Botnet Attack on BSNL Broadband network

[Kick933]

It have led to exhaustion of data fair usage policy limit and many fiber use are getting reduced speed. We should get together and get our compensation.

 

[NikhilS]

Yes. @Kick933 let’s start a campaign.

 

[Dark_Nate]

Strangely I'm not affected by this FUP issue. I guess it's because I'm using a TP-Link ONT, which I bought myself. Whatever vulnerabilities existed on Syrotech/Netlink/Whatever-Crap-brand OLTs/ONTs do not exist on TP-Link's ONTs.

 

[vignesh_venkatesan]

Just to clarify, did people having these indian rebranded ont's on bridge mode got affected ?

 

[vishalrao]

@vignesh_venkatesan i use my optilink ont in bridge mode with my own Netgear router but for past 15 days i am using the ont directly and am not affected by this fup issue for now.

 

[vishalrao]

but i have done those simple hardening steps (block telnet/http incoming, set firewall etc) so maybe that is helping.

 

[airforce]

@vignesh_venkatesan no bro,we found only who are using bsnl dns are affected in our network. chinese rebranded modem with 8.8.8.8 or cloudflare dns didn't get affected.

 

[varkey]

I'm curious to know what really happened. Was malicious code inserted into the ONT? Is that why the data usage went up? If so can something running on that ONT hardware generate so much of data? Also, has anyone actually got into an affected ONT over SSH or something and checked what was happening?

 

[airforce]

@varkey,users who where complaining slow speed, we found they have exhausted data usage mostly uploads. DNS also chaged to 89...*ips. only if they know our public IP they can log and brute force and gain access to modem.

 

[airforce]

We believe botnet got working ip from DNS queries.