Slashdot Mirror
A Sophisticated Grey Hat Vigilante Protects Insecure IoT Devices (arstechnica.com)
Ars Technica reports on Hajime, a sophisticated "vigilante botnet that infects IoT devices before blackhats can hijack them."
Once Hajime infects an Internet-connected camera, DVR, and other Internet-of-things device, the malware blocks access to four ports known to be the most widely used vectors for infecting IoT devices. It also displays a cryptographically signed message on infected device terminals that describes its creator as "just a white hat, securing some systems." But unlike the bare-bones functionality found in Mirai, Hajime is a full-featured package that gives the botnet reliability, stealth, and reliance that's largely unparalleled in the IoT landscape...
Hajime doesn't rashly cycle through a preset list of the most commonly used user name-password combinations when trying to hijack a vulnerable device. Instead, it parses information displayed on the login screen to identify the device manufacturer and then tries combinations the manufacturer uses by default... Also, in stark contrast to Mirai and its blackhat botnet competitors, Hajime goes to great lengths to maintain resiliency. It uses a BitTorrent-based peer-to-peer network to issue commands and updates. It also encrypts node-to-node communications. The encryption and decentralized design make Hajime more resistant to takedowns by ISPs and Internet backbone providers.
Pascal Geenens, a researcher at security firm Radware, watched the botnet attempt 14,348 hijacks from 12,000 unique IP addresses around the world, and says "If Hajime is a glimpse into what the future of IoT botnets looks like, I certainly hope the IoT industry gets its act together and starts seriously considering securing existing and new products. If not, our connected hopes and futures might depend on...grey hat vigilantes to purge the threat the hard way."
And long-time Slashdot reader The_Other_Kelly asks a good question. "While those with the ability and time can roll their own solutions, what off-the-shelf home security products are there, for non-technical people to use to protect their home/IoT networks?"
Hajime doesn't rashly cycle through a preset list of the most commonly used user name-password combinations when trying to hijack a vulnerable device. Instead, it parses information displayed on the login screen to identify the device manufacturer and then tries combinations the manufacturer uses by default... Also, in stark contrast to Mirai and its blackhat botnet competitors, Hajime goes to great lengths to maintain resiliency. It uses a BitTorrent-based peer-to-peer network to issue commands and updates. It also encrypts node-to-node communications. The encryption and decentralized design make Hajime more resistant to takedowns by ISPs and Internet backbone providers.
Pascal Geenens, a researcher at security firm Radware, watched the botnet attempt 14,348 hijacks from 12,000 unique IP addresses around the world, and says "If Hajime is a glimpse into what the future of IoT botnets looks like, I certainly hope the IoT industry gets its act together and starts seriously considering securing existing and new products. If not, our connected hopes and futures might depend on...grey hat vigilantes to purge the threat the hard way."
And long-time Slashdot reader The_Other_Kelly asks a good question. "While those with the ability and time can roll their own solutions, what off-the-shelf home security products are there, for non-technical people to use to protect their home/IoT networks?"
While those with the ability and time can roll their own solutions, what off-the-shelf home security products are there, for non-technical people to use to protect their home/IoT networks?
A hammer.
Hajime prevents these devices from being taken down. Instead it adds them to a botnet under the control of someone we don't know. Just because they say they're whitehat doesn't mean they are, and none of their behavior actually supports that claim. They attack other people's systems, instate defenses to maintain the ill-gotten control and use the devices to attack more devices, all without a public mandate. That's black hat.
... but the comments, so far, are not of value to those who want some red meat.
"While those with the ability and time can roll their own solutions, what off-the-shelf home security products are there, for non-technical people to use to protect their home/IoT networks?"
I gotta think of everything?
Hire this genius to make blister-pak retail-ready solutions available to everyone.
Inject the goddam thing by remote to protect it.
There's gold in them thar hills, I tell yun.
It little behooves the best of us to comment on the rest of us.
Both "non-technical people" amd "home networks" combined make that a tough one. A business full of non-technical people, or just people who don't specialize in security, can use a "experts included" solutions from companies like Alert Logic, but that's probably not reasonable for a home network.
