Slashdot Mirror
Krebs Warns Source Code Leaked From Massive IoT Botnet Attack (krebsonsecurity.com)
Remember that historically massive denial-of-service attack last month against security researcher Brian Krebs? The source code's just been leaked, Krebs reports, "virtually guaranteeing that the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, digital video recorders and other easily hackable devices." An anonymous Slashdot reader quotes KrebsOnSecurity:
The malware, dubbed "Mirai," spreads to vulnerable devices by continuously scanning the Internet for IoT systems protected by factory default or hard-coded usernames and passwords. Infected systems can be cleaned up by simply rebooting them -- thus wiping the malicious code from memory. But experts say there is so much constant scanning going on for vulnerable systems that vulnerable IoT devices can be re-infected within minutes of a reboot. Only changing the default password protects them from rapidly being reinfected on reboot...
The user who leaked the source code says "there's lots of eyes looking at IOT now... I usually pull max 380K bots from telnet alone. However, after the Krebs DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300K bots, and dropping"...
Now that the source code has been released online for that 620-Gbps attack, Krebs predicts "there will soon be many Internet users complaining to their ISPs about slow Internet speeds as a result of hacked IoT devices on their network hogging all the bandwidth. On the bright side, if that happens it may help to lessen the number of vulnerable systems." He points out that 5.5 million new things get connected to the internet each day, according to Gartner. And they're also predicting that 6.4 billion things will be connected to the internet by the end of the year -- reaching 20.8 billion over the next four years.
The user who leaked the source code says "there's lots of eyes looking at IOT now... I usually pull max 380K bots from telnet alone. However, after the Krebs DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300K bots, and dropping"...
Now that the source code has been released online for that 620-Gbps attack, Krebs predicts "there will soon be many Internet users complaining to their ISPs about slow Internet speeds as a result of hacked IoT devices on their network hogging all the bandwidth. On the bright side, if that happens it may help to lessen the number of vulnerable systems." He points out that 5.5 million new things get connected to the internet each day, according to Gartner. And they're also predicting that 6.4 billion things will be connected to the internet by the end of the year -- reaching 20.8 billion over the next four years.
The throw-away hardware market gave way to the throw-away software (APPS!) market... is this the result?
Krebs predicts "there will soon be many Internet users complaining to their ISPs about slow Internet speeds as a result of hacked IoT devices on their network hogging all the bandwidth. On the bright side, if that happens it may help to lessen the number of vulnerable systems."
Yeah, I doubt it.
Customer: My internet is slow.
Comcast: I'm knowing how frustrating that is because I'm being a Comcast customer too! Did you rebooting your modem?
Customer: Yes, my internet is still slow.
Comcast: Let me to be sending the signal to your modem!
Customer: Didn't do anything, my internet is still slow.
Comcast: I'm knowing how frustrating that is because I'm being a Comcast customer too! Did you rebooting your modem?
Customer: Yes, 5 minutes ago while I was talking to you! My internet is still slow.
Comcast: Let me to be sending the signal to your modem!
"If there was a gay Afro-Puertorican Linux distribution, I'd give it a try" ~lucm
No problem.
My old ISP used to detect SMB port access. If they witnessed any - i.e. your connection was opening your file shares to the world - they would block your web and replace every page with a notice until you signed a document stating that you intended to do this. I think you needed customer number so not something that the kids could just press okay on for you.
At that point, they would open up the port again, or - if you'd fixed the problem and they detected that - they'd check once an hour and take the block off.
Force ISPs to do the same for when they detect spam email, or botnet-contribution, etc. Then when they detect it again after they'd signed, you can just kick them off for AUP violation.
But easier - just charge people by the byte. That's what'll end up happening. And most people won't even know or care that they're sending gigabytes to some poor sod's website.
1) Fines for device manufactures whose products participate in these attacks
2) Fines for ISPs that allow this traffic
3) Fines for the end users who are too inept to police their equipment
And not little fines.
I blame Russians, nuclear power, trans fats, and gluten.
The reason you can't simply get as many bots isn't that ISPs start finding out that they have a responsibility. It's simply that more players are fighting over the bots.
Next step is probably botters hacking devices and changing the passwords so other bot herders can't use them. It's the usual game: A resource is only valuable if the other one does NOT have it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Am I thinking wrong, or isn't this potentially a good thing? The more DOS:ers fighting for the same bots, the fewer of them will be able to hit each site. Thus they won't really be effective any longer.
give away control of the internet?
Krebs reports, "virtually guaranteeing that the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, digital video recorders and other easily hackable devices."
A frightening "future" indeed.
It would be really handy to know what devices are actually at risk, so that people can tell if they need to take action. It sounds like whatever these devices are, they have somehow been exposed to the Internet (didn't we all disable UPNP years ago).
Maybe all the ISP's should grab a copy of the code and use it for scanning for vulnerable client devices and tell their customers to disconnect them before the ISP does it for them.
ONLY apps can app apps, and with the Appernet of Apps, modern can app even more apps while apping other apps! With LUDDITE software like LUDDITE Windows 7, you can only run one LUDDITE program at a time!
Apps!
