Slashdot Mirror
How Vigilante Hackers Could Stop the Internet of Things Botnet (vice.com)
An anonymous reader quotes a report from Motherboard: Some have put forth a perhaps desperate -- and certainly illegal -- solution to stop massive internet outages, like the one on Friday, from happening: Have white-hat vigilante hackers take over the insecure Internet of Things that the Mirai malware targets and take them away from the criminals. Several hackers and security researchers agree that taking over the zombies in the Mirai botnet would be relatively easy. After all, if the "bad guys" Mirai can do it, a "good guys" Mirai -- perhaps even controlled by the FBI -- could do the same. The biggest technical hurdle to this plan, as F-Secure chief research officer Mikko Hypponen put it, is that once it infects a device, Mirai "closes the barn door behind it." Mirai spreads by scanning the internet for devices that have the old-fashioned remote access telnet protocol enabled and have easy to guess passwords such as "123456" or "passwords." Then, once it infects them, it disables telnet access, theoretically stopping others from doing the same. The good news is that the code that controls this function actually doesn't at times work very well, according to Darren Martyn, a security researcher who has been analyzing the malware and who said he's seen some infected devices that still have telnet enabled and thus can be hacked again. Also, Mirai disappears once an infected device is rebooted, which likely happens often as owners of infected cameras and DVRs try to fix their devices that suddenly have their bandwidth saturated. The bad news is that the Mirai spreads so fast that a rebooted, clean, device gets re-infected in five minutes, according to the estimates of researchers who've been tracking the botnets. So a vigilante hacker has a small window before the bad guys come back. The other problem is what a do-gooder hacker could do once they took over the botnet. The options are: brick the devices, making them completely unusable; change the default passwords, locking out even their legitimate owners; or try to fix their firmware to make them more resistant to future hack attempts, and also still perfectly functioning. The real challenge of this whole scenario, however, is that despite being for good, this is still illegal. "No one has any real motivation to do so. Anyone with the desire to do so, is probably afraid of the potential jail time. Anyone not afraid of the potential jail time...can think of better uses for the devices," Martyn told Motherboard, referring to criminals who can monetize the Mirai botnet.
Re: "Anyone with the desire to do so, is probably afraid of the potential jail time."
Transfer the responsibility back to where it belongs, the manufacturers and vendors. Make them liable if they do not start patching their own devices. The cost of their devices might go up a little but that's their issue, regardless.
This problem is like pollution. It's pollution of the Internet and the device manufacturers are the root cause. The purchasers of the products might have some secondary responsibility, but we need to be careful what we ask of the consumer. Many consumers aren't very tech savvy and they will never, in most cases, become so. These IoT devices are mostly sold as plug-and-play devices. They need to stay that way.
If the problem is pollution of the Internet then we need a rule, or even a law: Polluter Pays. The polluter is responsible for the pollution and thus liability accrues to them. Since they are the manufacturer they need not be concerned about going to jail for patching their devices. We might need to make them concerned about going to jail for not patching their devices though.
The other problem is what a do-gooder hacker could do once they took over the botnet. The options are: brick the devices, making them completely unusable; change the default passwords, locking out even their legitimate owners; or try to fix their firmware to make them more resistant to future hack attempts, and also still perfectly functioning.
I say brick them. Perhaps when bad security starts costing ordinary people time and money, they'll take it more seriously.
Why not take a more amusing spin on this idea: Tell all the nodes in the botnet to attack 192.168.0.0/16. Basically, have them attack their own local network.
Then change the telnet password.
Convert them to BitCoin mining operations and PROFIT! Yea.....
Oh, wait....
Sarcasm aside... As the fine article points out, hacking someone else's device, regardless of the reason, is not a legal activity. And as my mother always said "two wrongs don't make a right" applies here. Where this is an interesting thought experiment, unless you can get the legal authorities to approve this kind of activity, let's not develop this idea too far. Perhaps you'd get by with a way to remove the affliction and reboot the device, they are likely to never find you, it would be all to easy to get your hat color misinterpreted should ISP's start monitoring this kind of thing.
