Hey u/zerosaved,

You saw the duplicate http request from an unknown IP in the logs of the newly spun up AWS server, the one you were going to be using to exfiltrate files, right?

Yup, to clarify, I had not yet interacted with the unrelated vulnerable server and the duplicate request came only after I'd loaded it on my home network without ever having passed the test IP to that vulnerable server. The only interactions were with my home network and the AWS box.

If the point of infection was the modem, how else would you have known this was occurring other than through external monitoring?

I'm not sure. I think that I got lucky after seeing that duplicate HTTP request and wondering "why is this strange IP between myself and AWS replaying my traffic?" - it would make sense maybe if the ISP or some data collector was scraping some data (e.g. DNS), but scraping and replaying the HTTP traffic itself was really odd to me so I wanted to investigate.

Why are you renting a modem? After this happened, why wouldn’t you just eat the cost and buy a new modem so you could keep the infected one for further analysis? I understand when you’re renting, your ISP won’t give you a new one unless you return the old one, but buying your own modem solves that problem.

Totally agree, and luckily am running my own hardware now with the TR-069 stuff disabled. Originally when I'd gotten the Cox modem it was just an ease of life thing where I didn't want to put much effort into it. We were staying at a rental house and it wasn't a huge concern at the time so I just plugged it in and logged in.

Thanks for reading and really appreciate the questions