Vigilante Malware Protects Routers Against Other Security Threats 79
Mickeycaskill writes: Researchers at Symantec have documented a piece of malware that infects routers and other connected devices, but instead of harming them, improves their security. Affected routers connect to a peer-to-peer network with other compromised devices, to distribute threat updates. 'Linux.Wifatch' makes no attempt to conceal itself and even left messages for users, urging them to change their passwords and update their firmware. Symantec estimates 'tens of thousands' of devices are affected and warns that despite Wifatch's seemingly philanthropic intentions, it should be treated with caution.
"It should be made clear that Linux.Wifatch is a piece of code that infects a device without user consent and in that regard is the same as any other piece of malware," said Symantec. "It should also be pointed out that Wifatch contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions." There is one simple solution to rid yourself of the malware though: reset your device
"It should be made clear that Linux.Wifatch is a piece of code that infects a device without user consent and in that regard is the same as any other piece of malware," said Symantec. "It should also be pointed out that Wifatch contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions." There is one simple solution to rid yourself of the malware though: reset your device
Misnomer (Score:2)
I would call that palware and not malware.
Re: (Score:2)
Is that greyhat?
Re:Misnomer (Score:4, Insightful)
No. It's whitehat.
If you're dumber than a sack of hammers and never update your router to fix security problems with its firmware, then this worm (not malware, just a software worm) fixes it for you to prevent some other exploit from doing far, far worse.
Grayhat is when it also MITM's your https sessions to steal financial details.
Admittedly, we don't know if this particular worm is whitehat or grayhat yet. We do know for certain that it isn't pure blackhat. And that was pretty much what Symantec said, but in srsbsnss corporate terms.
Re:Misnomer (Score:4, Informative)
Re: (Score:2)
Re: (Score:1)
If it's got backdoors, it's no longer whitehat.
false.
a whitehat could be anticipating that more white intervention might be necessary at some point in the future. it's not clear, but it's not clear that it's white hat. it is clear that your statement is false, however.
it's opaque hat, or shadow hat.
Re: (Score:3)
Re: Misnomer (Score:1)
Re: (Score:2)
Is that greyhat?
No, it's asshat.
How is it malware then? (Score:5, Insightful)
Re:How is it malware then? (Score:4, Informative)
"It should also be pointed out that Wifatch contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions."
Patching systems or not, creating new backdoors really doesn't make it "doing good things."
Re: (Score:2)
its GoodyTooShoesWare aka GTSW
Re:How is it malware then? (Score:5, Insightful)
Is doing good things, that's not malware.
If I walk into your house through the unlocked front door while you are not home, does it protect me from trespassing charges if while I am there I made your bed and did your dishes?
Re: (Score:1)
Is doing good things, that's not malware.
If I walk into your house through the unlocked front door while you are not home, does it protect me from trespassing charges if while I am there I made your bed and did your dishes?
Like this woman: http://newsfeed.time.com/2012/... [time.com]
Except she was asking for money after cleaning the house.
Re:How is it malware then? (Score:5, Funny)
Exactly how many dishes and how long have they been sitting in the sink?
Re: (Score:2)
Are you offering to make my bed and do my dishes if I leave my door unlocked?
Re:How is it malware then? (Score:4, Funny)
Sure thing. Just post your address here along with the times when you will be out of the house with the doors unlocked and I assure you that everything will be cleaned out by the end of the day.
Up. I meant up. You can totally trust me on that. Have I ever lied to you before?
Re: (Score:2)
Let me just get that written down, while I'm working on that let me assure you that the two large dogs that greet you at the door with barking and scratching at the door are not at all violent and the growling and salivating is simply an emotional response to their love of human contact. Feel free to enter without fear and rumors or signs indicating that they have been trained as attack dogs are simply to scare away intruders and I can guarantee that you won't be attacked and have your throat ripped out.
Re: (Score:2)
Never encountered a properly trained dog have you?
Re: (Score:3)
What a deal! My address is One Schroeder Plaza, Boston, MA 02120. I won't be around for a while, but you can go right in any time day or night.
Bring doughnuts
Re: (Score:1)
Isn't it more like finding the door of your home open and getting in to make sure no thief will take advantage of it until you come home?
Re: (Score:2)
Isn't it more like finding the door of your home open and getting in
And you have permission to be inside?
Re: (Score:1)
Isn't it more like finding the door of your home open and getting in
And you have permission to be inside?
I am not arguing it is lawful. I am just saying it is a better analogy. That's all.
Re: (Score:2)
I am not arguing it is lawful. I am just saying it is a better analogy. That's all.
It's the entrance that is the point in question, not what you do once you are inside.
Re: (Score:2)
Isn't it more like finding the door of your home open and getting in
And you have permission to be inside?
It's more like finding a house with an open door, and smelling gas coming from inside, a potential hazard for the house and everyone else around.
Or, an even better analogy, finding a car that is open, or already with thieves inside, and closing the door having previously chased the thieves away.
Oh, and leaving a note about what you did and that you should get your locks checked or changed.
Re: (Score:2)
Is doing good things, that's not malware.
If I walk into your house through the unlocked front door while you are not home, does it protect me from trespassing charges if while I am there I made your bed and did your dishes?
In that case, just because I can call you a tresspasser, doesn't mean it is proper to also call you a bed-messer-upper or a dish-dirtier.
Malware is software that harms you. This is not malware. No one said it wasn't an infection, or a virus if you prefer, because that it certainly is.
Re: (Score:3)
How do you know that it's doing good things?
And even if it did good things for someone else, how would you know that it was still doing good things by the time it hit your router?
Re: (Score:2)
i'm going to break into your house
but it's ok, i just want to wash your dishes
you don't know me at all. i'm an inexplicable weirdo who breaks into people's houses and does their dishes. but you're good with me being in your house downstairs while you sleep, and me doing that. doesn't bother you at all. right?
