CSIPE

Published

- 18 min read

An Old Network Box Can Lend Out Your Internet Address

Home Network Security Internet Privacy Smart Devices Online Safety

Books by the author

Compare all 5

As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.

A camera recorder sits in a cupboard for six years. It still records. The phone app still opens. Nobody remembers the last time its software was updated, and that quiet reliability feels like success.

On 15 October 2026, GreyNoise described a campaign that gives that old box a second job. Attackers had broken into at least 143 network devices in 34 countries and installed Pawns.app, a real service that pays account holders for sharing an internet connection. The device owners had not agreed to share anything. Traffic bought by other people could leave through the victim’s connection, wearing the victim’s public internet address on the way out.

The affected equipment in GreyNoise’s findings included D-Link storage boxes, Ubiquiti video recorders, and SAP business servers. The researchers also saw attempts against Hikvision and Dahua recorders. This was a small observed set, not evidence that every camera, storage box, or router is involved. It is still a useful household lesson because the attackers went after the machines we tend to stop seeing once they work.

You do not need to inspect every cable tonight. Start with one question: which box in your home or business can be reached from the internet but no longer receives security updates? That answer matters more than a frantic scan of every light bulb.

What happened on 15 October

GreyNoise began with an investigation inside an unnamed organisation. Its researchers found logins coming from residential internet addresses that looked ordinary for the users involved. A familiar town or country would usually make those sign-ins seem less suspicious. Several users, however, appeared through the same residential address, and further investigation confirmed a serious intrusion. GreyNoise withheld the victim’s details, so the public report does not tell us who was breached or what was taken.

That investigation led the company to a separate campaign against devices at the edge of networks. In its 15 October research report, GreyNoise said the attacker had successfully compromised at least 143 devices across 34 countries. The attacker installed Pawns.app and linked the installations to an account under the attacker’s control. In some cases, the attacker also placed a secure-shell key on the device, which created a backup route for returning later.

Pawns.app itself is a commercial bandwidth-sharing product. A willing customer installs it, allows other people’s traffic to use the connection, and receives a payment. GreyNoise was careful about that distinction: its report says the software binaries are not necessarily malicious when an owner chooses to install them. The crime is taking another person’s device and connection, enrolling both without consent, and collecting the money.

BleepingComputer independently reported the same campaign on 15 October after reviewing the GreyNoise findings. It confirmed the count, countries, device groups, and unauthorised Pawns.app installations. Both accounts describe the activity as proxyjacking, a compact technical word for turning somebody else’s internet connection into a rented route.

The number needs context. GreyNoise reported devices it could attribute to this campaign, not a census of every compromised device in the world. The researchers did not claim that all 143 belonged to households, and an SAP NetWeaver server plainly points to business use. They also did not publish a list of affected owners. If you have one of the named brands, the report is a reason to check the exact model and software, not proof that your box was entered.

The timing also matters. This campaign became public on 15 October 2026, but the weaknesses used against the named products were older. Two D-Link flaws date from 2024. The Ubiquiti route involved the widely known Log4Shell flaw from 2021. Attackers often prefer a door whose key is already documented, especially when the device behind it has been forgotten.

How a borrowed address changes what the internet sees

Your home has many private addresses inside it. A television, laptop, phone, camera, and storage box can all talk across the local network. When they reach the wider internet, the router usually presents one public address supplied by the internet provider. To a website, that address is the return label on the connection.

A residential proxy lets somebody elsewhere borrow that return label. Their request travels to a participating device in a home or small office, then leaves for the destination from that local connection. The destination sees the household’s public address rather than the original user’s address. This has honest uses, including checking how a website appears in another region. It also gives fraudsters an address that looks more like a normal customer than a rented server in a data centre.

Imagine that a stranger pays a delivery driver to collect parcels from your porch. The sender sees your house as the collection point even though you chose none of the parcels and receive none of their contents. Your home has become a useful middle stop. On the internet, the borrowed item is the public address and the route behind it.

