Re: Armor Blocking Repetitive Port Scan Attacks on Google Nest Hub

TWHBW · ‎2021-08-20

I keep getting port scan attack notices (every 5-10 minutes for two days now) from Armor regarding two Google Nest Hubs we have. When I go to check the information in the app, the app says "something went wrong try again" and then crashes. Not helping obviously. I logged into the web portal and it gave a little more information, including that the scan was coming from 8.8.8.8.

Can anyone help me out here? Is this legit Google activity or something nefarious?

Robell1981 · ‎2021-08-20

Same thing on my logs as well.

Network Attack Blocked

Aug 20, 2021 10:56:05 AM

NETGEAR Armor A.I. has detected and blocked a scanning attack to Google Nest Hub smart display (Bathroom) from 8.8.8.8.

I have disallowed network access to the two home hubs for the time being since we are not sure if its bad or not.

Edit: I have over 100 of these in my logs over the past two days.

Robell1981 · ‎2021-08-20

Wonder if this can be of any help. Just got the below email from Netgear saying they "enhanced" Armor. I wonder if its related.

Seems like the forum doesn't like the image. Here is a copy paste of the added protection.

Here is what has been added for your protection:

DoS and DDoS Protection:
Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) are organized attacks directed at a device on your network and are now blocked without any disruption to you or your network.

Sensitive Data Protection:
Your private data is protected. NETGEAR Armor blocks requests from non-encrypted connections to keep banking and other personally identifiable information secure.

Exploit Prevention:
NETGEAR Armor maintains a best-in-class, centralized list of vulnerabilities and exploits, then scans your devices for known threats.

Anomaly Detection:
Machine learning identifies baseline traffic flows on a variety of networks. Should an anomaly, like a sudden traffic spike, occur on any network device, the router will block the suspicious traffic to the device.

Brute Force Protection:
A brute force attack describes how hackers try all possible combinations to guess your device's login credentials.

RemyLeBeau · ‎2021-08-20

I'm getting the exact same thing, since yesterday on my Google Nest Home Hubs and my Orbi RBR850

Robell1981 · ‎2021-08-20

You have no idea how relieved I am that others are experiencing this. I changed everything once I started getting these alerts, because I seriously thought something had gotten inside. Hopefully Netgear or Google resolves it soon, I am almost confident it is releated to the changes that Netgear made to the armor service or maybe Google has been doing it forever to check if their devices have been compromised and the changes to Netgear's Armor just exposed it, not sure thought, and we won't know until Netgear comments on one of these threads.

TWHBW · ‎2021-08-20

Scared the crap out of me too, I hope it's resolved soon.

TWHBW · ‎2021-08-20

Got the same email. It has to be related to the issues we are all experiencing now. These alerts are non stop.

Robell1981 · ‎2021-08-20

Yeah, I don't really need those two hubs on at the moment so I turned their access to the network off and the alerts stopped. I'll leave them off for a while, but I know when I turn them back on it will start alerting like crazy.

scamp23 · ‎2021-08-23

I don't have a solution to this, but wanted to add that I have been inundated with similar 'attacks' on a lot of my hubs (specifically Google Hubs, not Google Hub Maxs, Minis, or Homes). It is always from 8.8.8.8. and will do it in spurts, then won't do it for a few days.

I hope this gets resolved soon. I have been very concerned that my network was potentially compromised, but it looks like it's maybe just an issue with Google / Armor. Also, the Armor portion of the Orbi app has become next-to-worthless... it doesn't show any information, my security score hasn't been updated in months, etc.

For a premium subscription / protection, I expect more.

Stompy_NG · ‎2021-08-25

My best guess is this is down to some Google firmware update possibly. I read recently they're going to start silently pushing out the Fuschia OS to the first generation hubs (without built in sleep tracking).

How to know if your Nest Hub has updated to Fuchsia OS - 9to5Google

However I am going allow NetGear Armor to keep blocking these scans until it's confirmed 100%.

baptistevod · ‎2021-08-25

Happy to read I'm not the only one who experiences this (since today). Besides the multiple notifications, what bothers me the most is that Netgear Armor doesn't show a lot of information regarding the 'threat' on its platform:

Any chance this gets resolved quickly?

In the meantime, is there any possibility to instruct Armor not to scan the (old) Google Nest Hub?

