Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Networking Security Linux

Vigilante Malware Protects Routers Against Other Security Threats 79

Mickeycaskill writes: Researchers at Symantec have documented a piece of malware that infects routers and other connected devices, but instead of harming them, improves their security. Affected routers connect to a peer-to-peer network with other compromised devices, to distribute threat updates. 'Linux.Wifatch' makes no attempt to conceal itself and even left messages for users, urging them to change their passwords and update their firmware. Symantec estimates 'tens of thousands' of devices are affected and warns that despite Wifatch's seemingly philanthropic intentions, it should be treated with caution.

"It should be made clear that Linux.Wifatch is a piece of code that infects a device without user consent and in that regard is the same as any other piece of malware," said Symantec. "It should also be pointed out that Wifatch contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions." There is one simple solution to rid yourself of the malware though: reset your device
This discussion has been archived. No new comments can be posted.

Vigilante Malware Protects Routers Against Other Security Threats

Comments Filter:
  • by Anonymous Coward

    I would call that palware and not malware.

    • Is that greyhat?

      • Re:Misnomer (Score:4, Insightful)

        by Anonymous Coward on Friday October 02, 2015 @04:24PM (#50647389)

        No. It's whitehat.

        If you're dumber than a sack of hammers and never update your router to fix security problems with its firmware, then this worm (not malware, just a software worm) fixes it for you to prevent some other exploit from doing far, far worse.

        Grayhat is when it also MITM's your https sessions to steal financial details.

        Admittedly, we don't know if this particular worm is whitehat or grayhat yet. We do know for certain that it isn't pure blackhat. And that was pretty much what Symantec said, but in srsbsnss corporate terms.

        • Re:Misnomer (Score:4, Informative)

          by TWX ( 665546 ) on Friday October 02, 2015 @05:02PM (#50647645)
          I need proof that it effectively removes or disables itself once it's on there and has no possibility of later command-and-control and could not be directly co-opted by someone with bad intentions before I would call it white-hat. History is loaded with examples where someone or something appeared altruistic but turned out to be sinister in the end.
        • If it's got backdoors, it's no longer whitehat.
          • by Anonymous Coward

            If it's got backdoors, it's no longer whitehat.

            false.

            a whitehat could be anticipating that more white intervention might be necessary at some point in the future. it's not clear, but it's not clear that it's white hat. it is clear that your statement is false, however.

            it's opaque hat, or shadow hat.

        • Symantec would just hate the possibility of a free and better protection introducing itself into their marketplace. They've been coining it for a long time on threat awareness and creation.
      • Is that greyhat?

        No, it's asshat.

  • by hyperar ( 3992287 ) on Friday October 02, 2015 @04:17PM (#50647321)
    Is doing good things, that's not malware.
    • by Anonymous Coward on Friday October 02, 2015 @04:30PM (#50647431)

      "It should also be pointed out that Wifatch contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions."

      Patching systems or not, creating new backdoors really doesn't make it "doing good things."

    • its GoodyTooShoesWare aka GTSW

    • by OzPeter ( 195038 ) on Friday October 02, 2015 @04:44PM (#50647529)

      Is doing good things, that's not malware.

      If I walk into your house through the unlocked front door while you are not home, does it protect me from trespassing charges if while I am there I made your bed and did your dishes?

      • Is doing good things, that's not malware.

        If I walk into your house through the unlocked front door while you are not home, does it protect me from trespassing charges if while I am there I made your bed and did your dishes?

        Like this woman: http://newsfeed.time.com/2012/... [time.com]

        Except she was asking for money after cleaning the house.

      • by Krishnoid ( 984597 ) on Friday October 02, 2015 @04:55PM (#50647599) Journal

        Exactly how many dishes and how long have they been sitting in the sink?

      • Are you offering to make my bed and do my dishes if I leave my door unlocked?

        • by Minwee ( 522556 ) <dcr@neverwhen.org> on Friday October 02, 2015 @05:04PM (#50647659) Homepage

          Sure thing. Just post your address here along with the times when you will be out of the house with the doors unlocked and I assure you that everything will be cleaned out by the end of the day.

          Up. I meant up. You can totally trust me on that. Have I ever lied to you before?

