Slashdot Mirror
Massive Mirai Botnet Hides Its Control Servers On Tor (bleepingcomputer.com)
"Following a failed takedown attempt, changes made to the Mirai malware variant responsible for building one of today's biggest botnets of IoT devices will make it incredibly harder for authorities and security firms to shut it down," reports Bleeping Computer. An anonymous reader writes: Level3 and others" have been very close to taking down one of the biggest Mirai botnets around, the same one that attempted to knock the Internet offline in Liberia, and also hijacked 900,000 routers from German ISP Deutsche Telekom.The botnet narrowly escaped due to the fact that its maintainer, a hacker known as BestBuy, had implemented a domain-generation algorithm to generate random domain names where he hosted his servers.
Currently, to avoid further takedown attempts from similar security firms, BestBuy has started moving the botnet's command and control servers to Tor. "It's all good now. We don't need to pay thousands to ISPs and hosting. All we need is one strong server," the hacker said. "Try to shut down .onion 'domains' over Tor," he boasted, knowing that nobody can.
Currently, to avoid further takedown attempts from similar security firms, BestBuy has started moving the botnet's command and control servers to Tor. "It's all good now. We don't need to pay thousands to ISPs and hosting. All we need is one strong server," the hacker said. "Try to shut down .onion 'domains' over Tor," he boasted, knowing that nobody can.
Something satisfying about that.
The "internet of Things" was a stupid idea, so why not just ban it once and for all? Or create a separate internet just for people who want such stupidity as turning on their lights without getting off the couch. The world would be a better place either way.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
They just have to block Tor traffic.
The IOT is a buzzword. There are many devices compromised by this hack that really do belong on the internet, albeit with additional security. Cameras, routers, etc... this is not only a virus of light bulbs.
Additionally, having command and control servers hiding on TOR is likely a vector to be taken by future bot-nets.
"Try to shut down .onion 'domains' over Tor," he boasted, knowing that nobody can.
Once you find the .onion address, DDOS it.
Of course, that would
* be illegal, unless of course you are the law or have the blessings of the law
* hurt the Tor network itself, which in the short term does more harm than good
This kind of thing should be punishable by death. No, I'm not kidding. Death, or 20 years with no chance of parole.
When one or two dickheads with a botnet can knock an entire country offline, there should be severe repercussions. That's terrorism by any definition.
And worse yet, these things will only get more powerful...how long until the US is seriously plagued by one or more of them fucking up the economy, crippling emergency services and police response, interfering with hospitals, and hampering commerce in general?
Most of you reading this would lose your jobs if the net was crippled for a month or two by one of these fucking botnets, and what happens when 5 or 10 of 50 players, some funded at the state level, all get involved?
Now the death penalty or 20 years hard time doesn't sound so outrageous, does it?
Just cruising through this digital world at 33 1/3 rpm...
It's time for consumer firewalls to be "block all by default" in all directions, not just WAN-to-LAN.
If you want to allow your thermostat to talk to a specific external host then punch a very narrow hole in the firewall to allow it.
Heck, I would go so far as to put everything on the LAN side in its own DMZ. If you want your PC to talk to your media player, punch a specific hole in the firewall.
This will require industry cooperation:
* Protocols will have to be developed so "punching holes in firewalls" becomes super-easy for the consumer
* ISPs will have to start telling customers "if bad things come out of your network, we WILL cut you off. If you use one of these new routers, it's much less likely that bad things will come out of your network."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
*yawn* Its Hockey Night In Canada!
Force all their internet through a proxy that routes everything to goatse for the next 20 years to life.
I can almost hear them screaming:
"My eyes, they burn, kill me now, please kill me now."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Result ? Among others the DMCA. Various individuals were sued into bankruptcy by the music industry, just to show people what the risks were (remember single mother Jammie Thomas ? See: https://en.wikipedia.org/wiki/...) . Some were driven to suicide (see https://en.wikipedia.org/wiki/... ).
What shouty nerds tend to forget is that (like it or not) they are part of a society that can (and does) sets certain limits on their behaviour. Which can be enforced. With or without their consent.
Tor routers can be a force for the good (avoiding censorship, protecting human rights activists, protecting investigative journalists) but they really _can_ be eradicated, given sufficient incentive.
Just outlaw the servers, force ISP's to scan all Internet traffic for TOR servers, log any connections and isolate / report them as soon as they're detected. Send a SWAT team to visit anyone who connects to a TOR server to seize their computers pending investigation. Set penalties sufficiently high to pay for all that and publicly sue a few tens of offenders into bankruptcy.
Should cow 99% of all TOR users, right? The 1% who aren't cowed are probably up to no good anyway.
A bit like China. Not pretty, and people won't like it, but it really can be enforced.
The detection and tracking part is already in place. Just consider the raft of deep-packet inspection routers that has been installed already (see https://en.wikipedia.org/wiki/... ).
