Slashdot Mirror
Author of BrickerBot Malware Retires, Says He Bricked 10 Million IoT Devices (bleepingcomputer.com)
An anonymous reader writes: The author of BrickerBot -- the malware that bricks IoT devices -- has announced his retirement in an email to Bleeping Computer, also claiming to have bricked over 10 million devices since he started the "Internet Chemotherapy" project in November 2016. Similar to the authors of the Mirai malware, the BrickerBot developer dumped his malware's source code online, allowing other crooks to profit from his code. The code is said to contain at least one zero-day. In a farewell message left on hundreds of hacked routers, the BrickerBot author also published a list of incidents (ISP downtimes) he caused, while also admitting he is likely to have drawn the attention of law enforcement agencies. "There's also only so long that I can keep doing something like this before the government types are able to correlate my likely network routes (I have already been active for far too long to remain safe). For a while now my worst-case scenario hasn't been going to jail, but simply vanishing in the middle of the night as soon as some unpleasant government figures out who I am," the hacker said.
"And thanks for all the fish!" Reports say were his final words.
it's only about 456 years.
so he was bricking IOT devices just to warn people of a potential threat of their IOT devices being bricked. Apparently logic isn't his strong point.
Oh, sort of like how creimer still posts despite being at -1, universally mocked, and not wanted here?
For a while now my worst-case scenario hasn't been going to jail, but simply vanishing in the middle of the night as soon as some unpleasant government figures out who I am," the hacker said.
It's 2017, FFS. In the West, that insane drivel stopped the day W left office, and is Putin going to throw you in the Gulag, or have a show trial, and the throw you in (a very nasty, but public) prison.
"I don't know, therefore Aliens" Wafflebox1
He disabled insecure devices before they could be taken over as part of a botnet.
Screw jail. This guy needs to be drawn and quartered.
Nonsense. Having guys like him probing our infrastructure is a lot better than leaving the holes wide open for Putin and Xi Jingping. He is providing a public service. It may not be pleasant when you get pwned, but flu shots aren't pleasant either.
He was doing more than probing. Anyone who thinks this bottom feeder was performing a public service is an idiot. And this guy will probably find out the retiring doesn't mean law enforcement will stop looking for him. And implying he would be "disappeared" is indicative of his warped view of reality. How many people have been "disappeared" for hacking? This guy, and people like him, are also responsible for giving law enforcement the political support needed to attach harsher penalties for these types of crimes.
(1) He's destroying devices that destroy privacy in themselves ... open Telnet ports
(2) He's destroying devices that are insecure by design
Not crying for the owners of this junk. He's indeed doing the Internet a service...
This guy is my hero.
Times 10 million devices. A billion dollar lawsuit filed against an individual might break some records.
And no, I'm not playing anything. Just noting something hypothetical here. Personally I want to see every buggy piece of shit IoT removed from the Internet. They can go start their own garbage network to run their shitbox hardware on.
“Common sense is not so common.” — Voltaire
He was doing more than probing. Anyone who thinks this bottom feeder was performing a public service is an idiot.
I think he should get a gold medal for each bricked device. He deserves it.
Wow, .759 people! That's pretty cool. What happened to the .241 of them?
I don't know how you did your basic arithmetic, but ((10,000,000 / 60 ) / 24 ) / 365 is 19 years only not 456.
It would have been better if his mother covered his face with a pillow when he was born...
10 million IoT which is an addition to 44 million metric tons of e-waste reported yesterday. Would've been better if he just patched thosed routers directly by closing those open telnet ports and ssh ports which were wide open to the internet.
Give this man a fucking prize.
Seriously, IoT devices should come with goddamn warning labels.
This device in known to the surgeon-general of cyberspace to pose a serous risk to your personal privacy, and the personal privacy of those around you. This device may also cause undesired network traffic, communicate with unauthorized systems, and promote the spread of malware to other network connected devices.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
I guess those fractions represent missing arms, legs and other appendages.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
sorry.... did he fuck up you bot-net?
... finally gets a job.
Just the second period would be enough, we're not that dense.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
Clearly missing the / 24 part.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
"Infrastructure" Scary Russians and Chinese.... LOL. Meme day on /.?
