Slashdot Mirror
Source Code For IoT Botnet 'Mirai' Which Took Down Krebs On Security Website With DDoS Attack Released (krebsonsecurity.com)
As if the state of security wasn't already a headache worldwide, we now may have one more reason to worry about: a hacker has made available the source code that could allow more people to wage the kinds of extraordinary large assaults that recently knocked security news site KrebsOnSecurity offline. Brian Krebs reports:The source code that powers the "Internet of Things" (IoT) botnet responsible for launching the historically large distributed denial-of-service (DDoS) attack against KrebsOnSecurity last month has been publicly released, virtually guaranteeing that the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, digital video recorders and other easily hackable devices. The leak of the source code was announced Friday on the English-language hacking community Hackforums. The malware, dubbed "Mirai," spreads to vulnerable devices by continuously scanning the Internet for IoT systems protected by factory default or hard-coded usernames and passwords. Vulnerable devices are then seeded with malicious software that turns them into "bots," forcing them to report to a central control server that can be used as a staging ground for launching powerful DDoS attacks designed to knock Web sites offline. The Hackforums user who released the code, using the nickname "Anna-senpai," told forum members the source code was being released in response to increased scrutiny from the security industry.
Oh great, now every dickweasel and conehead in the world will be cranking out malware.
Just cruising through this digital world at 33 1/3 rpm...
It's amazing that is just now becoming a thing. IoT devices and their piss-poor security/default passwords/etc have been out for a while.
Fuck Ajit Pai
Headline translation: "We're Doomed."
Just cruising through this digital world at 33 1/3 rpm...
Better that it's out in the open than hidden in the shadows, out of reach of security researchers.
This will motivate competent admins who, for whatever reason, haven't secured these kinds of devices already to get around to taking care of the issue. As for the incompetent admins and the average home user, they'll figure it out when their bandwidth costs go through the roof and be forced to take action one way or another.
But long story short, if a tool exists (good or bad) it's better that everyone can access it rather than just the bad guys.
This is a duplicate of http://m.slashdot.org/story/31...
Reading about this, I was wondering is there isn't some way to mitigate the problem by pre-emptively borking the devices.
Apparently power cycling the IoT device will reset it to normal, whereupon it can be reinfected.
Suppose some security group ran the malware and infected as many devices as possible with code that made the device *not work*.
The owners would have to keep power-cycling the devices, they'd get pissed at the manufacturers for making a poor product, and maybe they'd replace the devices with newer ones.
This should be simple to do, much less effort than making the code try to contact the owner with "hey - change your password" and such.
Would just making the products appear crappy work?
.. loosing the battle
The same story was posted yesterday.
Use the source code to create malware that disables the functionality of the insecure devices. When it becomes apparent that massive numbers of them stop working soon after installation, sales will drop through the floor and that is the only thing that will make manufacturers change their behavior.
My ISP says they will not monitor my traffic without my request or a court order. This is part of their Net Neutrality statement in their TOS. Can't have your cake and eat it to.
I mean, what would happen if you used a strong passphrase?
Some of the Things on Internet (ToIs) would heat up and catch fire, because hashing algorithms on long strings is the straw that breaks the camel's CPU, busy as it is running looping ajax applications and digesting log files for sending to the mothership.
Their security was fine, as long as you changed the default password.
Devices really do need a recovery mechanism from someone losing their password and a hard reset back to a default is fine with me.
That people buy a security camera and then leave it with its default password is the problem.
I built my own using a beagle bone and assorted parts (opto-triacs, P/S and xformer) for under a hundred.
I wouldn't really call it an exploit to try a set of default passwords on telnet connections.
Send in two résumés
>> Their security was fine, as long as you changed the default password.
Sorry, telnet's just not cool in 2016.
>> That people buy a security camera and then leave it with its default password is the problem.
Some manufactures HAVE figured out a better way: a different default password for each device. Any company that still has a single common password for multiple devices these days is asking for a lawsuit.
thats how the ISP i work for operates. As such having this code will be able to better help our customers at the ISP level
have you seen my sig? there are many others like it but none that are the same
...and somehow houses/cars/etc. get doors with unique keys by default.
Their security was fine, as long as you changed the default password.
And, you know, don't connect them directly to the Internet....
My eyes reflect the stars and a smile lights up my face.
Bricking the device negatively impacts the end-user, who frequently has zero control over security flaws in the firmware. Instead, the malware should figure out who the manufacturer is of the device it's infected, then start DDoSing that manufacturer's website. Minimal impact to the end-user, but the manufacturer's problem scales with the number of insecure devices they sell and leave unfixed.
The same reason so few had https in the past, most just want to get their brands out. When all the security comes on one cheap chip, they will up sell that in a few years.
Until then its just getting their brand into each home and online hype about the internet been on their easy to use devices.
Security is a cost to buy on an another chip, a cost to design, to keep cool, test, add, build, then support.
When standards change, a device is stranded with a user looking for their passphrase. The box or some paperwork that was once in the devices packaging.
To the user its the fault of the brand if they have to set anything new up, rather than have instant discovery on any new or old wireless network.
Consumers don't want to keep a box, read a long unique number stuck on some folded paper and have to press 5-20 keys on a keyboard to get a device seeing a network.
Or just ship every device with admin, admin and try and ask the user to enter a stronger password?
Domestic spying is now "Benign Information Gathering"
But they will monitor it for you with your consent? Interesting. I'd pay an extra couple bucks a month for a nicely packaged traffic report (as long as I could manage/delete/etc. some of the capture rules). Sure, I could set up my own proxy, or port mirror to a Splunk box, but that could actually be a service a lot of people would buy into out of sheer convenience. Even moreso if it was tied to their IDS for hueristic analysis of both outbound and inbound traffic.