I'm not saying I'd like to see something like that (I wouldn't). All I'm saying is that stupid and venal abusers like this a**hole botnet operator make it that much more likely that something like that will occur. Whether we realise it or not. To the detriment of us all.
So, any site that handles email without a "postmaster" or which has a "do-not-reply" address should be booted off the Internet?
The network itself may have a pretty good track record of never totally falling over, but there is no guarantee at any given moment that there will be connectivity where you are, right now. Networks and entire countries can be cut off, and an emergency responder had best assume in a SHTF scenario that data service will be intermittent to completely unavailable. What happened to the radios in the cars? Those won't just stop working (unless it's an EMP attack, but what good is a network connection if all your gear is bricked?) and were the state of the art not that long ago. If they don't want to maintain a radio network in addition to the Internet-reliant communications, then they're going to have to pass out handhelds when it happens. If they aren't keeping any backup plan in place at all, they're complete idiots because this doesn't require buying more gear, it just means maintaining the gear they owned before. (Or someone higher up forced them to do so, for self-serving and/or malicious purposes.)
The internet being unavailable should not be a life-threatening emergency, except possibly to the degree that hospitals will be unable to access patient files who are there for treatment after whatever actually went wrong that day. Even that could be avoided if hospitals all had to mirror the host every so often, but any /. reader will know how incompetent healthcare IT has proven to be.
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
Decades ago some cities had houses with 2 electric meters.
One fed the hot water heater (the kind with a tank) but the power company would turn off the electricity for, say, 15 minutes at a time on a "rolling" basis during peak usage. In exchange, the "hot water heater" electricity rate was lower than the regular rate.
Since hot water stays hot for a long time, you wouldn't notice it unless everyone in your house was taking a long shower at the same time the power was cut.
Oh, and since this was decades ago, it was in a time when the power grid was managed almost completely by "analog" devices, including "analog computers."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
One of my jobs in the past, was crisis potential utilization.
we didn't generate a crisis. But we noted where potential problems existed, then take actions 3 steps removed to influence other pieces to get closer. Say you find a mop closet storing petrol, ether etc. having people work there who are inclined to be lazy & not be thorough or safe is a good start. having it appear as a convenient spot to smoke is a good next step. Whatever happens next, the only real job is to clean up the situation, discredit all people close to the event, then institute sweeping changes, programs, new groups to deal w/ problems.
for the TL; DR; crowd, don't worry about it, everything is fine go back to your food trough & watch more cat videos.
for the rest of us, the title says it all. This will be the opening gambit in a new war. Not the watershed moment, but a very good one for historians to hang their hats on.
It'll potentially help to identify weaknesses in Tor whereas previously it was government contractors doing the code review and keeping its security vulnerabilities to itself. If we have the private security entities that target malware doing the review we have a better chance and finding out about a vulnerability in Tor that may not have otherwise been exposed publicly.
It's illogical to try and shut down Tor. The problem is not Tor. It's crappy security on IoT devices and computers. Anonymity networks are already designed to hide so outlawing them doesn't stop them from existing. At best it just becomes a cat and mouse game with the anonymity networks getting better and better.
We do need to keep funding projects like Tor, i2p, and Freenet. We also need to come up with appliances and use cases for wider adoption. If only the 'bad guys' use Tor then its easy to pick out the activists, governmental adversaries, and persons being persecuted by governments for which Tor is primarily intended. I know people don't like the fact people run file sharing software over Tor or any number of other things. However the argument for it is simple. If we don't do these things then those who need these tools can more easily be identified and targeted. If a Tor user is more likely to be some innocuous user than a person the government is after that government is going to bear less fruit by targeting Tor users.
1) No botnet actually hijacked 900k CPEs of DT, at the moment there are rougly between 10k-40k zyxel ones across the world. The outages were caused by the increased 7547 scan traffic crashing routers of other vendors.
2) Zyxel SOAP RCE probes died down rapidly past 2 weeks. There is still some traffic (wget vizxv.pw/a if you're curious, note that you need actual wget user-agent), but the botnet is relatively small at this point.
3) As for general IoT botnets using telnet, running a simple cowrie honeypot will tell you that C&C method of current largest botnet is not Tor based, but bittorrent DHT based. The codebase appears to be unrelated to mirai, too.
All of the above can be fact checked using pretty simple tools - for TR-069 exploit simply listen with netcat, for telnet/ssh bruteforce use cowrie. Botnet size can be gauged accurately by sampling scan probes (mirai codebase sends 160 probes/s).
No. The internet is not crucial to life and health. And if someone makes it so, then *they* should be put to death. Srsly. 20 years after the internet becomes mainstream and suddenly you want people put to death over it? Give me a break. If it's come to this then we need to cut our dependence.
I guess that was GP's point:
A good example of IoT would be if your household appliances worked in concert with the Electric Company so power generation could match expected usage
So the appliances you mention might be able to respond to "please conserve at these times" messages from the power company.
