Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Botnet Security The Internet Privacy Software Linux

New, More-Powerful IoT Botnet Infects 3,500 Devices In 5 Days (arstechnica.com) 56

An anonymous reader quotes a report from Ars Technica: There's a new, more powerful Internet-of-things botnet in town, and it has managed to infect almost 3,500 devices in just five days, according to a recently published report. Linux/IRCTelnet, as the underlying malware has been named, borrows code from several existing malicious IoT applications. Most notably, it lifts entire sections of source code from Aidra, one of the earliest known IoT bot packages. Aidra was discovered infecting more than 30,000 embedded Linux devices in an audacious and ethically questionable research project that infected more than 420,000 Internet-connected devices in an attempt to measure the security of the global network. As reported by the anonymous researcher, Aidra forced infected devices to carry out a variety of distributed denial-of-service attacks but worked on a limited number of devices. Linux/IRCTelnet also borrows telnet-scanning logic from a newer IoT bot known as Bashlight. It further lifts a list of some 60 widely used username-password combinations built into Mirai, a different IoT bot app whose source code was recently published on the Internet. It goes on to add code for attacking sites that run the next-generation Internet protocol known as IPv6. The best-of-breed approach "is driving a high infection speed of Linux/IRCTelnet (new Aidra) so it can [infect] almost 3,500 bot clients within only five days from the moment its loader was first detected," a researcher who goes by the handle Unixfreakjp wrote in a blog post reporting on the new malware. "To incarnate a legendary botnet code into a new version that can [target] the recent vulnerable threat landscape is really inviting more bad news."
This discussion has been archived. No new comments can be posted.

New, More-Powerful IoT Botnet Infects 3,500 Devices In 5 Days

Comments Filter:
  • by Mal-2 ( 675116 ) on Tuesday November 01, 2016 @08:54PM (#53195901) Homepage Journal

    Whoever decided putting devices without sufficient resources to defend themselves, or be updated, directly onto the Internet was a good idea should have his professional certifications revoked and forbidden to administer anything more complicated than his own home network. And that home should probably be denied connectivity to the world.

    The IoT is not necessarily a bad idea in concept, but it has been implemented exceptionally poorly, and those devices that cannot be updated need to be disconnected forever, or at least hidden on their own private networks. Vendors who cannot or will not patch their devices should be compelled to recall them, as violations of Part 15 rules against causing harmful interference.

    • by Anonymous Coward

      I don't know that doesn't make sense. That would like suing a gun manufacturer for something a user did. These cheap crappy devices probably are fine as long as they are properly firewalled onto their own subnet. Isn't it the users fault for not properly securing the devices?

    • should have his professional certifications revoked

      What professional certification? What sort of people do you think are designing and deploying this stuff, professionals?

      • Well the things are not running windows so yeah, we all spect them to be properly set up by the friendly neckbeard we all know.
        Decades of millions of windows boxes owned and nothing happened but make popular some Linux-on-a-stick and the internets collapse. Good game.
    • And how are we supposed to hold vendors accountable? Domestic ones you can, however there are very few domestic IoT vendors. Nonetheless, people are going to keep buying them without giving a damn what impact they have on anybody else. This is why you should hold the end user responsible, otherwise they can just get away with slapping the blame on a manufacturer that can never be reached, which means zero accountability.

      We do the same thing with cars, by the way. By putting your car on the road, you by defa

  • by Noah Haders ( 3621429 ) on Tuesday November 01, 2016 @10:06PM (#53196307)

    We need a team of grey hats who weaponize these IoT security flaws. There's no way you can win the IoT security battle through publicity or conferences. I assure you the chinese crapola seller isn't going to issue a security patch.

    Instead, we need the grey hats to find these IoT flaws and then brick all IoT devices that they can find. Just make it a standing rule -- insecure IoT? Bricked! This would make many OEMs pay attention to security, and for those who still don't, at least their products will be off the web.

    Where can we enlist these hackers?

    • by AHuxley ( 892839 )
      Using admin, admin or admin, password is a feature not a flaw.
      What is an insecure IoT to an isp? A user looking at their CCTV at work or in another country?
      "This would make many OEMs pay attention to security," is the key, get them at the app level. Get their brands off the phones, desktops and tablets.
      Get all AV brands to scan all devices on a network and report the junk by default. Not some hidden scan setting for "network".
      • Not sure what you mean by getting them at the app level. To be clear, I'm talking about breaking their IoT fridge so it no longer works and they have to buy another one. Next time, they'll buy a different brand!

    • by Anonymous Coward

      I agree with parent. If corporations aren't going to take responsibility for their creations once sold into the wild, then the law of 'survival of the fittest' needs to come into play. Once a few big companies get their entire lines of devices bricked due to being just unfit for survival in the open internet, they'll start to change their behaviour.

