Orbi WiFi 7 RBE973
Reply

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

TWHBW
Tutor

Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

I keep getting port scan attack notices (every 5-10 minutes for two days now) from Armor regarding two Google Nest Hubs we have. When I go to check the information in the app, the app says "something went wrong try again" and then crashes. Not helping obviously. I logged into the web portal and it gave a little more information, including that the scan was coming from 8.8.8.8.

Can anyone help me out here? Is this legit Google activity or something nefarious?
Message 1 of 28
Robell1981
Star

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Same thing on my logs as well.

 

Network Attack Blocked

Aug 20, 2021 10:56:05 AM

NETGEAR Armor A.I. has detected and blocked a scanning attack to Google Nest Hub smart display (Bathroom) from 8.8.8.8.

 

I have disallowed network access to the two home hubs for the time being since we are not sure if its bad or not.

 

Edit: I have over 100 of these in my logs over the past two days.

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 2 of 28
Robell1981
Star

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Wonder if this can be of any help.  Just got the below email from Netgear saying they "enhanced" Armor.  I wonder if its related.

 

Screenshot 2021-08-20 133204.jpg 

 

 

Seems like the forum doesn't like the image.  Here is a copy paste of the added protection.

 


Here is what has been added for your protection:

DoS and DDoS Protection:
Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) are organized attacks directed at a device on your network and are now blocked without any disruption to you or your network.

Sensitive Data Protection:
Your private data is protected. NETGEAR Armor blocks requests from non-encrypted connections to keep banking and other personally identifiable information secure.

Exploit Prevention:
NETGEAR Armor maintains a best-in-class, centralized list of vulnerabilities and exploits, then scans your devices for known threats.

Anomaly Detection:
Machine learning identifies baseline traffic flows on a variety of networks. Should an anomaly, like a sudden traffic spike, occur on any network device, the router will block the suspicious traffic to the device.

Brute Force Protection:
A brute force attack describes how hackers try all possible combinations to guess your device's login credentials.

Message 3 of 28
RemyLeBeau
Initiate

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

I'm getting the exact same thing, since yesterday on my Google Nest Home Hubs and my Orbi RBR850
Message 4 of 28
Robell1981
Star

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

You have no idea how relieved I am that others are experiencing this.  I changed everything once I started getting these alerts, because I seriously thought something had gotten inside.  Hopefully Netgear or Google resolves it soon, I am almost confident it is releated to the changes that Netgear made to the armor service or maybe Google has been doing it forever to check if their devices have been compromised and the changes to Netgear's Armor just exposed it, not sure thought, and we won't know until Netgear comments on one of these threads.  

Message 5 of 28
TWHBW
Tutor

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Scared the crap out of me too, I hope it's resolved soon.
Message 6 of 28
TWHBW
Tutor

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Got the same email. It has to be related to the issues we are all experiencing now. These alerts are non stop.
Message 7 of 28
Robell1981
Star

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Yeah, I don't really need those two hubs on at the moment so I turned their access to the network off and the alerts stopped.  I'll leave them off for a while, but I know when I turn them back on it will start alerting like crazy.

Message 8 of 28
scamp23
Aspirant

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

I don't have a solution to this, but wanted to add that I have been inundated with similar 'attacks' on a lot of my hubs (specifically Google Hubs, not Google Hub Maxs, Minis, or Homes). It is always from 8.8.8.8. and will do it in spurts, then won't do it for a few days.

 

I hope this gets resolved soon. I have been very concerned that my network was potentially compromised, but it looks like it's maybe just an issue with Google / Armor. Also, the Armor portion of the Orbi app has become next-to-worthless... it doesn't show any information, my security score hasn't been updated in months, etc.

 

For a premium subscription / protection, I expect more.

Message 9 of 28
Stompy_NG
Aspirant

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

My best guess is this is down to some Google firmware update possibly. I read recently they're going to start silently pushing out the Fuschia OS to the first generation hubs (without built in sleep tracking).

How to know if your Nest Hub has updated to Fuchsia OS - 9to5Google

 

However I am going allow NetGear Armor to keep blocking these scans until it's confirmed 100%.

Message 10 of 28
baptistevod
Guide

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Happy to read I'm not the only one who experiences this (since today). Besides the multiple notifications, what bothers me the most is that Netgear Armor doesn't show a lot of information regarding the 'threat' on its platform:

91A40FB5-D0E4-4F6B-B534-74C2909A4608.jpeg

 
Any chance this gets resolved quickly? 

In the meantime, is there any possibility to instruct Armor not to scan the (old) Google Nest Hub? 

Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 11 of 28
Tardigrade123
Aspirant

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

The same problem here, today i started getting messages that Nest Hub is getting port scanned from ip 8.8.8.8. But thats just google right ?

