We have a customer who is running an office CCTV system which he accesses from home. The system runs on an embedded Linux box behind a NAT firewall forwarding to ports 8080 for web browser access and 37777 for proprietary software access.
All this has suddenly stopped working and a little investigation shows that TCP SYN packets sent to his IP address (on either port) are getting immediately terminated with RST packets containing the message "Go away, we're not home". Googling this message gets a lot of stuff about the Storm Botnet which apparently does exactly this.
So the question is, how on earth can the Storm Botnet hijack an embedded Linux box. Or am I missing something else entirely?