Slashdot Mirror
Source Code For IoT Botnet 'Mirai' Which Took Down Krebs On Security Website With DDoS Attack Released (krebsonsecurity.com)
As if the state of security wasn't already a headache worldwide, we now may have one more reason to worry about: a hacker has made available the source code that could allow more people to wage the kinds of extraordinary large assaults that recently knocked security news site KrebsOnSecurity offline. Brian Krebs reports:The source code that powers the "Internet of Things" (IoT) botnet responsible for launching the historically large distributed denial-of-service (DDoS) attack against KrebsOnSecurity last month has been publicly released, virtually guaranteeing that the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, digital video recorders and other easily hackable devices. The leak of the source code was announced Friday on the English-language hacking community Hackforums. The malware, dubbed "Mirai," spreads to vulnerable devices by continuously scanning the Internet for IoT systems protected by factory default or hard-coded usernames and passwords. Vulnerable devices are then seeded with malicious software that turns them into "bots," forcing them to report to a central control server that can be used as a staging ground for launching powerful DDoS attacks designed to knock Web sites offline. The Hackforums user who released the code, using the nickname "Anna-senpai," told forum members the source code was being released in response to increased scrutiny from the security industry.
Oh great, now every dickweasel and conehead in the world will be cranking out malware.
Just cruising through this digital world at 33 1/3 rpm...
It's amazing that is just now becoming a thing. IoT devices and their piss-poor security/default passwords/etc have been out for a while.
Fuck Ajit Pai
Headline translation: "We're Doomed."
Just cruising through this digital world at 33 1/3 rpm...
Unfortunate this was released. Even more unfortunate the IoT devices have such poor security.
Better that it's out in the open than hidden in the shadows, out of reach of security researchers.
This will motivate competent admins who, for whatever reason, haven't secured these kinds of devices already to get around to taking care of the issue. As for the incompetent admins and the average home user, they'll figure it out when their bandwidth costs go through the roof and be forced to take action one way or another.
But long story short, if a tool exists (good or bad) it's better that everyone can access it rather than just the bad guys.
This is a duplicate of http://m.slashdot.org/story/31...
ISP's have a responsibility to make sure their subscribers aren't using their network for nefarious purposes. That includes unknowingly so.
Identify the botnets and their traffic, in turn identify offending IOT devices that are doing this, and revoke the access of the subscriber until they are removed.
DDOS is against the law. If people were connecting child pr0n spamming devices to the internet instead of garbage pingers, might it get some fucking attention?
People need to realize the intrinsically insecure nature of the network.
Stop using it for critical infrastructure.
Stop trying to use it as a backbone for monetary systems.
Stop using it to handle important personal data.
In most cases, this is being done just to cut jobs and save money.
If Mirai makes people look in the mirror and wake-up, it's a good thing.
This just in: Post Title for Source Code For IoT Botnet 'Mirai' Which Took Down Krebs On Security Website With DDoS Attack Released Deemed 'Not Enough Like That Brain Freeze Feeling' on Slashdot
There are two types of people in the world; those who believe there are two types of people, and those who don't.
Reading about this, I was wondering is there isn't some way to mitigate the problem by pre-emptively borking the devices.
Apparently power cycling the IoT device will reset it to normal, whereupon it can be reinfected.
Suppose some security group ran the malware and infected as many devices as possible with code that made the device *not work*.
The owners would have to keep power-cycling the devices, they'd get pissed at the manufacturers for making a poor product, and maybe they'd replace the devices with newer ones.
This should be simple to do, much less effort than making the code try to contact the owner with "hey - change your password" and such.
Would just making the products appear crappy work?
.. loosing the battle
I'm just thinking... if all these IoT devices are insecure to let a hacker take them over, why doesn't a whitehat group just do the same thing, but instead of using the devices maliciously, they modify the device password to something random to make them more secure? Most folks wouldn't even know, and if they ever needed to change their password they could reset their device and figure it out.
The same story was posted yesterday.
Use the source code to create malware that disables the functionality of the insecure devices. When it becomes apparent that massive numbers of them stop working soon after installation, sales will drop through the floor and that is the only thing that will make manufacturers change their behavior.
We need a grey-hat to take this and use it to "secure" all the insecure IoT devices, be it patching, changing passwords, or bricking them.
The problem you have here is that if you get caught attempting to crack IoT devices even with the best of intentions you could be charged as a criminal cracker. The only way to legally run network sniffing software which can also include tools like Wireshark is to actually get written permission and therein lies the problem.
Anyone who has worked in the enterprise should be well aware of the tiers bureaucracy of the organisation and how some departments can be downright antagonistic to others to the point where cooperation is almost impossible. So say you have someone who offers to test IoT in a particular organization but is not a member of the department who should be responsible for the testing the hardware or worse yet there are multiple departments involved. Honestly without written permission from the CEO any well meaning "grey hat" risks a prison term.
The best solution is for IPS's to be aware and have the ability to pinpoint the sites were these IoT devices have been compromised and submit a report that can't be disputed to a particular body that has the power to fine the organisations responsible for lax security. I am not holding my breath for something like this to occur though.
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
I mean, what would happen if you used a strong passphrase?
Dupe
It took me all of 0.5 seconds to spot this dupe. Do editors get paid? How do I apply for this job?
What happened to hacker ethics? Releasing an exploit (as opposed to selling it to some government agency) used to be good news. It's the only chance that manufacturers and users will start worrying about securing their devices. Making them liable might also help.
I built my own using a beagle bone and assorted parts (opto-triacs, P/S and xformer) for under a hundred.
...and somehow houses/cars/etc. get doors with unique keys by default.
How many things of value would fail if ISPs blocked telnet port ?
Bricking the device negatively impacts the end-user, who frequently has zero control over security flaws in the firmware. Instead, the malware should figure out who the manufacturer is of the device it's infected, then start DDoSing that manufacturer's website. Minimal impact to the end-user, but the manufacturer's problem scales with the number of insecure devices they sell and leave unfixed.
I have a computer program that needs all the video feeds to find people who might be involved in "interesting" incidents.