Slashdot Mirror
Vigilante Malware Protects Routers Against Other Security Threats
Mickeycaskill writes: Researchers at Symantec have documented a piece of malware that infects routers and other connected devices, but instead of harming them, improves their security. Affected routers connect to a peer-to-peer network with other compromised devices, to distribute threat updates. 'Linux.Wifatch' makes no attempt to conceal itself and even left messages for users, urging them to change their passwords and update their firmware. Symantec estimates 'tens of thousands' of devices are affected and warns that despite Wifatch's seemingly philanthropic intentions, it should be treated with caution.
"It should be made clear that Linux.Wifatch is a piece of code that infects a device without user consent and in that regard is the same as any other piece of malware," said Symantec. "It should also be pointed out that Wifatch contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions." There is one simple solution to rid yourself of the malware though: reset your device
"It should be made clear that Linux.Wifatch is a piece of code that infects a device without user consent and in that regard is the same as any other piece of malware," said Symantec. "It should also be pointed out that Wifatch contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions." There is one simple solution to rid yourself of the malware though: reset your device
I would call that palware and not malware.
...and then gets apped.
Apps!
Is doing good things, that's not malware.
This. Is. Awesome!
Finally someone has decided to return to the roots of hacking... making something change just to see the change happen!
Which has more power: the hammer, or the anvil?
I am not sure I agree with this fully. The webcam site which shows all the cameras with default settings I don't take issue with, because it's not doing anything special or malicious to access the camera. In this case, they are doing more than uploading software by using a default password. The original good intention can easily become something bad. You can check history on that last one if you have doubts.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
This type of virus-like good-guy software shall hereby be known as: Rogueware
Rogueware: A stealth cyber agent which defends crapware.
... to get this malware?
It little behooves the best of us to comment on the rest of us.
It should be made clear that Symantec is a piece of code that infects a device /with/ user consent and in that regard is the same as any other piece of malware that is installed via a phishing attack.
The original iPhone jailbreaking site, "jailbreakme.com", used the tiff library exploit to install the installer, and then patched the tiff exploit behind itself to prevent it being used for any other (nefarious) purpose, so this type of thing is not a unique or even new idea.
Useful software runs on computers and in that respect is no different than malware.
IIrc there are some other infections that do this sort of thing ie removing other threats/blocking other malware infections. I think one of them was the TDSS rk. And by doing so it evaded behavioral and real time scanners as it was seen as just another security service.
Symantec didn't get my consent when they infected my brand new computer with their anti-virus bloatware. Where is an anti-norton virus when you need one?
Too many vulnerable routers without patches available. If someone came up with a way to plug the vulnerability by exploiting it, Kudos. I say leave it there unless you CAN patch it, then do that instead. If they later abuse it, then reset your router.
(If at first you don't succeed, do it different next time!)
The Welchia worm, also known as the "Nachia worm", is a computer worm that exploits a vulnerability in the Microsoft Remote procedure call (RPC) service similar to the Blaster worm. However, unlike Blaster, it first searches for and deletes Blaster if it exists, then tries to download and install security patches from Microsoft that would prevent further infection by Blaster, so it is classified as a helpful worm.
https://en.wikipedia.org/wiki/...
His name is TRON, he fights for the Users.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Lots of malware actually does close security holes, after exploiting the device. If you've worked very hard (or shelled out large amounts of case) for a working zero day, the last thing you want is some other asshole compromising your hacked system and screwing up your back door.
Solving Unix problems since 1989...
This....makes me uneasy.
It appears to be benign (or even helpful) but this is a slippery slope...and I can see all sorts of things that can go wrong here.
I want to root for the good guys here (pun intended, heh!) but I don't know...anything that fiddles with my PC or server without my explicit, informed consent and permission just doesn't sit well with me.
It sort of reminds me of the viruses that infect your PC and then disable any competing viruses it finds, so it has your PC all to itself. It doesn't do it for benevolent reasons, it does it because it's greedy and doesn't want to share.
So I dunno. I can't say as I like it, and I can't say as I don't. Major conflicted feelings here.
Just cruising through this digital world at 33 1/3 rpm...
Symantec don't like it because who will buy the anitivirus if the RobinHoodware would spread.
Batman learned to code!
well done, and thank you, to whoever did this - great work, more please.
How many man hours are wasted pen testing or setting up security just so that client after client can fail to remain compliant as time goes by?
How many billions of dollars are wasted every year by large corporations failing to secure their data?
Why not just start writing viruses that go out, patch vulnerabilities, throw a middle finger and erase / kill process?
Target the weakest link and do something about it. In fact I feel if a company is "caught" doing this it shouldn't even be considered illegal. This should be considered the future of anti-malware.
Today I was helping a computer illiterate classmate set up some engineering software, and to make idle chat I tried to explain to her Moore's law. And I had to add the caveat that some people felt Moore's law was breaking down.
