Slashdot Mirror
DVRs Used To Attack Synology Disk Stations and Mine Bitcoin
UnderAttack (311872) writes "The SANS Internet Storm Center got an interesting story about how some of the devices scanning its honeypot turned out to be infected DVRs. These DVRs are commonly used to record footage from security cameras, and likely got infected themselves due to weak default passwords (12345). Now they are being turned into bots (but weren't they bots before that?) and are used to scan for Synology Disk Stations who are vulnerable. In addition, these DVRs now also run a copy of a bitcoin miner. Interestingly, all of this malware is compiled for ARM CPUs, so this is not a case of standard x86 exploits that happen to hit an embedded system/device."
...by this?
I'm more surprised that we haven't seen reports of infected DVD and Blu-ray players whose only purpose is to seek out more powerful devices (PCs, smartphones) on peoples' networks to compromise and turn into bitcoin zombies. After all, it only takes a few people to come up with the exploits in the first place, and then 5kr1p7 k1dd13s can use the tools others have created.
Do not look into laser with remaining eye.
Not for Slashdot.
I've got the same combination on my luggage!
I hate April fools on the internet... April fools only works in person, it is just dumb and possibly dangerous on the internet.
next hack all of the dish, directv, and cable ones and make HBO free and with no HDCP.
Interestingly, all of this malware is compiled for ARM CPUs
How else does malware running on ARM based systems work?
This april fools is believable.
I still have more fans than freaks. WTF is wrong with you people?
are you sure espresso machines are not being used for same purposes? mine seem to be running out of coffee every 3 cups or so
Even though these people aren't paying for the power these devices use, I really doubt that there is any worth doing this. Even with thousands of them, could you mine a single block chain on an ARM processor when the network is overruled with FGA devices?
Glad this made it in before April 1st.
These should be considered counterfeit. True, they are probably good bitcoins in the accuracy department, but by no stretch of the imagination could they be considered legitimately mined. Is there a mechanism built into the bitcoin structure that allows for this and voids the coins?
The word? The word is weebles wobble but they do not, I repeat, do not, fall down. You heard the word right. Weebles do wobble, yes, but they do not - that's right, do not - fall down.
hardyharhar but of course weebles fall down you foo you. No gosub and multiply.
It's 90 minutes into April USA time and still no OMGPONIES!!!!!
Maybe that's the joke this year - nothing special on March 32nd.
Then again, I did see a "red" submission that looks out-of-this-world fake, so maybe we'll see something soon.
But when you've actually been asked by management whether you've implemented RFC 3514 (the "Evil Bit"), how can the Internet NOT be better?
as we can see, he was two minutes early.
Bird is the word
rewriting history since 2109
Since part of the world has the date of April 1 we've got a couple of days of trying to tell which stories are bogus and which not.
Please bring back the ponies instead of making us guess.
Well the laundry thought they may as well make SCORPION STARE self-funding by mining bitcoins. Its fortunate the researchers did not activate the primary function
TFA has very little info on the supposed Synology management interface vulnerability.
I believe this article covers some some of the general info on the vulnerabilities: http://www.symantec.com/connec...
That might also be an error in reporting: TFA's Author might have written "bitcoin mining" (for lack of understanding the whole alt-coin ecosystem) when it would be best described as "cryptocurrency miner". /. mentioning mining malware, all said "bitcoin mining" when careful reading showed up that in fact the malware didn't mine bitcoins but another cryptocurrency better suited for CPU (one of the latest I remember was PTShares).
The last few article on
Reporter just say "bitcoin mining" because that's the only thing they know and they vaguely remember that creating bitcoins was something CPU intensive.
The black-hats creating sophisticated malware (a worm, infecting vulnerable connected DVR, so they in turn can attack Synology NAS and launch mining software) aren't probably stupid enough to mine bitcoin, they probably know better, and the miner is for whatever is the current most CPU-worthy (i.e.: non SHA-256^2 baesd) cryptocurrency-coin.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
As I've mentionned above, it's probably NOT bitcoins being mined. /. mentioning mining malware, all said "bitcoin mining" when careful reading showed up that in fact the malware didn't mine bitcoins but another cryptocurrency better suited for CPU (one of the latest I remember was PTShares).
The last few article on
Reporter just say "bitcoin mining" because that's the only thing they know and they vaguely remember that creating bitcoins was something CPU intensive.
If the black-hats are smart enough to think this contrived way to infect the synology (infect first the "always on internet" DVR and only then, once you're on the other side of the firewall, start scanning the home intra-net for NAS hidden behind the firewall), perhaps they are also able to pick a CpU worthy (ie.: not SHA-256^2 based) cryptocurrency coin.
Even free-as-in-stolen, you're telling me that the best use somebody can think of for a botnet of network attached storage devices is generating maybe as many hashes as one of those cheapo USB-stick ASICs, rather than, say, basking in juicy private data and massive stolen storage space?
While you're at it, it's best to take as much opportunity as possible.
- you can "safely" mine on a nas, because the clueless user won't notice a heavily degraded performance (unlike on their desktop).
- you can pick-up a coin which won't be beaten by cheapo USB ASICs: math based coins (like PrimeCoin, RieCoin, etc.) are still mined on CPUs. SHA3 based coins (CopperLark, QuarkCoin, etc) don't have an efficient GPU implementation yet. SCrypt-based coins are some memory-intensive, that the jump between hardware generations doesn't yield such a strong difference in hash rate: even if the current mining is mostly done on GPU and some early experimental FPGA, high-end server CPU can still give Litecoin for their run. (so even if the ARM inside NAS isn't that powerful, a whole botnet mining Litecoin could still earn some money back).
