Unidentified Scanning Activity, (Sat, Sep 7th)

Over the two weeks, my honeypot has captured a new scan. According for the URL targeted and some research, this might be used to identify Dahua[1] or HiSilicon[2] digital video recorder (DVR) product. So for I have only seen this activity against port 80 and the scans for this activity looks like this:

20190907-090937: data ‘GET ../../mnt/custom/ProductDefinition HTTPrnrn’
20190907-093912: data ‘GET ../../mnt/custom/ProductDefinition HTTPrnrn’
20190907-094441: data ‘GET ../../mnt/custom/ProductDefinition HTTPrnrn’
20190907-100443: data ‘GET ../../mnt/custom/ProductDefinition HTTPrnrn’
20190907-115225: data ‘GET ../../mnt/custom/ProductDefinition HTTPrnrn’
20190907-115630: data ‘GET ../../mnt/custom/ProductDefinition HTTPrnrn’
20190907-122646: data ‘GET ../../mnt/custom/ProductDefinition HTTPrnrn’

If you are seeing this kind of activity and are able to help identify the product targeted or confirm it is one of the 2 I listed, leave a comment on our page. I did find an exploit against HiSilicon DVR released last year searching for the same URL[3].


Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

(c) SANS Internet Storm Center. Creative Commons Attribution-Noncommercial 3.0 United States License.

Reposted from SANS. View original.

Posted in: SANS

Leave a Comment (0) ↓