A typical home network can be made noticeably more secure from these kinds of attacks by simply turning off UPnP on the router, though. Without UPnP, by default devices on the network can't be accessed from outside, from the internet. The standard router configuration using overloaded NAT (aka PAT) has the side effect of acting like a strict firewall. It's not an enterprise-grade firewall, just a simple packet filter, but it does prevent incoming connections / attacks, except for any port-forwards that are manually configured.
Other than disabling UPnP, the other main thing I can think of is keeping software and firmware up to date, at least for security patches. Devices running old versions are the low-hanging fruit for bad guys. The new software might have new security holes that nobody knows about, but the old version definitely has security holes that everybody knows about, and the bad guy and just run a script to automatically exploit those vulnerabilities.
Sorry I don't have better answers right now. The lack of good answers is why Australia is looking at having the ISP take care of some protection. The ISP can see trends across the whole network, and more importantly they can spend a few thousand dollars per month to contract with companies like Cisco TALOS and Alert Logic to deploy and monitor sophisticated, modern security systems. Yeah that brings up privacy issues, so there is no great solution that I can see.
He's not protecting devices. He's compromising them.
He's exploiting a machine, to make it do what he wants it to do. Maybe most of us agree with why (stupid unsecured devices) but he's still exploiting it.
He's not a "greyhat" he's a blackhat (or a script kiddy, depending on how you look at it). He's making peoples computers do things they never agreed was acceptable to them.
Vigilante justice. Lets not celebrate this person.
I suppose this might be a better solution than brickerbot, if people just replace their bricked IoT gadget with another insecure IoT gadget.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
What have I done better? I went out and bought a Commodore 64 to use instead!
Saw a trend in the comments and I had to run with it with my first computer. :-P
Also, most tcpip stack implementations lack the presence of hosts in their implementation. In VB 6, one can use hosts.dll to prevent that. Also to circumvent any issues nevertheless, handy is a gidney pig host file that piggies back on the VB 6 udp layer kernel stack.
Coupled with the speed of kernel lookups inherent to the special host module built-into every OS, this sure stops electricity wastes and cuts down on your power bill.
Even more; since one would then get less irradiated by electromagnetic waves generated by the extra current used by not using hosts countermeasures, your family will reproduce more given the fact that in-kernel mode always prevail.
Everything I write is lies, read between the lines.
The problem with this solution is that the companies are not getting the negative financial feedback (punishment) that they need to correct their behavior.
I've said it before but it's worth repeating.
IoT vendors will only secure their devices after it starts costing them money or are legally required to do so.
The best option is to hijack the IoT devices to DDoS their makers because it creates a direct feedback loop. The more insecure devices they sell, the more it will cost them to host their company's website(s). For extra points, only target their parent company. ;)
Anons need not reply. Questions end with a question mark.
Most OS use mostly standard almost bone stock BSD derived IP stack. Linux, MacOS X, Windows (as admin it can do more than non admin users like raw sockets) do....
I agree, very clever.
But nowadays, if you Intel cpu has the special and very powerful vmx flag you can use raw sockets as a regular user process.
This open great opportunities with regards to in-kernel mode lookups and power efficiency of host only based lookups..
Everything I write is lies, read between the lines.
Apk made his engine. People like and use it.
The 3 users like it very much!
APK
P.S. - I suck cocks.
Every village needs an idiot.
Ezekiel 23:20
APK you're a dumb fuck talking about yourself at the third person.
Apk made his engine. People like and use it.
The 3 users like it very much!
APK
P.S. - I suck cocks.
Don't their talons cut-up your face?
I agree hosts lists like this are useful protection. However, they are unfortunately off-topic for this discussion. Hosts lists are used only by the more techncalliy knowledgeable users. Insecure IoT devices are more commonly used by the _less_ techncalliy knowledgeable users. Someone who knows enough to use a host list, probably also knows enough to change default passwords and disable UPnP.
However, such regulation is unlikely to happen. It is cheaper for these companies to quickly churn out 10,000,000 insecure IoT devices with minimal testing, and then use some of the profit to buy a politician. There is too much profit in being first to market.
Sorry mate, HOSTS won't help you against inbound attackers. It can only prevent the computer possessing the HOSTS file from resolving DNS names in the list. Not saying your concept isn't a good one, just that it's not particularly useful for securing IoT devices, which is what makes it largely off-topic in this thread.
