Slashdot Mirror
New, More-Powerful IoT Botnet Infects 3,500 Devices In 5 Days (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: There's a new, more powerful Internet-of-things botnet in town, and it has managed to infect almost 3,500 devices in just five days, according to a recently published report. Linux/IRCTelnet, as the underlying malware has been named, borrows code from several existing malicious IoT applications. Most notably, it lifts entire sections of source code from Aidra, one of the earliest known IoT bot packages. Aidra was discovered infecting more than 30,000 embedded Linux devices in an audacious and ethically questionable research project that infected more than 420,000 Internet-connected devices in an attempt to measure the security of the global network. As reported by the anonymous researcher, Aidra forced infected devices to carry out a variety of distributed denial-of-service attacks but worked on a limited number of devices. Linux/IRCTelnet also borrows telnet-scanning logic from a newer IoT bot known as Bashlight. It further lifts a list of some 60 widely used username-password combinations built into Mirai, a different IoT bot app whose source code was recently published on the Internet. It goes on to add code for attacking sites that run the next-generation Internet protocol known as IPv6. The best-of-breed approach "is driving a high infection speed of Linux/IRCTelnet (new Aidra) so it can [infect] almost 3,500 bot clients within only five days from the moment its loader was first detected," a researcher who goes by the handle Unixfreakjp wrote in a blog post reporting on the new malware. "To incarnate a legendary botnet code into a new version that can [target] the recent vulnerable threat landscape is really inviting more bad news."
Whoever decided putting devices without sufficient resources to defend themselves, or be updated, directly onto the Internet was a good idea should have his professional certifications revoked and forbidden to administer anything more complicated than his own home network. And that home should probably be denied connectivity to the world.
The IoT is not necessarily a bad idea in concept, but it has been implemented exceptionally poorly, and those devices that cannot be updated need to be disconnected forever, or at least hidden on their own private networks. Vendors who cannot or will not patch their devices should be compelled to recall them, as violations of Part 15 rules against causing harmful interference.
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
And that, folks, is what IOT gets you
Notice that you don't see Windows 10 botnets causing these problems. It's always Linux.
Google "exponential growth" and come back after you've read up on it.
I've noticed an enormous increase in telnet scans being performed on our networks recently. Infected devices are used to scan for more vulnerable devices to infect. If you telnet to the ip address of the probing device you will often find they are wireless routers or cameras and can be logged in with a default password. On ones with a ps command you can see what appears to be randomly named processes running. I think the blame can be shared between most device manufacturers and consumers for both having poor security practices.
We need a team of grey hats who weaponize these IoT security flaws. There's no way you can win the IoT security battle through publicity or conferences. I assure you the chinese crapola seller isn't going to issue a security patch.
Instead, we need the grey hats to find these IoT flaws and then brick all IoT devices that they can find. Just make it a standing rule -- insecure IoT? Bricked! This would make many OEMs pay attention to security, and for those who still don't, at least their products will be off the web.
Where can we enlist these hackers?
We all know IoT devices have absolutely no security, we've known this for months. Yet the uninformed keep buying them (despite the "NEW AT 11 OCLOCK!!! HACKERS TAKE OVER YOUR BABY CAM" every few weeks). The uninformed can't be bothered to change the default password, even after watching the abovementioned news flash. The uninformed considered a day or three of crappy internet as "hmmm, must be hackers somewhere. But not in my neighborhood".
We need to put a tax on the stupid/lazy. Either fine the fuck out of the vendors of these things when they get compromised (won't happen), or fine the fuck out of idiots who leave these things in the default mode and get hacked (won't happen). Until one of those 2 things happen things will get worse.
They need to have their *COMPLETE* build environment for the firmware image to their device's source code released. Should an updated version of the source code ALSO fail security testing, all proprietary components of the system should in turn have their source code/firmware code documented and released. Should the auditing/repair of THOSE fail, then the device should be recalled at the manufacturer's expense, and/or the manufacturer permanently banned from the enforcing countries markets.
The reason situation/issue here is that GPL'd software has been heavily abused for *YEARS* now in embedded markets without the required level of source code disclosure. A secondary, but no less troublesome issue is the level of obfuscation/encryption in modern hardware designs disallowing owners of devices from being able to reimage those devices to repair them either with binary patches to existing firmware images, or in the case of linux based devices, the ability to rebuild a complete image to the same checksums used by the originals and thus be able to audit both an original image with security issues, as well as a replacement image with those issues patched. The usage of telnet, unencrypted http, and outbound internet connections (especially for 'cloud devices' where the services are often up for only a short time and insecure themselves) is a major issue even on a LAN today, and is certainly untrustworthy for use on an internet facing device, where 40+ nation's governments may be performing DPS on the resulting unencrypted stream.
It's bitztream, the autism-hating, custom EpiPen-hating Slashdot troll!
I get that
No you didn't - you specifically had to be told.
It's bitztream, the autism-hating Slashdot troll!
If I would wear a tin-foil hat, then I'd suggest that Asia is carpet bombing the Western digital world. The difference being that no lives are being taken (yet), no physical damage occurs (yet) and no bomber planes are flying. Oh, and contrary to physical warfare, WE ARE PAYING for our own bombs. Small amounts each time,but we buy the cr*p that comes out of Asia.
I'm not wearing a tin-foil hat, but still I wonder if the cr*ppy firmware and spreading of so many exploitable devices isn't just part of the plan.
To Terminate, or not to Terminate, that's the question - SCSIROB
Are these things making uPnP requests? Or are people actually putting them up with no firewalling? Or are people's PCs getting owned and being used to spread malware behind their firewall? What's the actual vector for people to make connections to these IoT devices? It boggles my mind to think that there are still people out there without firewalls. They cost basically nothing, especially if you don't expect to converge them with an access point.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
danger to the internet. If you can infect them then brick them.