      This isn't unethical -- it's the most ethical thing people can do, in the long run. Make the big companies stare with open eyes at the elephant they've created i

    • autoimmune response
    • They don't have to be bricked, just have their logins changed so they are no longer a threat. The problem is that even just doing that is technically hacking and can land you in hot water if/when caught. Bricking them would just land you in more hot water.
      • the problem with your approach is that it lets the companies off the hook, and makes it so they don't need to pay any attention to security. the only thing that will wake them up is if their stuff breaks.

      • "just have their logins changed so they are no longer a threat."
        A lot of those devices have logins/passwords hardcoded in them.

        • Well if they can't be changed then it's also going to be hard to brick them.
          I was under the assumption that most of these devices have not had the DEFAULT credentials changed, the ones that the get from the factory and are printing on the box or in the user manual. When the owner realizes he can no longer login and does a factory reset it will go back to the default. Hopefully after a few times he will catch a clue and change the default login.
  • by Snotnose ( 212196 ) on Tuesday November 01, 2016 @10:14PM (#53196333)
    We all know IoT devices have absolutely no security, we've known this for months. Yet the uninformed keep buying them (despite the "NEW AT 11 OCLOCK!!! HACKERS TAKE OVER YOUR BABY CAM" every few weeks). The uninformed can't be bothered to change the default password, even after watching the abovementioned news flash. The uninformed considered a day or three of crappy internet as "hmmm, must be hackers somewhere. But not in my neighborhood".

    We need to put a tax on the stupid/lazy. Either fine the fuck out of the vendors of these things when they get compromised (won't happen), or fine the fuck out of idiots who leave these things in the default mode and get hacked (won't happen). Until one of those 2 things happen things will get worse.
    • by Zocalo ( 252965 ) on Wednesday November 02, 2016 @05:44AM (#53197339) Homepage
      Months? Try *years*. Ignoring the frivolous crap like fridges and kettles, the IoT has basically grown out of the previous generation of SCADA and Industrial Control & Automation (ICA) hardware, plus IP enabled versions of things like access control, building management systems, CCTV and so on. In almost every single case, even where you'd assume that the vendor ought to know better, the rush to get a product to market has trumped any security considerations and quite often the design can be summed up as "take an existing analogue product, put an Ethernet enabled chip on the side of it, slap an Ethernet jack on the case, give it an SKU, and update the product brochure".

      The really scary part is that that is still only scratching the surface of the problem. You also need to keep in mind that many of the original products that the IoT devices are based on are considered mature - they've been in development and on the market for well over a decade in many cases - yet researchers are still finding major security flaws in the underlying devices, e.g. the recent exploits of Siemens' SCADA systems. Factor in that in order to get the "big data" off these myriad devices and into "the cloud" to meet the necessary levels of buzzword compliance means that you are also negating any possibility of a physical air gap between the systems and the public Internet and it's been obvious for much longer than a few months that we've been heading for a major trainwreck (possibly quite literally since rail is also moving towards IoT systems).
    • We need to put a tax on the stupid/lazy. Either fine the fuck out of the vendors of these things when they get compromised (won't happen), or fine the fuck out of idiots who leave these things in the default mode and get hacked (won't happen).

      What needs to happen is ISPs need to be held responsible when one of their customers is DoSing the rest of the world. You'd waste your effort going after individuals. But the ISPs can cut off individuals' internet access, maybe redirecting to a "FIX YOUR DAMN INSECURE

    • by houghi ( 78078 )

      Also it was only 3500 devices. To me that could mean that it is:
      a) A proof of concept
      b) Not a very dangerous virus
      c) The IoT is pretty safe

    • isn't it hypocritical to blame the manufactures when you leave to secure a Linux in the hands of the average gadget user, but shame MS when the same average user fail to secure the windblows box correctly? Which is it? oh right, it's the programmers fault, be it Linux or Windows, it's all your fault but obviously you would never admit to it, bonus points for spinning it in the direction of our memetic nemesis M$ which is not longer relevant to the game.
  • If I would wear a tin-foil hat, then I'd suggest that Asia is carpet bombing the Western digital world. The difference being that no lives are being taken (yet), no physical damage occurs (yet) and no bomber planes are flying. Oh, and contrary to physical warfare, WE ARE PAYING for our own bombs. Small amounts each time,but we buy the cr*p that comes out of Asia.

    I'm not wearing a tin-foil hat, but still I wonder if the cr*ppy firmware and spreading of so many exploitable devices isn't just part of the plan.

  • Are these things making uPnP requests? Or are people actually putting them up with no firewalling? Or are people's PCs getting owned and being used to spread malware behind their firewall? What's the actual vector for people to make connections to these IoT devices? It boggles my mind to think that there are still people out there without firewalls. They cost basically nothing, especially if you don't expect to converge them with an access point.

"We don't care. We don't have to. We're the Phone Company."