Perhaps it's time to put some legal safeguards in place for users to force device manufacturers into having liability when they ship stuff with gaping holes like this. But I'm not going to hold my breath waiting for Congress to draft and pass anything reasonable in this regard and I loath that they would likely make a bloody mess of things if they even tried. Maybe some kind of regulation on ISP's to monitor and deal with such garbage coming from their networks? Again, I wouldn't trust Congress to write that law either.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
The other problem is what a do-gooder hacker could do once they took over the botnet. The options are: brick the devices, making them completely unusable; change the default passwords, locking out even their legitimate owners; or try to fix their firmware to make them more resistant to future hack attempts, and also still perfectly functioning.
I say brick them. Perhaps when bad security starts costing ordinary people time and money, they'll take it more seriously.
If I understand the process correctly, most hacked IoT devices aren't firmware hacked, the exploits live in volatile memory while the device is powered. The exploit can't get into the firmware because that's much more difficult, and in many cases the firmware is read-only.
Power cycling the device will clear the hack, but it can be taken over again using the same exploit.
Bricking the device, or perhaps making the device access an online site intended to catch the owner's attention(*) seems like a reasonable solution when used in concert with all the other solutions - going after the perpetrators legally, going after the device manufacturers, changing net rules to disallow IP address spoofing, and so on.
(*) Lead to a website with a landing page alerting the owner of the issue, or (for cameras) upload video to the user's account alerting the owner to the issue, and so on.
How about write a few bytes of junk to every block file found under /dev then reboot, if you've left it internet exposed with admin/admin as the creds you deserve nothing less than a bricked device.
Where have I heard of hackers with Chaotic Good before?
Blaster's worst enemy
Two wrongs don't make a right.
What we need is to grasp the careless morons that made those devices by the balls and squeeze 'til patches materialize.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If they have access to the internet, couldn't manufacturers setup an API endpoint that accepts a serial number and a password... so that the password could be changed and the manufacturer could be sent the new one?
The owner, when locked out, can call the manufacturer, they can look up the password, etc.
Not totally sure how one might secure said API so it doesn't just get spammed as well, but... :P
I wondered when this was going to come up. It totally reminds me of this short story.
If you think the FBI are "good guys" who don't violate the law you haven't been paying attention since it was founded. Hoover (who was actually around when the FBI was just the BI) was only the head of the FBI for so long because he kept blackmail files on anyone of improtance.
"a "good guys" Mirai -- perhaps even controlled by the FBI -- could do the same."
I think I see a flaw here....
Much easier to have ISP's run an automated white-hat type scan against new devices the first time a home user attempts to connect one to the Internet. This device "registration" process would look for open telnet, insecure hard coded passwords, etc. Failing devices would be blackballed and confined behind the home router. The ISP could generate a report for the user suggesting corrective action, etc. to fix the offending device. Not perfect, but it would reduce the footprint of low-hanging IoT devices.
Botnet infection software typically patches the vulnerability it exploits to infect any given device. This is due to botnet operators attempting to block their competitors from stealing away bots they have already pwned. This can actually work against the botnet operators since any device known to be exploitable that cannot be exploited has likely already been pwned and should be blacklisted.A truly sophisticated attacker would patch the vulnerability they exploited while mascarading as still being vulnerable. Unless you have a fresh 0-day exploit to get root on the devices you wish to patch you are likely wasting your time.
Is criminal negligence for profit. Jail.
...they wait and hope for the good people to clean up their mess.
I'd like to see one admission of responsibility from manufacturers, who made all this possible by designing the flimsiest security features possible on their devices (a common default password for all devices ? Seriously ?). They created the mess, and are now trying to stay out of the spotlight by nominating other people to clean it up, for free might I add.