I would have written it as 9.786.759,0 with the ,0 there to indicate to dumb-ass Americans they are not the only people in the world.
Says the one mindlessly clutching to the losing convention for historical accuracy? tradition? feels? Who knows why. But, good one. You've got your own groove. Get it, stella!
You forgot tp mention Mossad and the NSA and all others.
Don't fight for your country, if your country does not fight for you.
Shanghai faggot with the +5 sock puppet self promotion again, what a dumb bitch.
He was doing more than probing. Anyone who thinks this bottom feeder was performing a public service is an idiot. And this guy will probably find out the retiring doesn't mean law enforcement will stop looking for him.
Speaking of public service, three-letter agencies make this guy look like an angel by comparison, and taxpayers fund that fucking evil. He bricked infrastructure with shit security. For fucks sake, he broke into devices configured with default authentication sitting on telnet. I guess you would have preferred the alternative, which would have been many other hackers taking over your shit IoT hardware and fucking with you/spying on you instead.
And implying he would be "disappeared" is indicative of his warped view of reality. How many people have been "disappeared" for hacking?
How the fuck would you know? You personally know the current status of every high-profile hacker on the planet? If they did pass away, it was from natural causes? You can't get any more ignorant if Snowden himself slapped you in the face.
This guy, and people like him, are also responsible for giving law enforcement the political support needed to attach harsher penalties for these types of crimes.
Ah, but suggesting "disappearing" him is somehow too harsh. Perhaps you'll enjoy paying higher taxes so we can warehouse script kiddies for life in prison. Not that harsher sentences will deter jack shit, but you'll somehow feel better with more taxation.
Yeah. Very likely the CIA uses European decimal separator...
He implied "some government", not necessarily yours. We typically won't hear about "disappearing people", will we?
you could say he provied a free global security worth $100 million for us non boneheads that don't want unsecured IOT devices used in our daily lives. The dummies going around with unsecured $10 IOT devices should pick up the tab..
or finally gets kicked out of the basement.
He deserves to be probed. In the ass. With a sharp stick. Coated with capsaicin.
The dangers of excessive individualism are nothing compared to the oppressiveness of excessive collectivism
No, he is fucking tool and so are you. You should share his fate and your family too.
Sure. Let's have some more guys "probing our infrastructure", by going door to door looking for weak or unlocked doors, then drawing our attention to security vulnerabilities by entering our homes and defecating on the bedsheets, and publishing a list of vulnerable locks and how to break them for other providers of this "public service"
No thanks. No, the only "unpleasant figure" in this story is this criminal.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
The next time you fail to lock your car door, I will be sure to rob you and leave a note that says "shit security".
Then when you do lock your doors, I will be sure to break your windows and leave a note that says "shit security".
Then when you put steel around your windows, I will be sure to torch a hole through the steel, rob you, and leave a note that says "shit security". When does it end?
He deserves to be probed. In the ass. With a sharp stick. Coated with capsaicin.
But enough of your sexual fantasies...
He didn't forget them, they sign his paycheck.
9786.759 people have disappeared because of these activities this year alone. Its easy to access this information for yourself, just log on to www.CIA/bagmen/illegal/assassinations.org where the government tracks all of these instances for you.
You sound awfully sarcastic. I'd hate to think you didn't think the CIA has ever killed anyone. If you do - read the following - and know it's not the only record from an 'authoritative' source on the subject:
[The dart from this secret CIA weapon can penetrate clothing and leave nothing but a tiny red dot on the skin. On penetration of the deadly dart, the individual targeted for assassination may feel as if bitten by a mosquito, or they may not feel anything at all. The poisonous dart completely disintegrates upon entering the target. The lethal poison then rapidly enters the bloodstream causing a heart attack. Once the damage is done, the poison denatures quickly, so that an autopsy is very unlikely to detect that the heart attack resulted from anything other than natural causes. Sounds like the perfect James Bond weapon, doesn't it?] http://www.military.com/video/guns/pistols/cias-secret-heart-attack-gun/2555371072001
No, these IoT manufacturers with half-baked bullshit "security" built into them need to be drawn and quartered.
cos only an infantile cvnt could possibly be bothered with such vapid mindlessness.
12yo seeks internet glory, becomes laughing stock instead.
total twaat.