This can hurt an owner without producing a dramatic movie scene. Proxy traffic may consume bandwidth or count against a metered allowance. Websites may begin challenging or blocking the address after seeing abusive requests from it. A bank or email service may decide that activity from the address looks suspicious. An investigator following a first lead may arrive at the connection used for the traffic, while the person who chose the target remains elsewhere.

The problem extends beyond this one campaign. In a March 2026 public warning about residential proxy networks, the FBI described criminals using them to hide activity tied to password attacks, fraud, phishing, and other offences. It also explained that proxy addresses can come from compromised devices or from applications whose users did not understand that their connection would be shared. The common feature is borrowed residential traffic, not one particular app or manufacturer.

The public address alone does not prove who performed an action. Internet providers can change addresses, households share connections, visitors use Wi-Fi, and proxy services deliberately put distance between an operator and a destination. Investigators know this and normally seek more evidence. Even so, explaining why somebody else’s traffic left through your connection is an inconvenience worth avoiding.

The more important danger is often the entry that came before the proxy. An attacker who installed software on a storage box or video recorder already gained meaningful control of that machine. GreyNoise observed backup access keys in some cases, which suggests that removing one application may leave the return route intact. The owner must ask what else the device could read, reach, or change while it was under somebody else’s control.

That question depends on where the box sits. A camera recorder may hold private footage. A network storage device may contain tax files, family photographs, or business backups. A server may have passwords or trusted routes to other systems. The stolen bandwidth is the visible business model, but the same foothold can expose whatever the device was allowed to touch.

Why the old box keeps winning

The products named by GreyNoise shared a practical weakness: they were reachable and running code with known security problems. The attacker used CVE-2024-3272 and CVE-2024-3273 against D-Link ShareCenter storage devices, CVE-2021-44228 against Ubiquiti UniFi Video recorders, and CVE-2025-31324 against SAP NetWeaver Visual Composer. The labels matter to administrators, but a household can read the pattern without memorising them.

The two D-Link flaws are a good example. One involved a built-in credential, and the other allowed commands to be passed to affected storage devices. CISA added both flaws to its Known Exploited Vulnerabilities catalogue in April 2024, which means the agency had evidence that attackers were using them. D-Link’s security notice for the affected ShareCenter models says the listed products had reached end of service and would receive no further security development.

That last sentence changes the sensible response. An update can repair a supported product. An unsupported box with a remotely useful flaw has no update waiting next Tuesday. Keeping it on the public internet turns hope into the maintenance plan.

Owners often miss this point because the device still performs its visible task. Hard drives spin. Cameras record. An app displays a picture. End of support does not make the power light turn red, and shops rarely send a clear replacement date years after purchase. The product can be functionally alive and security-dead at the same time.

Automatic updates help only while someone is producing them. A screen that says “up to date” may mean the device has installed the newest available release. It can also mean the newest available release is several years old and still contains a known weakness. Check the date of the release and the manufacturer’s support status, not only the comforting green tick.

Internet exposure supplies the other half of the problem. People sometimes enable remote viewing for cameras, remote file access for storage, or remote administration for a router and then forget the setting. A mobile app may depend on a vendor relay rather than a direct opening, so the app’s existence alone does not prove the device is publicly reachable. The useful check is the actual remote-access setting and the maker’s current explanation of how it works.

A device can also become reachable through a router feature called port forwarding. That feature sends incoming traffic on a chosen internet port to a particular box inside the home. It is like telling the receptionist that every caller asking for extension 8080 should be put straight through to the camera recorder. If nobody remembers creating the rule, the rule can outlive the reason.

Universal Plug and Play, usually shown as UPnP, can let devices request some of these routes automatically. It saves setup time for games and media devices. It can also leave an owner with less understanding of which openings exist. Turning UPnP off may break a game or app that relied on it, so make the change when you have time to test rather than five minutes before a family video call.

Passwords still matter, though changing only the Wi-Fi password misses the machines in this report. The campaign used software flaws against particular services. A strong password does not patch an exposed command-injection flaw, just as a good front-door key does not close an open basement window. Updates, support status, and exposure answer different questions from account security.