          • Let me just get that written down, while I'm working on that let me assure you that the two large dogs that greet you at the door with barking and scratching at the door are not at all violent and the growling and salivating is simply an emotional response to their love of human contact. Feel free to enter without fear and rumors or signs indicating that they have been trained as attack dogs are simply to scare away intruders and I can guarantee that you won't be attacked and have your throat ripped out.

          • What a deal! My address is One Schroeder Plaza, Boston, MA 02120. I won't be around for a while, but you can go right in any time day or night.

            Bring doughnuts

      • Isn't it more like finding the door of your home open and getting in to make sure no thief will take advantage of it until you come home?

        • by OzPeter ( 195038 )

          Isn't it more like finding the door of your home open and getting in

          And you have permission to be inside?

          • Isn't it more like finding the door of your home open and getting in

            And you have permission to be inside?

            I am not arguing it is lawful. I am just saying it is a better analogy. That's all.

            • by OzPeter ( 195038 )

              I am not arguing it is lawful. I am just saying it is a better analogy. That's all.

              It's the entrance that is the point in question, not what you do once you are inside.

          • Isn't it more like finding the door of your home open and getting in

            And you have permission to be inside?

            It's more like finding a house with an open door, and smelling gas coming from inside, a potential hazard for the house and everyone else around.

            Or, an even better analogy, finding a car that is open, or already with thieves inside, and closing the door having previously chased the thieves away.

            Oh, and leaving a note about what you did and that you should get your locks checked or changed.

      • by dissy ( 172727 )

        Is doing good things, that's not malware.

        If I walk into your house through the unlocked front door while you are not home, does it protect me from trespassing charges if while I am there I made your bed and did your dishes?

        In that case, just because I can call you a tresspasser, doesn't mean it is proper to also call you a bed-messer-upper or a dish-dirtier.

        Malware is software that harms you. This is not malware. No one said it wasn't an infection, or a virus if you prefer, because that it certainly is.

    • by Minwee ( 522556 )

      How do you know that it's doing good things?

      And even if it did good things for someone else, how would you know that it was still doing good things by the time it hit your router?

    • i'm going to break into your house

      but it's ok, i just want to wash your dishes

      you don't know me at all. i'm an inexplicable weirdo who breaks into people's houses and does their dishes. but you're good with me being in your house downstairs while you sleep, and me doing that. doesn't bother you at all. right?

  • Finally! (Score:5, Insightful)

    by Lab Rat Jason ( 2495638 ) on Friday October 02, 2015 @04:19PM (#50647333)

    This. Is. Awesome!

    Finally someone has decided to return to the roots of hacking... making something change just to see the change happen!

    • I am not sure I agree with this fully. The webcam site which shows all the cameras with default settings I don't take issue with, because it's not doing anything special or malicious to access the camera. In this case, they are doing more than uploading software by using a default password. The original good intention can easily become something bad. You can check history on that last one if you have doubts.

  • This type of virus-like good-guy software shall hereby be known as: Rogueware

    Rogueware: A stealth cyber agent which defends crapware.
  • ... to get this malware?

    • by KGIII ( 973947 )

      You could just patch your router yourself and save everyone the hassle of needing/wanting to author malware (and anything that changes code without permission is malware regardless of intent).

      • by bmo ( 77928 )

        I would rather have something that auto-updates for me.

        If this was merely a worm (it's not malware) that did a one-time-patch and went on its way, that isn't as useful as something that keeps itself updated and fetches useful router kernel patch upgrades by itself on a regular basis.

        I already do this in my desktop Linux systems. Why can't I have it in my DSL modem/router? (yes, DSL. Fairpoint sucks.)

        --
        BMO

  • by tlambert ( 566799 ) on Friday October 02, 2015 @04:34PM (#50647467)

    It should be made clear that Symantec is a piece of code that infects a device /with/ user consent and in that regard is the same as any other piece of malware that is installed via a phishing attack.

    • by Anonymous Coward

      Symantec didn't get my consent when they infected my brand new computer with their anti-virus bloatware. Where is an anti-norton virus [chroniclesofgeorge.com] when you need one?