Then when you put steel around your windows, I will be sure to torch a hole through the steel, rob you, and leave a note that says "shit security". When does it end?
Default passwords left unchanged across thousands of devices. Insecure protocols still being used (fucking telnet?). The kind of stupid shit that vendors have known for decades to avoid. When does it end? When vendors pull their fucking head out of their wallet and invest in sound development practices instead of building hardware with shit security and rushing to be first to market.
Until then, they're going to continue to be a hackers bitch. Retired or not, he sure as shit won't be the last one to make an example out of those who fail to prioritize even common sense security.
I am admittedly lazy. Can someone point me at his source. I couldn't find it in a cursory google search. I'm not planning to use it in the wild, just curious about which exploits he used exactly.
thanks
this sig is deprecated
Are you actually so stupid you don't know the difference? When door vendors start selling doors with locks that don't work because there is no financial motivation to add them and your house and 100,000+ others are used by criminals to damage a third party who pays a lot of money to secure their dwelling, then get back to us. Idiots like you are the reason we need guys like this in the world.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Not to mention those pesky attacks on credit companies like Equifax or health-care.
It's not pleasant and the industry has a habit of reducing costs and efforts.
Dumbass mainland Europeans think it's OK to write in English but not follow English numeric conversions resulting in documentation that either makes no sense or worse gives values that are plain wrong.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Make sure you steal his ECU or otherwise "brick" his car. He shouldn't drive it until it's secured properly.
Just junk food for thought...
Right, so the solution is to punish the owners by destroying their devices to send a "message" to vendors? How's that working out so far? Are IoT device vendors scrambling to secure their shit so it doesn't get bricked? No?
Fuck, if the ends justify the means why didn't he just start murdering insecure IoT device owners until the vendors agreed to change their ways? It would have been a lot more effective and he would have had just as many morons like yourself riding his nuts.
What's a little collateral damage when fighting the "good" fight?
Why wouldn't you add Trump to the list? He inherited Obama's mass hacking agencies.
Chemotherapy sucks balls, but death sucks worse. News at 11.
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
For a while now my worst-case scenario hasn't been going to jail, but simply vanishing in the middle of the night as soon as some unpleasant HR person figures out who I am
He was afraid of that already.
Nonsense. Having guys like him probing our infrastructure is a lot better than leaving the holes wide open for Putin and Xi Jingping. He is providing a public service. It may not be pleasant when you get pwned, but flu shots aren't pleasant either.
What?!? So if I am creating an IOT of things with my 7 year old, I don't know a simple weather station just say, and we don't secure it because it is a project for a 7 year old where there is no security risk of leaving it exposed, and it is easier for them to experiment with and this guy bricks it, maybe permanently, how is this a public service?
It is vandalism. It is no different then him walking down the street looking at a weather station attached to a wooden fence post in someones yard and smashing it because, he wants you to know that unless you put a secure cage around it or bring it into your home it is unsafe. This guy should be charged for vandalism for each device he broke and serve time for each. Just a single day for each device I think would suffice.
I don't think it's the "government types" that are unpleasant.
What a tool.
To clarify the argument (without endorsing this position). It would be like you created an internet connected IOT weather station that because it was unsecured got hijacked to be included in a DDoS swarm.
The problem with poor IoT security is that, even if the device is useful for nothing else to the hacker, if it has a network stack and a connection it can DDoS someone else and there are millions of these devices. If this guy can get in and brick it, than someone else can get in and use it to DDoS
That clarifies it but doesn't make it right. It is like walking through a person's yard seeing a pick ax and breaking it to prevent a bad person from potentially finding it and using to murder someone.
Nonsense. Having guys like him probing our infrastructure is a lot better than leaving the holes wide open for Putin and Xi Jingping. He is providing a public service. It may not be pleasant when you get pwned, but flu shots aren't pleasant either.
The difference is I choose whether or not to get a flu shot. If someone walked down the street jabbing random people with a hypodermic, I'd suggest harsh penalties for them too.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
The next time you fail to lock your car door, I will be sure to rob you and leave a note that says "shit security".
In Australia leaving your car door unlocked when the vehicle is unattended in a public place will get you a fine.
It would be nice if we could get the same sort of treatment for the idiots who code for these IOT devices.