The calm home and small-business check

Begin with the equipment that handles traffic, storage, cameras, or remote access. Look near the router, under a desk, beside a television, and in the cupboard where the camera cables end. You are looking for routers, separate modems, network storage boxes, camera recorders, old smart-home hubs, and any small computer installed by a contractor. A printer is worth noting if it has its own network cable or Wi-Fi connection.

Write down the maker and exact model from the label. “D-Link box” is too broad because one company can sell supported products and retired products at the same time. The model may be called DNS-320L, UNVR, NVR, NAS, gateway, hub, or something equally unhelpful. Photographing the label is fine as long as you do not post the serial number or Wi-Fi password online.

Next, find the manufacturer’s support page by typing its known web address or using a careful search. Check three things: the latest software version, its release date, and whether the exact model is still supported. If the box offers an update through its own settings, install the update there rather than downloading a file from a forum or an advert. Save a screenshot or note of the version after the restart.

Look for remote administration, remote management, cloud access, port forwarding, and UPnP in the router and device settings. CISA’s home-network guidance recommends disabling remote management when it is not needed because that feature exposes the router’s settings over the internet. The same plain rule works for a storage box or recorder: if nobody needs to reach it while away from the building, turn that route off.

Do not remove remote access blindly from a shop’s alarm or a relative’s medical equipment. Find out who supports it, what service depends on it, and how to confirm that it still works after a change. A managed device should have a named person or company responsible for updates. If the installer cannot tell you the model, current version, and support date, that uncertainty belongs in the replacement decision.

Change the device’s administrator password if it is still a default, reused elsewhere, or known by a former installer or employee. Use a different long password for each device and keep it in a password manager. If the product offers two-factor authentication for its account, enable it. These steps reduce account entry, but they do not rescue unsupported software from a known remote flaw.

Check the router’s port-forwarding list. Every rule should have a present owner and a present reason. A rule labelled “camera,” “NAS,” or a string of numbers may be legitimate, but somebody should be able to explain it. Remove an obsolete rule, then test the service you expected to keep. Record what you changed so a future fault does not send somebody searching for a mystery.

Your router may also show connected devices. Names such as unknown, a maker’s name, or a string of letters are common and do not prove an intruder is present. Compare each entry with the equipment you own, switch an uncertain device off briefly if that is safe, and see whether the entry disappears. Avoid pressing “block” on life-safety, heating, or access-control equipment you have not identified.

The result should be a short table, not a weekend of anxiety: device, model, current version, support status, remote access, and owner. Five honest rows are more useful than a phone full of network-scanner screenshots nobody understands. The row marked “unsupported and remotely reachable” goes to the top.

If you find an unsupported or suspicious device

An unsupported box does not automatically mean an attacker is inside it. It means the manufacturer no longer promises repairs for newly found software problems. If the device is reachable from the internet or belongs to a product group with a known exploited flaw, replacement is usually the clean answer.

Disconnecting can come before diagnosis when the risk is immediate and the function is not essential. Unplug the network cable or disable that device’s Wi-Fi connection while leaving the hardware itself intact. A camera recorder may continue recording locally; a storage box will stop serving files. Know what you are interrupting, especially in a business.

A restart is a useful maintenance habit, but it is not a complete incident response. Some unwanted programs disappear from memory when a device restarts, while a known flaw remains available for the attacker to use again. GreyNoise also observed backup access keys in this campaign. A reboot can change what is running without explaining how entry occurred or removing every change left behind.

A factory reset has similar limits. It may remove settings and installed software, but it returns the device to the maker’s factory software, which can still be old and vulnerable. Resetting also erases logs that might help an administrator understand the event. On a supported device, a careful process is to preserve useful information, install a known-good current release, reset configuration, create new credentials, and restore only the settings you understand.

For an end-of-service storage box or recorder, replacing the hardware often takes less expertise than trying to prove an old installation clean. Back up necessary data without copying unknown programs or configuration files. Buy a currently supported replacement, update it before exposing remote features, and move the data. Keep the old box disconnected until you are sure the transfer worked, then erase or destroy its storage according to what it held.