Or if the washing machine is programmed to run at 4-7am, it can let them know.
My fridge stays cool for a looong time without power, a few hours off is no problem. Unless you want some instant icecube dispenser to work or something.
But if it "knows" in advance when it should conserve power, before that it can run extra cool to bridge the gap, or say "no" to the network.
Perhaps it can make things easier for the power company to deal with supply/demand differences, reducing the need for batteries/fossil to augment renewables.
(PS: not saying all this is a good idea, that's another discussion)
Maybe the guy will turn some of those hacked devices into TOR nodes and actually do some good for the world.
See subject - Blocking communication w/ it's C&C servers:
HARDCODED INTERNAL TO BOTNET CODE:
0.0.0.0 zugzwang.me
0.0.0.0 tr069.online
0.0.0.0 tr069.tech
0.0.0.0 tr069.support
DGA GENERATED:
0.0.0.0 vmdefmnsndoj.tech
0.0.0.0 xpknpxmywqsr.tech
0.0.0.0 lvfjcwwobycj.tech
0.0.0.0 nympompksmfx.tech
0.0.0.0 kedbuffigfjs.online
0.0.0.0 bwhrdaumwuvn.online
0.0.0.0 bpmsfckfkrpr.online
0.0.0.0 oornduuwjli.tech
0.0.0.0 qjqubpciajoc.tech
0.0.0.0 exvdaajegjur.online
0.0.0.0 poorcetnmjfc.online
0.0.0.0 vtrndmhsgada.online
* BOTNET NO LONGER USES DGA THOUGH
"the DGA feature had been removed" FROM https://www.bleepingcomputer.com/news/security/security-firms-almost-brought-down-massive-mirai-botnet/
(TOR DOMAINS != LISTED BUT CAN BE BLOCKED ONCE DETERMINED)
APK
P.S.=> For the best custom hosts file creator? APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ ... apk
These entries in your custom hosts file also block more MIRAI botnet C&C servers (+ other communications parts):
0.0.0.0 timeserver.host
0.0.0.0 securityupdates.us
0.0.0.0 srrys.pw
0.0.0.0 l.ocalhost.host
0.0.0.0 tr069.pw
0.0.0.0 mziep.pw
* FROM - https://securelist.com/blog/incidents/76791/new-wave-of-mirai-attacking-home-routers/
APK
P.S.=> That's in addition to my original post's list of C&C servers MIRAI botnet utilizes here https://it.slashdot.org/comments.pl?sid=10009063&cid=53507971/ ... apk
I have them determined & blocked in my custom hosts file for ZEUS variants just as I have blocked MIRAI's current crop of C&C servers hardcoded + other networked systems it uses here https://it.slashdot.org/comments.pl?sid=10009063&cid=53507971/ & here https://it.slashdot.org/comments.pl?sid=10009063&cid=53508081/ so I am awaiting the .onion TOR domains to block once they're determined - as is, I've got this thing corralled & nullified via hosts files usage.
APK
P.S.=> Use of .onion by this "bestbuy" GOOF (anyone doing botnet crap's an a-hole imo) isn't what he says it is quoted "Try to shut down .onion 'domains' over Tor," BestBuy boasted FROM https://www.bleepingcomputer.com/news/security/security-firms-almost-brought-down-massive-mirai-botnet// BECAUSE YOU'RE CORRECT & THOSE .onion DOMAINS GET REVEALED JUST LIKE ANY OTHER C&C + OTHER NETWORKED PARTS ALWAYS DO - hosts block them easily! apk
Please get at least basic facts right in stories: It crashed these routers, but it did not get in, as the vulnerability exploited was not present. A DoS vulnerability remained unfortunately, and the port the service was running on was globally reachable. Bad, but not nearly as bad as being vulnerable to "hijacking".
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Indeed. Tor is not the problem here. Anybody running a bot-net can already implement command-insertion in such a way that a command can be sent to any member-note and then gets distributed. That is basically untraceable if cover-traffic is also added. It takes a tiny bit more effort in implementing this though.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Simply requires the cooperation of all ISP's. Law enforcement and spies have fought tooth and nail to maintain their right to collect "meta data". Nothing is more meta than identifying which two parties are talking to each other.
No matter what kind of encryption used you can characterize streams by various types of signature. Second ISP's could be compelled to implement IP packet tracking at the protocol level to pad something like a serial number to every stream but strip it out before delivery. Finally one can also always introduce lag.
So to track who is talking to any server you characterize the stream. Then through a command and control server of their own introduce various inconspicuous amounts of lag at all ISP's for all the streams that match the characterization signature. Add in a binary search and you can track any connection back to it's source in under a minute. It also can also identify all proxies within it's borders and the order they are used according to the lag propagation. Even using a neighbors WIFI will not necessarily hide you.