BTW, it seems a lot of his victims were ISPs who are professionals and should know better as to how to set up their equipment.
see title
How the fuck do you expect for a vendor to set unique passwords for the customer? Are you retarded? The device is sold with a default login so that the operator can configure the device and set the password. It's up to the operator to limit access to it. That's ALWAYS been the case. People bitch when they buy a device and it's not locked down, and others complain the vendor oversteps and belongs to the one who purchased it. You can't have both ways. This is a network administration problem. Super obvious, sunshine. There's already many proper disclosures sent to ISP'S when open resolver DNS servers or SNMP with default community strings are found open. That's the responsible thing and leads to change and educated admins. Damaging property and causing issues on property you don't own is clear as fucking day illegal and this prick will eventually get caught when he steps into the USA. He's a cunt looking for the lulz. Fuck you and your 'you deserve it because you didn't change protocols soon enough', rather than limiting access in the first place as the vendor expects the admin to fucking do.
That's a stupid law. Although I know Australia started off as a criminal colony, I didn't think you inherently treat your fellow citizens as criminals right off the bat. Gone are the days when you could leave house and car doors unlocked and not have to fear your shit being stolen.
So if the companies are already increasing security efforts, how is this extra punishment still needed? Responsible reporting could have easily been done, it already has for years. He wrote malware. The malware spread in criminal hands. He causes denial of service attacks. He's a cunt. This is an admin fail problem. Clear as fucking day. There's many IoT devices intended for private use without outside access that doesn't need to spend millions developing a new product. Companies do need to keep selling these devices and there is demand, sometimes there is no replacement product or the company is out of business. WinXP is no longer supported but is still needed for various things in various industries. You don't need to fuck around with spending time and effort changing shit to Windows 10 when you IP limit access or similar firewalling, especially if there is no upgrade path. I worked for a company that forced changing password on first login. ZERO fucking people praised it, but MANY complained when they typo (it's double prompted so they're the same, but doesn't help if caps was on without them knowing), forget passwords, or employees just die. When something is deployed, of course you should change it and record the password safely. That's the fucking admin's job. The botnet fuckers can learn of zero days and infect shitloads of devices regardless of SSH or changed passwords way before a patch can be distributed (scheduled downtime period, people sick, vacations, etc) even by the most responsible vendors. In the end, you need firewall and limited remote access for anything reachable from the public. That's the fucking message, not just "change your passwords", which is not enough.
So change the password to the MAC address instead. Hard to get remotely, easy with physical access. User learns they fucked up when they go to login and default doesn't work, but it's still operational without permanent damage. Even rebooting it at a specific interval would draw attention. It could be the "4h20 reboot issue" that becomes googleable when it's noticed their devices go offline on this specific time. There's lots of different things this asshole could have done without bricking them. He chose this. In court, the prosecution will present lots of alternative ways of educating the user and the jury will agree he's a cunt and he'll get decent prison time.
I didn't read much of your post because your first sentence shows that you are new to the technology world but think you know it all already. Also, you should learn about paragraphs.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
I highly doubt he hasn't monetized this.
This shit is a wake up call. Like how Watchdogs 1 and 2 was a wake up call hidden in a game. Lets not end up like the shit hole world like in watch dogs 2 where government and corporations have be come entirely nontransparent whilst your average Joe or Jane is so transparent that those nontransparent Political/Corporate entity can monitor every thing you do + metaphorically have their hand up your ass like a puppet e.g tampering with what you see so as to unfairly bias your vote choose i cite this from the story line of watchdogs 2... and they treat you like products for making money rather than as as actual humans!
Switch it Off,Switch it On[SOSO] Solves 95% of all IT problems!
Using Firefox on Android, there's no preview and there's new paragraphs when I submit it, so I only know they're not there afterwards, and there's no fucking edit. Sometimes I'll remember to have two new lines, but not always. Sometimes there's new paragraph and sometimes not. *shrug* Double new line test. I really hate walls of text, too. I guess I should have realized when it happens to others, it's likely the browser or /.
Fuck you firefox. (Three lines of white space) Or fuck you /.
He did get a job.
The nation state actors who took him away
in the middle of the night wrote his farewell.
After all, they don't want to scare away
any other job candidates.