If a device handled business records, customer footage, payment systems, or employee accounts, bring in the responsible IT provider before wiping it. Preserve the model, software version, router rules, login records, and the time you noticed the problem. A provider may need to check whether the box reached other systems, whether credentials were stored on it, and whether legal or contractual notifications apply.

Watch for ordinary after-effects. A home may see websites present more “prove you are human” checks, streaming services complain about location, or email providers question sign-ins. Those symptoms have many causes and do not prove proxyjacking. They become useful clues when they appear alongside an unsupported exposed device, unknown administrator access, unexplained traffic, or a GreyNoise result.

Contact the internet provider if the public address appears on blocklists or services keep rejecting it after the device has been removed. The provider may be able to issue a new address, but that should follow the repair. Changing the address first is like changing the number on the house while leaving the borrowed-parcel arrangement in place.

Do not install a random “proxy remover” advertised beside a search result. A web page cannot inspect the firmware of every recorder, router, and storage box in your cupboard. Use the manufacturer’s support route, the installer who owns the system, or a local technician who can name the exact device and show the work performed.

What deserves attention, and what can wait

The highest-priority combination is simple: old, unsupported, remotely reachable, and useful to the household or business. A storage box containing backups deserves attention because compromise could affect both privacy and recovery. A camera recorder deserves it because the device holds footage and often sits online for remote viewing. A router deserves it because every other connection passes through it.

A supported device with current software and no unnecessary internet-facing management route belongs lower down. Keep its unique administrator password, install updates, and review it when the maker announces a security issue. You do not need to replace working equipment merely because another model from the same brand appeared in a report.

A smart bulb on a separate guest network can usually wait behind the unsupported router controlling the whole house. So can the television that receives automatic updates and has no remote administration feature. The aim is to spend attention where control and exposure meet, not to turn every connected object into a crisis.

Network separation can reduce the damage if a camera or entertainment device is entered. Many routers offer a guest network or a separate setting for connected devices. Putting cameras and smart-home equipment away from laptops and work files can remove easy routes between them. This is helpful, though it does not make an unsupported public device safe to leave online or prevent its own connection from being abused.

Small businesses should assign each edge device to a person, not a drawer. The owner may be the office manager, an IT provider, or the installer, but the job must include checking updates and end-of-support dates. An invoice should say who maintains the recorder after installation. “The cameras still work” cannot be the whole test five years later.

Replacement dates are easier when written at purchase time. Keep the model, receipt, login location, support link, and expected support end in one ordinary record. Review that record once or twice a year. A calendar reminder costs less than discovering during an incident that the maker stopped updates in 2021.

The report also gives permission to ignore some noise. You do not need to learn the four vulnerability numbers. You do not need to identify every proxy company on the internet. You do not need to assume that slow Wi-Fi means criminals are renting your line. Find the forgotten box, learn whether it is supported, and close remote access you do not use.

The address is only the borrowed coat

Proxyjacking works because a residential internet address carries a small amount of borrowed trust. It looks like a home or ordinary office, so a login or web request may receive less suspicion than traffic from a known server farm. The attacker puts on that address like a coat. The websites being visited see the coat first.

GreyNoise’s original investigation shows why address-based confidence has limits. A login from the expected region can still deserve a second look when other details do not fit. For a household, the lesson runs in the opposite direction: traffic carrying your address may still belong to somebody you never invited. The address is evidence about a connection, not a signed statement about the person behind it.

The equipment at the edge of a network therefore needs a modest maintenance plan. It does not need daily attention. It needs a known model, current support, updates, a unique administrator password, and no unnecessary door from the internet. When support ends, retirement becomes part of ownership, even if the lights still blink.

The useful action from the 15 October 2026 report is wonderfully unglamorous. Look beside the router and where the camera cables end. Write down the exact model of the oldest box. Check whether its maker still fixes it. If the answer is no and the box can be reached from outside, disconnect or replace it with help appropriate to what it controls.

Then stop. You have checked the door that mattered instead of worrying about every device in the house.

For one calm, practical security note each month, the newsletter signup is on this site. One email per month, and no manufactured emergencies.

Sources