerabilities exploited were not identified. In some cases, the report says the attackers configured SSH key authentication to maintain backup access to the compromised systems.
pawn.app (Score:4, Funny)
Re: (Score:3)
I think the the author wanted to say you can install that thing on your own device and it is legimate, but the person installed it on other's devices which is not legitimate even when the app is.
Re: (Score:2, Informative)
It's for a fundamentally illegitimate act, because virtually no ISP allows you to resell part of your connection to others. The only potentially non-infringing use of such a tool is to permit you to use your own connection remotely. Even wilder, have you been to Pawns.app? It's all about surveys and shit, it says nothing about a connection sharing proxy on the front page, they're tricking people into installing their proxy! Once they install the app, which said nothing about that, it asks them if they want
Re: (Score:2)
I do agree... sharing your bandwidth (whatever it is) with an unknown party is a stupid move. Which I always wondered about with something like TOR... renting out processor time is sketchy enough... letting someone use my bandwidth (however that works... assume my machine compresses it, then sends it to whoever) makes me responsible for whatever non-TOR traffic they cause.
And, people should perhaps read ToS and EULA (yeah, right), and maybe do a little research before installing something like that... but,
Re: (Score:2)
I think by today most nodes run on dedicated servers and law enforcement knows about tor. Some nodes have a small webserver serving "Tor node, click here for explanation" and use reverse DNS making clear it is a tor exit, but law enforcement can also use the tor exit database to look up if it is worth to waste time on suing the exit operator or if they should rather try to catch the tor user by more promising means.
Re: (Score:2)
You're assuming a lot, and good luck analyzing traffic to find one person... the exit node that broadcasts anything besides 'Hi, I'm here' would be immediately suspect.
And, not entirely sure there is a 'database' that has yours and my IP just labelled with a bright sign saying "we did something and used TOR".
Re: (Score:3)
I think you got that the wrong way. The exit nodes mark themselves as "I am a exit node!" so law enforcement can determine that there is probably not much to find. And the list of eixt nodes (the IP your site sees, not the user's original ip) is public: https://metrics.torproject.org... [torproject.org]
There is no point in hiding where a tor exit is running, as it would be simple to determine. Set up a webserver, access it via tor and switch circuits. In a feasible time you will have collected most exit node IPs. Currently
Re: (Score:2)
ResiP apps are highly problematic. While the premise of having easy access to a nearly infinite number of residential IPs for super cheap is appealing for all sorts of reasons and may even have some legitimate uses such as for anti-circumvention campaigns that would route traffic from activists in democracy challenged environments through residential IP exit points thus mitigating the abuse penalty incurred by commercial or Tor gateways, abuse of ResiP systems is rife, likely dominant.
Servers used to see sc
Re: (Score:2)
Virtually all business connections do allow just that. You could be reselling transit, offering services to downstream customers etc, even a cafe that offers wifi to its customers is effectively reselling the service.
Re: (Score:2)
Virtually all business connections do allow just that. You could be reselling transit, offering services to downstream customers etc, even a cafe that offers wifi to its customers is effectively reselling the service.
Not really. You can sit outside McDs and use the wifi for free. You also can't order wifi service off the menu. It's not a for sell service. It's just a fringe benefit that anyone in proximity can use. It's of course meant for customers that some how still don't have a all you can eat cell plan in 2026 (seriously, $25 flat gets you all you can eat plan on Verizon through a reseller).
I would call this sharing your service. Not reselling. Big difference.
Re: wat (Score:2)
"seriously, $25 flat gets you all you can eat plan on Verizon through a reseller)."
Who? I pay Verizon 30/mo and only get like 10 GB, and that's a grandfathered plan.
Re: (Score:2)
My Verizon is $30 a month and have yet to find a bandwidth limit (Verizon Forward), it's 100megs down
Re: (Score:2)
That's an interesting service, I've never heard of that before, thanks.
Re: (Score:2)
It might just be a US thing, don't know where you are... but, you're welcome.
It's cellular, the modem/router only has two Ethernet ports, but there's no reason you couldn't slap a router behind it to run your Ethernet stuff (as long as you can get a cell phone signal, it should work).