What is an IoT device, exactly? My conception is stuff like cameras and connected toasters, but in TFA the only device maker mentioned is MicroTik, who do routers and APs. Most articles like this are similarly fuzzy on what exactly they are talking about.
Use a video server like Blue Iris or a home automation gateway like Vera to provide a single T on the I for your remote viewing needs.
Use vera/homeseer/ISY for your home automation. Now you have at most 2 Ts on the I to worry about.
I have almost 2 dozen HA devices (locks, power outlets, switches, bulbs, thermostat, sensors) and only 2 IP addressable devices.
I've been on slashdot so long I'm starting to get out of touch with the cool stuff if it ain't on slashdot.
If they are grossly negligent, they already ARE liable.
The question is, who was hurt and by how much? They are liable *to somebody* for *some* amount of money. That's the hard part.
I'm curious - how/why do IOT devices have sufficient memory to support communications protocols/addresses, a bittorrent-based client, etc.?
I am not a number - I am a free man!
Agreed, insurance companies are really good at analyzing and mitigating risk. Insurance companies created the fire code and Underwriters Laboratories to reduce fire risk. If you don't meet fire code and UL your insurance rates are much higher, so businesses make and buy UL approved stuff. That hints at general approaches which may work well for information security, and specifically at *enforcement* - insurance companies look at a property before they underwrite a multi-million dollar policy, and require regular inspections.
That's good as far as it goes. Insurance companies are concerned with damages they'll have to pay, though. When a company builds or markets a product that has a vulnerability, how much do they or their insurance company need to pay, and who do they need to pay? They have to pay the people who had damages as a result, and pay enough to correct the damage. That's the general law. It's very difficult to know who was hurt by a security vulnerability in an IoT device, amd how much each was hurt.
Even to the extent you can figure out who was hurt and how much damage there is, each consumer who was actually affected might be entitled to $100 - hardly worth filing suit over. Our current best answer there is class action suits. Not exactly a great answer.
Figure out why it needs to be on the internet in the first place.
Your hair look like poop, Bob! - Wanker.
Insurance companies also created the IIHS, Insurance Institute for Highway Safety. In twenty years they've compelled the automakers to go from cars that have a high likelihood of killing their occupants in moderate-speed collisions and cars that are extremely expensive to repair in 5mph collisions to cars that will do a much better job of protecting their occupants in even fairly high-speed collisions and are generally reasonable to fix if involved in 5mph collisions. It took a combination of embarrassing automakers by showing how badly their cars handled realistic collisions to the public and using the collected data to change insurance rates, but ultimately it has worked.
Unfortunately it'll probably take court precedent to demonstrate that insurance payout is the correct remedy in order to compel the situation to change. That means initial court cases will have to be fought the hard way to show that the entity's insurance really is liable.
Do not look into laser with remaining eye.
Stay the fuck out of this conversation, adults are talking.
Using hosts and inbound exploiting are completely different. How will you know that after i infect you my dns will be in your hosts list? I run private DNS and change frequently. I also Repack and encrypt my payload weekly. How do you know what im using today? You dont. Only massive Honeypot farms can be even close behind a prevention method like this(think top notch AV company) and even they cant keep somebody who does what im saying from infecting short of completely closing access to said exploit. and sometimes thats easier said than done.
This AC aint that dim. Knows his way around a keyboard.
Imitation? You might want to look up the meaning as you don't seem to know what it means. You did not come up with the idea of a hosts file. You are not the first to use the hosts file. You are not even the first person to aggregate block lists into a single block list. You've made nothing original. You made a Windows list aggregator. That is all. If anything, you've flattered the thousands who've made scripts to do this already.
Are you fucking nuts? Embedded devices don't have the processing power or memory to have 60k line hosts files. Jesus Christ, you are fucking deaf and dumb. If you fairly promoted the pros and cons of the hosts file method, most people wouldn't care about your spam. But you are frequently, at best misleading, at worst, outright WRONG. You never respond to valid technical concerns, just spam with people's comments about using your application; like we give a fuck what joe fucking nobody said in a comment without context/review. Stop fucking spamming. /. , please get an ignore option.
Elitist! VIC 20 should be good enough for everyone ...
(R)ule in Hell or (S)erve in Heaven [R]?