When is the whole www going to implement a system to disconnect items on the last leg of an internet connection when misbehavior occurs?
If 100 users get disconnected and 99 all pounce on the guy responsible for having a Bot-IOT device.
At least I can dream.
Well? Where is the source, luke?
So is it time for people to start bricking every unsecured IoT device or what?
Anons need not reply. Questions end with a question mark.
Wouldn't most if not all DDoS attacks be much harder if ISPs implemented BCP38? Of course IoT devices should be secure, but this is a dream as software will always contain bugs. The number of ISPs is much smaller than the number of devices connected to the internet, so blocking spoofed IP traffic is much cheaper solution.
Slippery slope. Very slippery. Oh look the ??AA just lobbied to get torrents listed as malware traffic legally and now ISPs are required to go around policing which is what the shit lord copyright trolls have always wanted.
In the past this used to be a good thing indeed,
but by now everyone seems to have forgotten the Slashdot Effect:
https://en.wikipedia.org/wiki/...
I am getting old ...
I don't see it as very helpful to announce these malwares and then issue hand waving generalities about 300,000 infected devices without ever mentioning which devices are being infected.
I realize that he explains that it is devices such as video cameras with default credentials, but I very much doubt that it is all that large a group of manufacturers/products. My suspicion is that, despite it being a very large number of devices(bots), it is a small group of manufacturers/products, and knowing which ones would be very helpful.
So, who/what makes up the botnet? Is it Hikvision, Panasonic, Ubiquiti? This, to me is the more important detail.
Does this scanning for IoT devices bypass NAT somehow? If my router isn't hacked, my internal devices should be safe from scanning?
I've been trying to get more info on this IoT unsecure thing and understand what these devices are. One thing that confuses me is that - aren't these things installed (mostly) in Residential Homes? which would be behind a "firewall" router that (usually) uses NAT?
The reason I ask this - how do I protect myself if I place such a device in my home? Are these pwned devices on the open network --- or can they be attacked through NAT? My "smart" TV, Bluray, Amazon TV, Apple TV, Raspberry Pi, Sonos, etc are all on the network. I have a NAT w/ uPNP disabled (prevent holes from being poked). Sure I understand there are ways through NAT....but these IoT attacks seem to "telnet" directly to the device without any special layers.
Beyond basic NAT/uPNP --- what else do I need to know?
Thanks!
You'd be dead too. ;)
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
I've heard that you're a raging homosexual. But, that doesn't mean that its true.
Printing facts, such as, the malware targets devices made by Hikuiti gets no one sued. It would be an irrefutable statement of fact.
Scanner runs through the following list of default login/passwords.
// root xc3511 // root vizxv // root admin // admin admin // root 888888 // root xmhdipc // root default // root juantech // root 123456 // root 54321 // support support // root (none) // admin password // root root // root 12345 // user user // admin (none) // root pass
// Set up passwords
add_auth_entry("\x50\x4D\x4D\x56", "\x5A\x41\x11\x17\x13\x13", 10);
add_auth_entry("\x50\x4D\x4D\x56", "\x54\x4B\x58\x5A\x54", 9);
add_auth_entry("\x50\x4D\x4D\x56", "\x43\x46\x4F\x4B\x4C", 8);
add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x43\x46\x4F\x4B\x4C", 7);
add_auth_entry("\x50\x4D\x4D\x56", "\x1A\x1A\x1A\x1A\x1A\x1A", 6);
add_auth_entry("\x50\x4D\x4D\x56", "\x5A\x4F\x4A\x46\x4B\x52\x41", 5);
add_auth_entry("\x50\x4D\x4D\x56", "\x46\x47\x44\x43\x57\x4E\x56", 5);
add_auth_entry("\x50\x4D\x4D\x56", "\x48\x57\x43\x4C\x56\x47\x41\x4A", 5);
add_auth_entry("\x50\x4D\x4D\x56", "\x13\x10\x11\x16\x17\x14", 5);
add_auth_entry("\x50\x4D\x4D\x56", "\x17\x16\x11\x10\x13", 5);
add_auth_entry("\x51\x57\x52\x52\x4D\x50\x56", "\x51\x57\x52\x52\x4D\x50\x56", 5);
add_auth_entry("\x50\x4D\x4D\x56", "", 4);
add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x52\x43\x51\x51\x55\x4D\x50\x46", 4);
add_auth_entry("\x50\x4D\x4D\x56", "\x50\x4D\x4D\x56", 4);
add_auth_entry("\x50\x4D\x4D\x56", "\x13\x10\x11\x16\x17", 4);
add_auth_entry("\x57\x51\x47\x50", "\x57\x51\x47\x50", 3);
add_auth_entry("\x43\x46\x4F\x4B\x4C", "", 3);
add_auth_entry("\x50\x4D\x4D\x56", "\x52\x43\x51\x51", 3);
add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x43\x46\x4F\x4B\x4C\x13\x10\x11\x16", 3);
Arm the providers with detection software and they can block the ip. Provider stores the blocked ip to a customer and informs them of the vulnerability and the cause, potentially even walks them through the fix. Everyone wins!