Re: (Score:2)
your argument works for government intrusion too: hey, the nsa is just sticking it's nose in and without your permission monitoring all of your personal private electronic communications. why? to keep you safe. oh that's nice!
so it's ok, right? no? but that's the same fucking argument you're making
the real bottom line:
someone you don't know and do not trust is transgressing your personal property and your privacy, you thick fuck
never acceptable, no matter what their agenda. because you did not grant them pe
Finally! (Score:5, Insightful)
This. Is. Awesome!
Finally someone has decided to return to the roots of hacking... making something change just to see the change happen!
Mixed feelings.. (Score:2)
I am not sure I agree with this fully. The webcam site which shows all the cameras with default settings I don't take issue with, because it's not doing anything special or malicious to access the camera. In this case, they are doing more than uploading software by using a default password. The original good intention can easily become something bad. You can check history on that last one if you have doubts.
Let it be christen (Score:2)
Rogueware: A stealth cyber agent which defends crapware.
Re: (Score:2)
Does it install tights on the system?
defend the IO tower! (Score:3)
Re: (Score:2)
I'm Batware.
Where do I sign up ... (Score:2)
... to get this malware?
Re: (Score:1)
You could just patch your router yourself and save everyone the hassle of needing/wanting to author malware (and anything that changes code without permission is malware regardless of intent).
Re: (Score:2)
I would rather have something that auto-updates for me.
If this was merely a worm (it's not malware) that did a one-time-patch and went on its way, that isn't as useful as something that keeps itself updated and fetches useful router kernel patch upgrades by itself on a regular basis.
I already do this in my desktop Linux systems. Why can't I have it in my DSL modem/router? (yes, DSL. Fairpoint sucks.)
--
BMO
Symantec infects a device with a user's consent. (Score:5, Informative)
It should be made clear that Symantec is a piece of code that infects a device /with/ user consent and in that regard is the same as any other piece of malware that is installed via a phishing attack.
Re: (Score:1)
Symantec didn't get my consent when they infected my brand new computer with their anti-virus bloatware. Where is an anti-norton virus [chroniclesofgeorge.com] when you need one?
Re: (Score:2)
Yes they did. It says right on the box that the computer comes with it. You accepted it by buying it.
Your argument is like saying you didn't consent to cancer when you bought and smoked cigarettes.
A better analogy would be "he consented with cancer when he was born with a defective p53 gene on his c17".
By the way: shrink wrap licenses are not valid in all jurisdictions.
jailbreakme.com (Score:5, Informative)
The original iPhone jailbreaking site, "jailbreakme.com", used the tiff library exploit to install the installer, and then patched the tiff exploit behind itself to prevent it being used for any other (nefarious) purpose, so this type of thing is not a unique or even new idea.
Re: (Score:2)
Viruses that fix things weren't even a new idea when the iPhone was being jailbroken.
Re: (Score:2)
anyone remember "Code Red" and "Code Green"? that was a fun month
In that respect (Score:1)
Interesting (Score:1)
Seems like a good idea (Score:2)
Welchia, the 2003 "helpful worm" (Score:2)
The Welchia worm, also known as the "Nachia worm", is a computer worm that exploits a vulnerability in the Microsoft Remote procedure call (RPC) service similar to the Blaster worm. However, unlike Blaster, it first searches for and deletes Blaster if it exists, then tries to download and install security patches from Microsoft that would prevent further infection by Blaster, so it is classified as a helpful worm.
https://en.wikipedia.org/wiki/... [wikipedia.org]
Fixing vulnerabilities is pretty common in malware (Score:4, Interesting)
Hmmmmm (Score:3)
This....makes me uneasy.
It appears to be benign (or even helpful) but this is a slippery slope...and I can see all sorts of things that can go wrong here.
I want to root for the good guys here (pun intended, heh!) but I don't know...anything that fiddles with my PC or server without my explicit, informed consent and permission just doesn't sit well with me.
It sort of reminds me of the viruses that infect your PC and then disable any competing viruses it finds, so it has your PC all to itself. It doesn't do it for benevolent reasons, it does it because it's greedy and doesn't want to share.
So I dunno. I can't say as I like it, and I can't say as I don't. Major conflicted feelings here.
Re: (Score:2)
Same thing here, except with less QA.
RobinHoodware (Score:1)
Batman (Score:1)
Batman learned to code!
Re: (Score:2)
i just really wanted to say (Score:1)
well done, and thank you, to whoever did this - great work, more please.
It's an inevitability. (Score:2)
How many man hours are wasted pen testing or setting up security just so that client after client can fail to remain compliant as time goes by?
How many billions of dollars are wasted every year by large corporations failing to secure their data?
Why not just start writing viruses that go out, patch vulnerabilities, throw a middle finger and erase / kill process?
Target the weakest link and do something about it. In fact I feel if a company is "caught" doing this it shouldn't even be considered illegal. This s
code that infects a device without user consent (Score:1)
Vigilante better than nothing? (Score:2)
Nobody prefers vigilante anything to doing things the right way. The question is, would these devices be realistically fixed over time, or just left open and exploited? If the later, maybe vigilante fix is better than no fix. If I left my door unlocked in a seedy neighborhood, I would rather somebody came and locked it for me than come back and find my house burglarized. The entry point for this thing is simply telnet with default username/password. There is little doubt that chances of malicious exploit ar
Some additional info... (Score:2)
For more information about this malware(ish) campaign, I would refer you to Peter Kosinar's talk at AVAR 2014: Stealing the Internet, One Router at a Time">. Disclaimer: Peter is a friend of mine. [avar2014.com]
Regards,
Aryeh Goretsky
wifatch source code on gitlab (Score:1)