Tardigrade123 · ‎2021-08-25

The same problem here, today i started getting messages that Nest Hub is getting port scanned from ip 8.8.8.8. But thats just google right ?

Robell1981 · ‎2021-08-25

Yeah 8.8.8.8 is one of google's DNS servers. Which makes the message all the more confusing. I am still getting the alerts if I allow the devices back on to the network. Not sure who's issue it was, but with Netgear being so silent on it, not sure if it will ever get resolved or if we will ever figure out what the hell it is.

PetrusB · ‎2021-08-30

I have the older Goole Smart display and the Nest Hub. Both are getting blocked for a port scanning attack. Does anyone have more insights here thus far?

Robell1981 · ‎2021-08-30

Nope I haven't heard anything yet. It's quite annoying and kind of disturbing because I am still not sure what is going on.

baptistevod · ‎2021-08-30

I've informed Netgear about the issue last week.
In a follow-up e-mail today they informed me they are working on it.

kc6108 · ‎2021-08-30

My Nighthawk app has been blowing up with these notifications as well. As irritating as they are, I hope Netgear and Bitdefender don’t whitelist this type of activity by my Google Home Hubs if it’s truly nefarious/suspect. I don’t mind being riddled with legitimate attack notifications.

Traffic75 · ‎2021-08-31

I am having the google scanning attacks as well as the external Circle device that I purchased. I am gettting notifications every few minutes. How do I resolve this?

Filmer · ‎2021-09-01

Hello,
I ran in to this same issue as well. I'm not sure if this is the actual problem, but I had one of my google hub displays set to show a picture slide show. I changed that setting to only show the clock. I haven't gotten any other blocked attacks from that display, it's been about 4 hours. We will see if that's actually resolves the issue (a software fix is still needed)

Aragorn78 · ‎2021-09-08

So, I did a Google search on this issue and typically when there is a security vulnerability on such a mainstream device (that is still being sold today) you would think there would be numerous mentions on the Internet. Guess what? It only shows up (would you believe it?!) ONLY in the context of the Netgear/Armor and Google Nest Home. Yeah, mine have been blowing up lately, too. And.... shock of shocks... it happens to be blowing up days prior to my "free" trial period of the Armor security ends.

Hmmmm....

1) No mention elsewhere on the internet about this, beyond Netgear space. Hmmm!

2) I even called Google priority support, which I pay for (Google 1) and the senior tech said they have had NO reports of similar issues with Google Nest Home. DOUBLE Hmmm!!

3) It "just so happens" that my free Armor protection period is coming to an end. TRIPLE Hmmm!!!

Sounds REALLY FISHY, folks! Netgear is better than this type of baseless manipulation.

BTW, I am heavy involved in tech professionally. For a LONG time (45 years). This has all the marks of a FAKE. Been there DONE that.

Netgear.... CAUGHT YA! BUSTED!!!

Will be looking to your competitor's devices in the future if you DARE continue stooping to such unethical, deceptive levels!

FURRYe38 · ‎2021-09-09

Any progress on this?

@baptistevod wrote:

I've informed Netgear about the issue last week.
In a follow-up e-mail today they informed me they are working on it.

baptistevod · ‎2021-09-09

Yes, every 2 to 3 days Netgear sends me an email to inform me they’re working on it.

Each time I hope it’s to tell me the compatibility issue with google has been solved (not!) but at least they haven’t closed the issue.

The more time passes, the more I’m convinced this issue is a mutual problem between Google and Bitdefender/Netgear.

Google recently decided to change the OS of Google’s Hubs. All Huns (1st gen) would be updated without users notifying it (no visible changes).

Ha img this said, I believe bitdefender is experiencing issues with this charge of OS

ags7798 · ‎2021-09-26

I placed my phone, connected to the Google hub, next to the hub during a scan and probes actually got to and were detected by netgear on the phone... now I'm thinking it is a legit vulnerability and am wondering if this is really netgears fault... I'll see if I can run wireshark to grab any info on the scans

SilkyS · ‎2021-10-04

I'm still having the same issue. Hopefully somebody can figure it out. I'm not going to unblock it until I realize it's okay.

SilkyS · ‎2021-10-04

I also wanted to add that my issue actually seemed to start after I paid for the armor service not before.