And last but not least:
- that the worm download a payload for mining bitcoins, doesn't prevent the the worm to also download a payload for scanning credit-cards numbers, SSN, naked photos, etc.
So don't despair, the massive stolen storage space will also be juiced for all it's worth.
The coin-mining at least is low bandwidth, and it's possible for the blackhats to check if their plan is working just by looking at the income on the cryptocurrency address used for mining. Scanning the stolen storage space would be much more bandwidth intensive (the victim would notice that "their internet has become slow").
On the other hand, getting that money out of the botnet and into the black-hat's pockets is going to be tough:
cryptocurrency aren't anonymous. in fact they work based on the exact opposite: every single transaction is boardcaster to the whole network. While this provide good security against counterfeit wiithout needing a central authority (the whole point of the bitcoin protocole), that also means that anyone can follow the transaction following this mining.
If the hackers indeed used a rare CPU-based coin, that means that they can't do much except exchange it on one of the few major exchange which accepts even very minor coins (like cryptsy). That means it's rather easy for law forces to collaborate with cryptsy to try and catch any transaction with coins coming from this mining- then it's just a question of matching this transaction with user profiles and/or follow the money trail further.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Is there a mechanism built into the bitcoin structure that allows for this and voids the coins?
Is there a mechanism built into hard cash that allows to void the silvercoins/bank bills to be remotely voided? No.
And basically any cryptocurrency works the same. There's by definition NO SINGLE ENTITY in control of the bitcoin protocol (that's the whole point of it).
so nobody could remotely void any coin. (but at least that means that legally earned crypto-mony won't suddenly vanish neither... no fraudulous chargebacks on the bitcoin network)
On the other hand, cryptocurrencies aren't anonymous. At all. In fact they are (again by definition) the exact opposite: every signle transaction is broadcasted to the whole network. That really helps the security (thus every single node on the network can check and verify all transaction) without needs for a central authority (see previous point). But that also means that anyone can follow transaction a follow money jumping from one public key to another.
As the blackhats aren't probably mining actual bitcoins, but some minor alt-coins which is much more mine-able on CPUs, at some point, they'll need to exchange it for something more easily spendable. So they need to send them to one of the (few) exchanges accepting less known coins (Probably cryptsy).
Law forces could collaborate with exchanges and try to catch transaction whose coins can all be traced back to the initial mining by this botnet.
Then it's a matter of matching transaction with profiles registered at the exchange or further following the money trail.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
At the current bit coin difficulty, I would have thought even a large botnet of conventional CPUs would be pretty pointless.
Unfortunately it is all too believable...
The reason why is the DVR devices often only include buttons on the front for basic playback controls and numbers for selecting which camera to view. Naturally, the numbers are used for the admin/user logins!
It's the same issue with most Samsung DVR's. I have a Samsung DVR (SHR-4000 series). It has an embedded linux on a bootflash disk attached to an IDE interface. Even though there is a PC application (SmartViewer), you can only use numeric passwords. Might as well use 1-2-3-4 folks! Since it has nothing to stop repeated invalid attempts!
I started to notice a ton of UDP 123 (NTP) traffic going to "zero.bora.net". Curiously, this host is in Korea but does not appear to be related to Samsung Electronics. The volume of traffic is very high and is definitely not NTP traffic. I suspect that the DVR is attempting to stream my "video" off my cameras to this host. The traffic is all hashed and not recognized by wireshark as proper NTP traffic.
if you have a Samsung DVR folks, watch your network carefully for "zero.bora.net". Even though I have configured mine to use a local NTP server, it still sends high volume of traffic to that host. (all blocked at my firewall)
Needless to say, I am not buying another Samsung security product.
impossible to make any cash mining bitcoin this way, probably mining primecoin or one of the other CPU based alt coins
that if you DVR fishing shows, you spread worms, too
if this is supposed to be a new economy, how come they still want my old fashioned money?
rubbish!
Grease is the word, not only is it the word, it's also the time and the place, and indeed the motion!
I'm wondering what the overall hashing rate of their 'botnet' is?
Combine the low hashing rate with the latency inherent in scattered devices on a network and... I see there needing to be a huge supply of them to produce any decent amounts of accepted shares on a pool. Heck, I'm running the new ccminer on 2 Nvidia 650Ti's and getting almost 11mh/s mining HeavyCoins. That may sound like a lot to some people, but the BitCoin difficulty is in the BILLIONS... yeah, 5 billion and climbing.
I'm actually making .5% a day on a different venture that doesn't mine bitcoins, yet pays bitcoins every 10 minutes. Heck, the last 3 days have been averaging almost .7% a day in profits. Come check it out at thecleangame[.]net/multicoin So far we have a great group of folks in the beta program and the site is about to go live.
Massive things are happening in the mining world these days... come join the fun! :D
I use mine for TV shows and as a VPN (travel a lot) and I got hit with this. I found out when it was slow as a dog, rebooted it, and the services never came up (malware screwed up the boot). SSH worked, and then I found the indications of infection... I was away so I had to ask someone to stop by my house and unplug the power.
Luckily I mostly keep media files on it, and anything sensitive is in an encrypted container.
I'm pissed that Synology knew about these bugs for months and only patched them after they were exploited. I will probably make my own NAS running some flavor of Linux and then just put the Synology as one only available on my local network.