[SBE] Barix Exstreamer Vulnerability List

[Gibson Prichard]

Not FCC per se, but it's easily found online. See
https://www.shodan.io/search?query=barix for a sample.

If you use Barix, they should be behind a router/firewall with the HTTP
port redirected to a non-standard port other than 80, 443, 8080 or 8081.
The inbound audio should also be moved off port 4444 to another port and
the default passwords changed at the minimum. Some would recommend a
Point-to-Point VPN to remove the Barix from the public Internet and place
its streaming ports entirely behind a firewall and this is also a good idea.

A good rule of thumb is - change the settings to something non-standard and
lock down access to the extent you can (public static IP's help but are not
required). Leave nothing at the defaults.

Gibson Prichard
Nashville, TN
gibson at prichard.tv

On Mon, Feb 6, 2017 at 3:14 PM, John Roberts <jorobert at cameron.edu> wrote:

> Does anyone know if there exists an FCC provided list of “open Barix
> boxes”? I recently received an email from a previously unknown source that
> contained the IP address of one of our boxes that said it came from such a
> list. It was actually to an Instreamer that’s not subject to the issue and
> also password protected, but I’m curious if such a list actually exists or
> if the email I received may have been a phishing attempt. Thought perhaps
> someone else subscribed to this list might be able to provide some insight.
>
> v/r
> John Roberts, CBRE
> 580-512-2582 <(580)%20512-2582> (mobile)
>
> _______________________________________________
> The SBE Roundtable, SBE at sbe.org
> To unsubscribe, go to https://pairlist7.pair.net/mailman/options/sbe
>
> https://pairlist7.pair.net/mailman/listinfo/sbe
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist7.pair.net/pipermail/sbe/attachments/20170206/6eb38886/attachment.html>