  • jailbreakme.com (Score:5, Informative)

    by tlambert ( 566799 ) on Friday October 02, 2015 @04:35PM (#50647475)

    The original iPhone jailbreaking site, "jailbreakme.com", used the tiff library exploit to install the installer, and then patched the tiff exploit behind itself to prevent it being used for any other (nefarious) purpose, so this type of thing is not a unique or even new idea.

  • Useful software runs on computers and in that respect is no different than malware.
  • IIrc there are some other infections that do this sort of thing ie removing other threats/blocking other malware infections. I think one of them was the TDSS rk. And by doing so it evaded behavioral and real time scanners as it was seen as just another security service.
  • Too many vulnerable routers without patches available. If someone came up with a way to plug the vulnerability by exploiting it, Kudos. I say leave it there unless you CAN patch it, then do that instead. If they later abuse it, then reset your router.
  • The Welchia worm, also known as the "Nachia worm", is a computer worm that exploits a vulnerability in the Microsoft Remote procedure call (RPC) service similar to the Blaster worm. However, unlike Blaster, it first searches for and deletes Blaster if it exists, then tries to download and install security patches from Microsoft that would prevent further infection by Blaster, so it is classified as a helpful worm.

    https://en.wikipedia.org/wiki/... [wikipedia.org]

  • by Doug Otto ( 2821601 ) on Friday October 02, 2015 @05:02PM (#50647643)
    Lots of malware actually does close security holes, after exploiting the device. If you've worked very hard (or shelled out large amounts of case) for a working zero day, the last thing you want is some other asshole compromising your hacked system and screwing up your back door.
  • by JustAnotherOldGuy ( 4145623 ) on Friday October 02, 2015 @05:07PM (#50647681)

    This....makes me uneasy.

    It appears to be benign (or even helpful) but this is a slippery slope...and I can see all sorts of things that can go wrong here.

    I want to root for the good guys here (pun intended, heh!) but I don't know...anything that fiddles with my PC or server without my explicit, informed consent and permission just doesn't sit well with me.

    It sort of reminds me of the viruses that infect your PC and then disable any competing viruses it finds, so it has your PC all to itself. It doesn't do it for benevolent reasons, it does it because it's greedy and doesn't want to share.

    So I dunno. I can't say as I like it, and I can't say as I don't. Major conflicted feelings here.

    • Think of how upset people get when Microsoft updates things without permission.
      Same thing here, except with less QA.
  • Symantec don't like it because who will buy the anitivirus if the RobinHoodware would spread.
  • Batman learned to code!

    • Seriously, who else did he have to program that huge Mainframe/Supercomputer he keeps in his basement? With all his trust issues, I highly doubt he'd be using any Kernel that he didn't develop himself from scratch. Also, he's gotta have some kind of mad hacking/networking skills to be able to pull data off of GCPD and Fed DB's without ever getting detected. All the infrastructure was in place long before anyone else joined the team, save Alfred. Maybe some help from Lucius, but I still wouldn't that muc
  • well done, and thank you, to whoever did this - great work, more please.

  • How many man hours are wasted pen testing or setting up security just so that client after client can fail to remain compliant as time goes by?

    How many billions of dollars are wasted every year by large corporations failing to secure their data?

    Why not just start writing viruses that go out, patch vulnerabilities, throw a middle finger and erase / kill process?

    Target the weakest link and do something about it. In fact I feel if a company is "caught" doing this it shouldn't even be considered illegal. This s

  • just like Microsoft Windows!?
  • Nobody prefers vigilante anything to doing things the right way. The question is, would these devices be realistically fixed over time, or just left open and exploited? If the later, maybe vigilante fix is better than no fix. If I left my door unlocked in a seedy neighborhood, I would rather somebody came and locked it for me than come back and find my house burglarized. The entry point for this thing is simply telnet with default username/password. There is little doubt that chances of malicious exploit ar

  • Hello,

    For more information about this malware(ish) campaign, I would refer you to Peter Kosinar's talk at AVAR 2014: Stealing the Internet, One Router at a Time">. Disclaimer: Peter is a friend of mine. [avar2014.com]
    Regards,

    Aryeh Goretsky
  • The source code apparently has been released on http://gitlab.com/rav7teif/lin... [gitlab.com]

If all else fails, lower your standards.

Working...