I can gather that this is the company Shodan, and that they make reports regarding internet connected devices, but what is a 'banner' is this instance?

In the context of SSH, a banner might be

root@localhost's password:

or more accurately SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1 which is the first thing a particular SSH daemon will send on receiving a connection from a client

One wouldn't normally 'resolve a banner' though, since it might contains the version of a service used, and other information other than what a Unix `hostname` command would return. You'd resolve the hostname mentioned in the banner.

HTTP/1.1 200 OK Server: Apache ...

The banner includes metadata about the service/ software that is running on the device.

What does this even mean?

First of all, what does it mean than an IP resolves to a hostname? I thought it's the otherway around: hostnames resolve to IPs.

Second, isn't this .. normal? localhost is always your local machine.

Please help me understand

For Google.com, I can get an A record (IP address)

    $ dig +short google.com a
    216.58.208.238

    $ dig -x 216.58.208.238 +short
    par10s22-in-f14.1e100.net.
    par10s22-in-f14.1e100.net.

Although maybe OP only means the hostname in the banner message. I grepped my mail logs for hostnames from Vietnam and couldn't find any IPs that would resolve back to localhost.

EDIT: 'nanofortnight https://news.ycombinator.com/item?id=9068054 found a range of addresses that do.

    $ dig +short -x 123.26.2.1 
    localhost.

A reverse dns lookup actually just does a lookup of {the ip address with octets reversed}.in-addr.arpa:

        > host 216.58.208.238 
        238.208.58.216.in-addr.arpa domain name pointer par10s22-in-f14.1e100.net.

        > dig +short ptr 238.208.58.216.in-addr.arpa 
        par10s22-in-f14.1e100.net.

        ;; AUTHORITY SECTION:
        208.58.216.in-addr.arpa. 86400	IN	NS	ns3.google.com.

https://www.shodan.io/search?query=hostname%3Alocalhost

That gives you a list of IPs that you can check for yourself are affected by the issue.

Edit: which usually gives a better idea of the host's origin than raw IP.

You can do a reverse DNS lookup, which uses PTR records. See:

https://tools.ietf.org/html/rfc1033

[1]: https://news.ycombinator.com/item?id=9065375

    $ dig @8.8.8.8 -x 123.16.0.0

    ; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 -x 123.16.0.0
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29897
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

    ;; QUESTION SECTION:
    ;0.0.16.123.in-addr.arpa.   IN  PTR

    ;; ANSWER SECTION:
    0.0.16.123.in-addr.arpa. 21265  IN  PTR localhost.

    ;; Query time: 64 msec
    ;; SERVER: 8.8.8.8#53(8.8.8.8)
    ;; WHEN: Wed Feb 18 08:14:37 2015
    ;; MSG SIZE  rcvd: 64

    $

[1]: http://bgp.he.net/AS45899#_prefixes

However, static.vdc.vn resolves to 203.162.0.78, not 127.0.0.1

There is another large network, 113.160.0.0/113.191.255.255 that seems to have PTR records of static.vnpt-hanoi.com.vn for all IPs, however that hostname has no A/AAAA record.

Pretty sloppy.

Looks like this has nothing to do with DNS, instead it's the hostname the machine displays in its banners for services like FTP or SSH.

113.169.170.93

You can get a list of affected IPs by searching as follows:

https://www.shodan.io/search?query=hostname%3Alocalhost

http://www.ip-tracker.org/locator/ip-lookup.php?ip=113.165.1...

BTW, I don't know why they did that.

When you connect over services, the banner (the first information presented to the client, before authentication) can be configured to include the 'hostname' setting of the server you have connected to.

If I am right about that, this means that the hostname setting of the server is still set to localhost, as it is default out of the box until configured.

For ssh that will be some information about the server, version of ssh, hostname, and (hopefully) a prompt to login, or a request for a key.

For http, it will be a handful of headers about the server.

Tools like Shodan scan the internet looking for active connections, and try to banner-grab on common ports, looking for details like server versions, operating system versions, etc for a long list of protocols like telnet, http, ssh, smtp, vnc, remote desktop (often with screenshots of the remote system, disturbing often unauthenticated straight to the desktop or running program), etc.

If you're of a malicious mindset, when a new vulnerability is discovered, or an old one, you can look up a list of vulnerable systems from the database, searching by service and version, rather than scanning the internet yourself.