Re: (Score:2)
The subject at hand is a survey site scam.
This is not targeted at corporations, it's aimed at end users.
End users' residential connections' use agreements generally don't permit resale.
Even when you can legally install a proxy and allow others to utilize your internet connection, the fact that you're doing it for profit changes the nature of the act. If you're getting a carrier grade connection with a service agreement beyond "you may pray to the telco* gods for assistance" then your agreement may or may no
Re: (Score:2)
It has been IP (Internet Protocol... unless you mean Individual Property) since the 'Net became a thing.
Can Facebook, Instagram, Twitter/X use the stuff you post for anything without asking you? Read the EULA and ToS completely... all of that data usage is covered in there... sure, you can opt out... by deleting your account.
There are so many more scams out there similar to this one, you'd have to read the mumbo-jumbo to know.
That's one reason I never tried the OpenWRT thing... aside from possibly not havi
Re: (Score:1)
In many countries they legally cannot forbid running a proxy service. They can limit your bandwidth or monthly traffic if you use too much, but also only when it is in your contract.
Re: (Score:2)
They can't expressly forbid it, but they can just knock your bandwidth down to like pre-Telnet levels... same as running a big high-hit webserver on your cheap internet... that additional traffic can trigger slowdowns.
So... you're in a place that forbids VPNs... you run a VPN so you can see outside your countries Internet... not that hard to find you. If IP traffic should be within the borders, anything going outside the border should be noticed. Not to mention, the VPN has a record of your IP address acc
Re: (Score:2, Flamebait)
Perhaps, but then there's. the misleading use of "earn money" and "their internet connections" that should read "get money" and "your internet connections", ignoring that "legitimate" should definitely be "illegitimate" and "bandwidth-sharing" should be "bandwidth-stealing", as already covered. This is standard lying to push a narrative.
Who hacked my modem :o (Score:4, Interesting)
Doesn't apply to me (Score:2)
Denial (Score:1)
Denial doesn't cause security.
If you knew networking you wouldn't need ubiquiti
Re: (Score:2)
Re: (Score:2)
Budget does not equal hardware. In the right areas, you can find hardware worth hundreds.
Even if it's an oldie but a goodie, does it have a firewall? If not, there may be a thing to either block certain ports that you don't use (or only allow the ports you use... depends on how it handles that).
We all probably have different needs for ports and networking... port forwarding and the built-in firewall can help with that.
Read the documentation, there should be a whole section about all that (and, if not, the
Re: (Score:2)
I have a firewall. One of the best out there in my opinion. With cisco switches and plenty of traffic separation.
Re: (Score:2)
You have a cell phone, right? Internet to your house from whatever service?
You already gave 'them' (whoever you signed contracts with... read the EULA and ToS fully) access to your data.
Not to mention, anything you send over the 'Net from within the US is scanned for keywords and potentially more before it goes out to the rest of the world.
Re: (Score:2)
Starting with your gold leaf toilet paper? What is the point of your message?
Unless you connect directly to the backbone, why should anyone care?
Doesn't apply to me either, and no one cares still.
Re: (Score:2)
The whole point isn't the app itself, it is that hackers can use a vulnerability in the AP to install this thing against the will of the owner/administrator. In computer terms, a vulnerability that would allow someone to install software on the computers without the computer owners knowledge or permission SHOULD be seen as a bad thing. The same vulnerability then could be used to steal information. Now, if your ROUTER were compromised, now everything going through it is now compromised.
Again, it's not
Re: (Score:2)
Install it on the modem/router itself? A very poor design, and a hard reset should get rid of it... and maybe do a 'check for updates' for the firmware.
Newsflash: hackers can use any exposed port or hardware for their own oddball happiness.
You can spend all week blocking everything except ports 80 & 443 & 3334 or whatever... and they can still get in. Reactive firewalls are what you may need. Can't install OperWRT or whatever on your router because increasingly the modem is also the router unless
Re:Doesn't apply to me (Score:5, Funny)
Doesn't apply to me either. I have Xfinity and nobody would want to share that.