• 1 Post
  • 25 Comments
Joined 2 years ago
cake
Cake day: June 15th, 2023

help-circle






  • Inside git’s internal plumbing folder, git holds a file with the branch name and all of the references (files and changes) for that branch.

    When you make a new branch git will update its internal plumbing checking to see if the new branch already exists, updates its references to the new branch if it doesn’t (all held internally in a case sensitive way). It will then make that new branch file, git has already checked that the case senitive name for the branch doesn’t exist internally, so it should be good to go.

    Part of its process is creating that internal branch file… But wait!

    Windows doesn’t have case sensitive naming so when it tries to make that new branch file it will overwrite the old one (since it shouldn’t exist by git’s own reference!) All of the files and references for it now get nuked.

    Now you’re at best back to wherever that originally named branch came from, at worse your .git folder is properly borked.













  • It’s been hacked, the light bulb is likely part of some botnet or under an attacker’s control directly. Which is why it’s sending that much data continuously. IoT/smart devices don’t send a lot of data in this sort of volume as most of the time they’re idle and maybe send a heartbeat or status update every once in a while to prove they’re alive.

    This is what is called an indicator of compromise or IoC, it’s some behavior or pattern that can be used to determine what is happening or who is the one doing the attacking.

    Likely OP would need to do some analysis to be able to get attribution unless it’s a very well known botnet actor in which case attribution is fairly straightforward.



  • You’d think, but then again they probably ripped some open source repo off Github that had more features than necessary. Then proceeded to not turn any of those off, hack in their own features that aren’t very optimized because the board has like 4 gigs of storage and who cares. Finally bake in some firmware blobs for other components that probably allow them to figure out what sports you play or what pets you have so they can sell that info so other companies can show you ads.

    Add all that together and you probably have a firmware image that’s like a gig.

    Due to the hacked in features, they probably need to release patches frequently or add new “features” nobody asked for. It probably also has a phone-home “feature” so it can automatically update itself because you obviously need the “Defunkifier” setting on your washer right now.

    It wouldn’t supprise me if it the amount of network traffic from something like a “smart” washer was a few gigs a day because it’s constantly looking for new updates or sending whatever other telemetry data it’s collected to the mothership.