Slashdot Mirror
Anonymous Accused of Running a Botnet Using Thousands of Hacked Home Routers
An anonymous reader writes: New research indicates that Anonymous hacktivists (among other groups) took advantage of lazy security to hijack thousands of routers using remote access and default login credentials. "'For perpetrators, this is like shooting fish in a barrel, which makes each of the scans that much more effective,' the report explains. 'Using this botnet also enables perpetrators to execute distributed scans, improving their chances against commonplace blacklisting, rate-limiting and reputation-based defense mechanisms.'"
Remote access is a great tool, fix problems where you are, don't go to the site, reach it as you want.
But wait, it can be used to attack too, the number of suckers who will turn on Remote access tools and trust a stranger is high enough that some groups try it.
Have it on by default? Router makers must be insanely reckless. Oh wait, it isn't just them. It is medical device manufacturers as well. Pacemakers and microwaves atrebad enough. Unsecured WiFi? What?
to put the router in the cloud.
>> Anonymous hacktivists (among other groups) hijacked thousands of routers using remote access and default login credentials
Well, duh. Anonymous launches DDOS attacks. Lots of compromised routers or compromised desktops are basically the two items you need to run an effective DDOS. The good news is that millions compromised IoT devices will soon also provide a third base of operations. https://twitter.com/iot_securi...
If these things are shipped with weak security which allows an account with a default password to access the router from the outside ... then no bloody wonder.
How could people not go for such trivial attacks?
I can see it being bad enough that behind the router you have default passwords, you're doing it wrong.
When you ship crap like that, you are basically shipping without any actual security in the first place.
That's completely idiotic.
Lost at C:>. Found at C.
Who would've thunk.
Hardly anyone seems to pay any mind to leaving default password machines ripe for abusive plucking, maybe we need to penalize people for being willing idiots?
Hell, make it the responsibility of ISP's to detect whether default logins are being used and warn the user to change them.
I'd love to see a list of vulnerable routers. Or at least a list of routers known to ship with remote access enabled by default. TFA has no such list.
This might not be an official function of the group anonymous.
Say for example a user runs a botnet and participate in Anonymous. I don't want to be found when the feds hack the server. Some users could simply be using the routers as an anonymous proxy.
This may have no official connection to anonymous. This could be the same as accusing Torr as being set up and run by anonymous as some of the exit notes log into the anonymous server.
There is a possibility this is real, but at this point is is mostly speculation, and possibly a smear campaign.
The truth shall set you free!
Hackers, hack things that are easy to hack and then use them to help them with other hacks!
Both the Canadian CSE, and British GCHQ have false flag attacks in their playbook, so the NSA probably has it too. Hence:
1) Hack tons of home routers for agency gain
2) Accuse Anonymous of doing it
3) Gain public support for going after them
4) Gain FUNDING for doing so
5) Profit.
The NSA acting like scumbags means I can never trust these types of stories ever again.
Although TFA does not name all of the routers affected, it does name Ubiquiti routers specifically as being an issue.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
The article recommends updating the firmware to the latest provided by the vendor - which is quite often, no help. First, check to see if that latest firmware is corrected... But preferably - install better 3rd party firmware - like openwrt - designed by people that care about your security, reliability, and uptime.
Does anyone have a better link with more information on this story?
The Information Revolution will be fought on the command line.
I've never heard of that expression before. Sounds like a bad episode of Swamp People. lol Isn't shooting a fish in a barrel overkill? How about using a fish hook or a net instead?
I have an ssh honeypot analyzer at longtail.it.marist.edu at Marist College and it shows that the second most popular account after root is "admin", and that the most common account/password tried is ubnt/ubnt.
Anybody who's been paying attention knows that default passwords on home routers are high on the bad guy's list of accounts to hack.
LongTail SSH Brute Force analysis tool is here!
Are there any resources to see if your router's admin password is the default password?
If my router has the easy default password, will changing the password to something else stop it from being used in botnets, or once penetrated, always screwed? I'm guessing if I do a factory reset I'll need AT&T to come out and configure the modem.
IMHO, if Anonymous creates a big enough network of compromised routers, they could create a meshed voip service or something like firechat where they can communicate using the mesh, without being monitored. If they are "cracking" home routers, it wouldn't be to use the wifi router's measly 1G port and cpu for DDOS attacks, it'd be for something more ambitious.
... to compel us to read further.
Anonymous is a punk outfit that sprays DDoS graffiti and that's it.
The REAL Anonymous players lost that attribute when the bastards went to jail.
Fuck Anonymous.
It little behooves the best of us to comment on the rest of us.
My Internet is hacked by the NSA/AT&T, my router is hacked by Anonymous, my Mac is hacked by China, my watch is hacked by fanboys, my VAX is hacked by Kevin Mitnick, my butt is hacked by racks of BBQ ribs, my brain is hacked by mounds of plaque, and my cat is hacked by a rat. What else is new?
This is the NSA, we're gonna geet U h@x0r5! Also, what is a h@x0r5?
IIt is porbably that hacker 4chan again.
Don't fight for your country, if your country does not fight for you.
It's a loose collective with no centrally organized leadership. How do you accuse a group of something that they, as a group, have no control over? How do you prosecute anarchy?
individuals. thats whoo. IRL can be a bitch when get indicted for serious crimes. arguably serious crimes against humanity since the gov classified the net as a utility. anon may as well be extorting people by cutting off water and electricity. thats how the gov now sees it, lolz. or perhaps bama or clinton thugz will just take care of it in their own way. you know, find the perps have committed suicide by shooting themselves in the back of the head twice then jumping off a tall building, lolz.
r in ur r00terz na0
All AirTies routers, used mainly in Turkey, use telnet with a passwordless root account and are also fully open on http. No https or ssh is used. The company refuses to fix it.
There are thousands of these router open within Turkish Telecom.
ISPs use custom protocols like http://en.wikipedia.org/wiki/TR-069 for remote management, so there's really no reason to enable by default services that listen on the public network.