Manufacturers made a lot of profits by skimping on security costs (thanks to cheaper processes, hardware and technical support). In short, they made a lot of profits by endangering their customers' and other Internet users' privacy. And now, God forbid they do something with those profits to help with the situation they created.
Will this be exactly the same as the 2008 bailout ? Will the people pay the price while the responsible parties once again walk away richer ? I hope not, but I've come to expect little from this society.
And I think we should make that something globally legal. Put in some safeguards, like a 48h observation period and a requirement to record logs and upload them with your identity to some legal entity that a device owner can then find out from what happened (but not who did it).
But if that is all fulfilled, make it legal for anyone to secure the hazard presented by these devices. After all, you are allowed, say, to put out a fire by yourself too.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This is an over-simplified article from a misinformed journalist You can't "protect" routers with malware because the "protective" malware will be wiped out when the router is restarted, along with the malicious malware. Only firmware patches can protect devices #vice
Welcome to the IoT connected Doorlock! With this fantastic device, you will be able to unlock your door from anywhere in the world, including (wait for it) at the doorlock!
This amazing, feature rich, inventor tested technology has been proven 1% secure against the most well intentioned script kiddies out there. By using a simple Telnet session and a 1995 version of the BBS software "Remote Access," these kiddies can gain remote access to your front door. Amazing! All this convenience for the rock bottom price of $200 per lock. Act now, because convenience always sells better than security.
There is no reason to keep a default password on something that connects to the internet, and excuses cause problems for others. I say brick the device or sabotage its internet connectivity.
What worked for me was:
hxxps://slashdot.org/ajax.pl?op=nel
Just cruising through this digital world at 33 1/3 rpm...
There are changes that can be made that make them useless as a botnet without impacting the hardware owner.
How about random wait times in the communication that make DDOS a trickle not a roar?
How about tell a security site when someone scans them with a bad password, or patches them, so the owner of Mirai can be tracked?
How about a counter-botnet for tracking Mirai during floods, like receiving bad IP's and flooding them - make it eat itself.
There are 100 things that could be done to the firmware besides "bricking" the device.
"Yes, you are accusing me of being a hacker, but really I'm the good guy trying to stop all those bad hackers! See my permission letter from the NSA! No, these credit card numbers on my system are just monitoring of some other *bad* operator who was stealing them."
OK, next stupid idea. I much prefer the notion of requiring a backdoor brick code that authorized law enforcement may utilize on any device determined to be engaged in illegal activity. That is also a stupid idea, but it is better than this one from the ivory tower.
So having lots of easily accessible hosts to use yourself, for example as a http redirect maze or an ever-changing lattice of encrypted tunnels or what else your imagination can output is.. bad?
Y'all crazy if you can not see the value of a free, distributed and unreliable/unmaintainable infrastructure.
Just have a Democrat do it. Everybody knows THEY don't have to fear jail time!
I for one am VERY glad to see ANY sort of suggested solution to this huge problem. I've always had the motto, "Don't bitch unless you have a solution." I had no solution (other than "sue the careless hardware vendors until they fix it", and that's no solution at all), so I just kept quiet. But this is a good one. Liability be damned: white hats, go for it! Brick them sons of bitches!
Alternatively, force a second "Internet Of Things" Internet, used ONLY by inhuman devices. If you want to talk to your goddamned front door lock, use THAT Internet. Stay the hell off mine: I need it for WoW!
Anyone who wants to use the Internet for their own normal uses would be motivated to mount such an "attack"... if you fix the IoT, it means that the Internet will actually work if you don't fix the IoT, the Internet is pretty much doomed.
I'd say that's motivation not only for white hats to get involved, but also for politicians to revise the laws governing this sort of thing, and voters to support such changes.
From CyberScoop: https://www.cyberscoop.com/mirai-botnet-for-sale-ddos-dark-web/
So why not just turn this thing on the Alpha Marketplace itself? Isn't the "dark web" just as vulnerable to attack?
"white-hat vigilante" is an oxymornon. How about "the 16,000psi vacuum at the bottom of the ocean".