Message 12 of 28
Robell1981
Star

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Yeah 8.8.8.8 is one of google's DNS servers.  Which makes the message all the more confusing.  I am still getting the alerts if I allow the devices back on to the network.  Not sure who's issue it was, but with Netgear being so silent on it, not sure if it will ever get resolved or if we will ever figure out what the hell it is.

Message 13 of 28
PetrusB
Aspirant

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

I have the older Goole Smart display and the Nest Hub. Both are getting blocked for a port scanning attack. Does anyone have more insights here thus far?

Message 14 of 28
Robell1981
Star

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Nope I haven't heard anything yet.  It's quite annoying and kind of disturbing because I am still not sure what is going on.

Message 15 of 28
baptistevod
Guide

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

I've informed Netgear about the issue last week. 
In a follow-up e-mail today they informed me they are working on it. 



 

Message 16 of 28
kc6108
Luminary

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

My Nighthawk app has been blowing up with these notifications as well. As irritating as they are, I hope Netgear and Bitdefender don’t whitelist this type of activity by my Google Home Hubs if it’s truly nefarious/suspect. I don’t mind being riddled with legitimate attack notifications.
Model: RAX120|Nighthawk AX12 12-Stream WiFi Router
Message 17 of 28
Traffic75
Aspirant

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

I am having the google scanning attacks as well as the external Circle device that I purchased.  I am gettting notifications every few minutes.  How do I resolve this?

Model: RBR20|Orbi AC2200 Tri-band WiFi Router
Message 18 of 28
Filmer
Aspirant

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Hello,
I ran in to this same issue as well. I'm not sure if this is the actual problem, but I had one of my google hub displays set to show a picture slide show. I changed that setting to only show the clock. I haven't gotten any other blocked attacks from that display, it's been about 4 hours. We will see if that's actually resolves the issue (a software fix is still needed)
Model: RBR50|Orbi AC3000 Tri-band WiFi Router
Message 19 of 28
Aragorn78
Aspirant

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

So, I did a Google search on this issue and typically when there is a security vulnerability on such a mainstream device (that is still being sold today) you would think there would be numerous mentions on the Internet. Guess what? It only shows up (would you believe it?!) ONLY in the context of the Netgear/Armor and Google Nest Home. Yeah, mine have been blowing up lately, too. And.... shock of shocks... it happens to be blowing up days prior to my "free" trial period of the Armor security ends.

 

Hmmmm....

 

1) No mention elsewhere on the internet about this, beyond Netgear space. Hmmm!

 

2) I even called Google priority support, which I pay for (Google 1) and the senior tech said they have had NO reports of similar issues with Google Nest Home. DOUBLE Hmmm!!

 

3) It "just so happens" that my free Armor protection period is coming to an end. TRIPLE Hmmm!!!

 

Sounds REALLY FISHY, folks! Netgear is better than this type of baseless manipulation.

 

BTW, I am heavy involved in tech professionally. For a LONG time (45 years). This has all the marks of a FAKE. Been there DONE that.

 

Netgear.... CAUGHT YA! BUSTED!!!

 

Will be looking to your competitor's devices in the future if you DARE continue stooping to such unethical, deceptive levels!

 

 

Model: RAX120|Nighthawk AX12 12-Stream WiFi Router
Message 20 of 28
FURRYe38
Guru

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Any progress on this? 


@baptistevod wrote:

I've informed Netgear about the issue last week. 
In a follow-up e-mail today they informed me they are working on it. 



 


 

Message 21 of 28
baptistevod
Guide

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

Yes, every 2 to 3 days Netgear sends me an email to inform me they’re working on it.

Each time I hope it’s to tell me the compatibility issue with google has been solved (not!) but at least they haven’t closed the issue.

The more time passes, the more I’m convinced this issue is a mutual problem between Google and Bitdefender/Netgear.

Google recently decided to change the OS of Google’s Hubs. All Huns (1st gen) would be updated without users notifying it (no visible changes).

Ha img this said, I believe bitdefender is experiencing issues with this charge of OS
Message 22 of 28
ags7798
Aspirant

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

I placed my phone, connected to the Google hub, next to the hub during a scan and probes actually got to and were detected by netgear on the phone... now I'm thinking it is a legit vulnerability and am wondering if this is really netgears fault... I'll see if I can run wireshark to grab any info on the scans
Message 23 of 28
SilkyS
Guide

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

I'm still having the same issue. Hopefully somebody can figure it out. I'm not going to unblock it until I realize it's okay.
Message 24 of 28
SilkyS
Guide

Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

I also wanted to add that my issue actually seemed to start after I paid for the armor service not before.
Message 25 of 28
Top Contributors
Discussion stats
  • 27 replies
  • 11949 views
  • 16 kudos
  • 15 in conversation
Announcements

Orbi WiFi 7