Open by default: the hidden cost of convenience in network security

This is a reserve paper. Should it not be required to replace a paper on the main programme, it will be presented in the Small Talks room on Friday 4 October.

Aurelio Picon (Cujo AI)

This presentation will discuss the almost obvious realization I had after a year of reviewing anonymized network security event logs for more than two billion devices spread across North America and Europe, tracking malware, trending TTPs, IOT software updates, targeted devices, botnet compositions and behaviours, etc. Ultimately, the only reason the majority of current botnet spreading and behaviour is happening is because the household routers have auto port forwarding enabled by default.

In this talk, I will share some of the statistical data I gathered during my day-to-day threat research, most commonly targeted device types, ports used, techniques, and scenarios in which a device gets compromised and later used as part of the threat actor infrastructure. Then I will look at what I believe is one of the core problems in current household network security: "auto port forwarding". We dig down a bit into the UPNP protocol and coming replacements, but still the same problem persists. I will propose solutions and alternatives and call for manufacturers to stop the auto port forwarding being enabled by default.

Aurelio Picon With over a decade of experience in the IT security sector, Aurelio has navigated through a myriad of roles, from network risk analyst to becoming part of an elite threat hunter team at one of the top fusion centres for a globally renowned consumer bank. Currently serving as a senior threat researcher at Cujo AI, he plays a crucial role in advancing network security solutions for households across the globe. This journey from corporate to consumer-end security is guided by the insight that homes often serve as unintended harbours for cyber threats. Committed to protecting both corporate networks and the personal digital spaces of consumers, Aurelio's efforts underscore a dedication to improving cybersecurity as a whole.

Back to VB2024 Programme page

Back to VB2024 conference page

Register for VB2024

Other VB2024 papers