And I said, what we need today is to focus not on how recklessly we can double computing power but how responsibly we can mitigate threat. And if you follow any of the bevy of pen testers with twitter accounts you'll read long, long lists of newly discovered vulnerabilities every day, many of them quite sweat-inspiring.
There should be a new "law" that describes the increase of threats across some variable like time, or complexity, or something like that.
Anyways the future of anti-malware is likely to be "vigilante ware" whether we like it or not. Some body will get it up their ass to write things like this that don't come with catches like back doors or other worries, and will just start distributing them as 0-day attacks.
With thousands of new pen testers and potential malware authors trained every year, I don't see how the millionth monkey effect can be avoided.
I see people here posting analogies about breaking into your house and doing your dishes. That's fine but this malware is an easy target because of the back doors.
What if you came home and that ugly dirt patch surrounded with paving stones along the front of your house (what the hell is that thing) had been planted with an appropriate selection of flowers to match your "paint"? How are you even going to pursue charges? Who would you be capable of getting interested in finding out whodunit? Probably nobody.
Eventually vigilante ware will be everywhere and I doubt anybody's going to get all that upset about it.
And no, this is not a manifesto.
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
just like Microsoft Windows!?
Facebook is billions of individual "Skinner Boxes." And if you use it you are the pigeon!
Yes they did. It says right on the box that the computer comes with it. You accepted it by buying it.
Your argument is like saying you didn't consent to cancer when you bought and smoked cigarettes.
Nobody prefers vigilante anything to doing things the right way. The question is, would these devices be realistically fixed over time, or just left open and exploited? If the later, maybe vigilante fix is better than no fix. If I left my door unlocked in a seedy neighborhood, I would rather somebody came and locked it for me than come back and find my house burglarized. The entry point for this thing is simply telnet with default username/password. There is little doubt that chances of malicious exploit are high and owners are not technologically savvy enough to fix the device by themselves even if there was some way to warn them.
Because we have to disable it. Because it's the malware that the routers deserve, but not the one they need right now... and so we'll try to disable it, because it can take it. Because it's not a hero. It's a silent guardian, a watchful protector, the Whitehat Malware.
Yes they did. It says right on the box that the computer comes with it. You accepted it by buying it.
Your argument is like saying you didn't consent to cancer when you bought and smoked cigarettes.
A better analogy would be "he consented with cancer when he was born with a defective p53 gene on his c17".
By the way: shrink wrap licenses are not valid in all jurisdictions.
Hello,
For more information about this malware(ish) campaign, I would refer you to Peter Kosinar's talk at AVAR 2014: Stealing the Internet, One Router at a Time">. Disclaimer: Peter is a friend of mine.
Regards,
Aryeh Goretsky
Dexter is a good dog.
See subject: Hosts protects vs. it (resolving before remote DNS can) by hardcoded fav. sites in hosts via APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
E.G. -> Thru it & inputs YOU give it for those favorite sites you use MOST online where you spend most of your time online in hosts (favorite sites that are VERIFIED AS VALID via REVERSE DNS PINGS) @ the TOP of your custom hosts file!
Doing that works for:
---
1.) MORE SPEED (hosts are cached into LOCAL memory + operate in kernelmode, NOT slower usermode OR some remote slower facility like DNS) - beyond adblocking hosts do as well.
2.) MORE SECURITY (vs. redirect poisonings)
3.) MORE RELIABILITY (vs. redirects & downed DNS too)
---
This is IN COMBINATION with DNS mind you!
(Albeit DNS is only secondary for rare times you may miss a lookup & the data for said site's NOT one of your favorites).
I'd suggest OpenDNS specifically!
(They filter vs threats as I do in my hosts file & they are patched vs. the Kaminsky redirect poisoning flaw here @ home).
This LIGHTENS REMOTE DNS SERVER LOADS too (DNS admins ought to love it) & increases RELIABILITY online vs. redirect poisoned DNS servers (of which 99.999% of ISP dns servers are NOT PATCHED AGAINST mind you), OR vs. "downed" dns servers too!
---
E.G. - You'd "hardcode" e.g. slashdot in properly
216.34.181.45 slashdot.org
AT THE TOP OF YOUR HOSTS FILE (so it resolves fastest cached in local system RAM & completely avoiding DNS giving you better speed & BEST security + reliability vs. this & no problem per my subject line above).
APK
P.S.=> Thus, DNS & hosts COMPLIMENT ONE ANOTHER, EVEN IN A ROUTER, for more speed, security, & reliability online!
(I use DNS for rare sub 4% of the time lookups I have to do, the other 95++% of my time online is spent @ favorite sites in my hosts file, which is what MOST folks do (nobody "hits the entire internet everyday" in other words))... apk
The source code apparently has been released on http://gitlab.com/rav7teif/lin...
The Securityweek article on the subject reported that the code had this comment:
“To any NSA and FBI agents reading my email: please consider whether defending the US Constitution against all enemies, foreign or domestic, requires you to follow Snowden's example.”