Slashdot Mirror
Vigilante Malware Protects Routers Against Other Security Threats
Mickeycaskill writes: Researchers at Symantec have documented a piece of malware that infects routers and other connected devices, but instead of harming them, improves their security. Affected routers connect to a peer-to-peer network with other compromised devices, to distribute threat updates. 'Linux.Wifatch' makes no attempt to conceal itself and even left messages for users, urging them to change their passwords and update their firmware. Symantec estimates 'tens of thousands' of devices are affected and warns that despite Wifatch's seemingly philanthropic intentions, it should be treated with caution.
"It should be made clear that Linux.Wifatch is a piece of code that infects a device without user consent and in that regard is the same as any other piece of malware," said Symantec. "It should also be pointed out that Wifatch contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions." There is one simple solution to rid yourself of the malware though: reset your device
"It should be made clear that Linux.Wifatch is a piece of code that infects a device without user consent and in that regard is the same as any other piece of malware," said Symantec. "It should also be pointed out that Wifatch contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions." There is one simple solution to rid yourself of the malware though: reset your device
I would call that palware and not malware.
Is doing good things, that's not malware.
This. Is. Awesome!
Finally someone has decided to return to the roots of hacking... making something change just to see the change happen!
Which has more power: the hammer, or the anvil?
I am not sure I agree with this fully. The webcam site which shows all the cameras with default settings I don't take issue with, because it's not doing anything special or malicious to access the camera. In this case, they are doing more than uploading software by using a default password. The original good intention can easily become something bad. You can check history on that last one if you have doubts.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
This type of virus-like good-guy software shall hereby be known as: Rogueware
Rogueware: A stealth cyber agent which defends crapware.
... to get this malware?
It little behooves the best of us to comment on the rest of us.
It should be made clear that Symantec is a piece of code that infects a device /with/ user consent and in that regard is the same as any other piece of malware that is installed via a phishing attack.
The original iPhone jailbreaking site, "jailbreakme.com", used the tiff library exploit to install the installer, and then patched the tiff exploit behind itself to prevent it being used for any other (nefarious) purpose, so this type of thing is not a unique or even new idea.
Useful software runs on computers and in that respect is no different than malware.
IIrc there are some other infections that do this sort of thing ie removing other threats/blocking other malware infections. I think one of them was the TDSS rk. And by doing so it evaded behavioral and real time scanners as it was seen as just another security service.
Symantec didn't get my consent when they infected my brand new computer with their anti-virus bloatware. Where is an anti-norton virus when you need one?
Too many vulnerable routers without patches available. If someone came up with a way to plug the vulnerability by exploiting it, Kudos. I say leave it there unless you CAN patch it, then do that instead. If they later abuse it, then reset your router.
(If at first you don't succeed, do it different next time!)
The Welchia worm, also known as the "Nachia worm", is a computer worm that exploits a vulnerability in the Microsoft Remote procedure call (RPC) service similar to the Blaster worm. However, unlike Blaster, it first searches for and deletes Blaster if it exists, then tries to download and install security patches from Microsoft that would prevent further infection by Blaster, so it is classified as a helpful worm.
https://en.wikipedia.org/wiki/...
His name is TRON, he fights for the Users.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Lots of malware actually does close security holes, after exploiting the device. If you've worked very hard (or shelled out large amounts of case) for a working zero day, the last thing you want is some other asshole compromising your hacked system and screwing up your back door.
Solving Unix problems since 1989...
This....makes me uneasy.
It appears to be benign (or even helpful) but this is a slippery slope...and I can see all sorts of things that can go wrong here.
I want to root for the good guys here (pun intended, heh!) but I don't know...anything that fiddles with my PC or server without my explicit, informed consent and permission just doesn't sit well with me.
It sort of reminds me of the viruses that infect your PC and then disable any competing viruses it finds, so it has your PC all to itself. It doesn't do it for benevolent reasons, it does it because it's greedy and doesn't want to share.
So I dunno. I can't say as I like it, and I can't say as I don't. Major conflicted feelings here.
Just cruising through this digital world at 33 1/3 rpm...
Symantec don't like it because who will buy the anitivirus if the RobinHoodware would spread.
Batman learned to code!
well done, and thank you, to whoever did this - great work, more please.
How many man hours are wasted pen testing or setting up security just so that client after client can fail to remain compliant as time goes by?
How many billions of dollars are wasted every year by large corporations failing to secure their data?
Why not just start writing viruses that go out, patch vulnerabilities, throw a middle finger and erase / kill process?
Target the weakest link and do something about it. In fact I feel if a company is "caught" doing this it shouldn't even be considered illegal. This should be considered the future of anti-malware.
Today I was helping a computer illiterate classmate set up some engineering software, and to make idle chat I tried to explain to her Moore's law. And I had to add the caveat that some people felt Moore's law was breaking down.
And I said, what we need today is to focus not on how recklessly we can double computing power but how responsibly we can mitigate threat. And if you follow any of the bevy of pen testers with twitter accounts you'll read long, long lists of newly discovered vulnerabilities every day, many of them quite sweat-inspiring.
There should be a new "law" that describes the increase of threats across some variable like time, or complexity, or something like that.
Anyways the future of anti-malware is likely to be "vigilante ware" whether we like it or not. Some body will get it up their ass to write things like this that don't come with catches like back doors or other worries, and will just start distributing them as 0-day attacks.
With thousands of new pen testers and potential malware authors trained every year, I don't see how the millionth monkey effect can be avoided.
I see people here posting analogies about breaking into your house and doing your dishes. That's fine but this malware is an easy target because of the back doors.
What if you came home and that ugly dirt patch surrounded with paving stones along the front of your house (what the hell is that thing) had been planted with an appropriate selection of flowers to match your "paint"? How are you even going to pursue charges? Who would you be capable of getting interested in finding out whodunit? Probably nobody.
Eventually vigilante ware will be everywhere and I doubt anybody's going to get all that upset about it.
And no, this is not a manifesto.
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
just like Microsoft Windows!?
Facebook is billions of individual "Skinner Boxes." And if you use it you are the pigeon!
Nobody prefers vigilante anything to doing things the right way. The question is, would these devices be realistically fixed over time, or just left open and exploited? If the later, maybe vigilante fix is better than no fix. If I left my door unlocked in a seedy neighborhood, I would rather somebody came and locked it for me than come back and find my house burglarized. The entry point for this thing is simply telnet with default username/password. There is little doubt that chances of malicious exploit are high and owners are not technologically savvy enough to fix the device by themselves even if there was some way to warn them.
Yes they did. It says right on the box that the computer comes with it. You accepted it by buying it.
Your argument is like saying you didn't consent to cancer when you bought and smoked cigarettes.
A better analogy would be "he consented with cancer when he was born with a defective p53 gene on his c17".
By the way: shrink wrap licenses are not valid in all jurisdictions.
Hello,
For more information about this malware(ish) campaign, I would refer you to Peter Kosinar's talk at AVAR 2014: Stealing the Internet, One Router at a Time">. Disclaimer: Peter is a friend of mine.
Regards,
Aryeh Goretsky
Dexter is a good dog.
The source code apparently has been released on http://gitlab.com/rav7teif/lin...