8 ms·

The Vigilantes Who Created 'Malware' to Secure 10,000 Routers

102 points by cdubzzz 11y ago

cdubzzz 11y ago
Link to the GitLab page: https://gitlab.com/rav7teif/linux.wifatch https://gitlab.com/rav7teif/linux.wifatch
josefresco 11y ago
Trying to think of a real world analogy - let's say your car was compromised and hackers were using it when it was idle to launch attacks, or make money. Would I be mad if someone entered my car and turned on/activated the locks?
- hugozap 11y ago
  There must be better analogies.
  - dogma1138 11y ago
    "Canadian man breaks into home, cooks meals, does laundry, writes in owner’s diary"? http://www.nydailynews.com/news/crime/canadian-man-breaks-home-feeds-animals-laundry-article-1.2385010 http://www.nydailynews.com/news/crime/canadian-man-breaks-ho...
  - ef4 11y ago
    You see someone tie their boat to a dock and walk away. Then you notice that their knot is terrible, and the boat is about to drift off, so you untie it and re-tie it for them.
    - josefresco 11y ago
      Meh. People aren't losing their routers completely, they're just being used without their knowledge or permission. Maybe if you noticed that local kids were hosting parties on the boat and you closed the gate so they could not longer enter?
      - dogma1138 11y ago
        Closing a gate isn't really a violation of privacy, if we use the boat analogy it would be more like you've noticed that some thief's are about to steal the boat so you sail it out yourself. This is still quite a big violation of privacy, even if was done for good reasons. It's like some one notices that your window is open so they pick the lock on you front door and enter your home to close it.
        AnimalMuppet 11y ago
        > It's like some one notices that your window is open so they pick the lock on you front door and enter your home to close it. Beautifully put. And they justify doing it because of the danger of someone breaking and entering. But someone might have broken and entered, and they definitely did, so the justification sounds very hollow.
- CorpOverreach 11y ago
  Assuming everything went as planned, no problem. But to play devil's advocate... The risk with these things is always the "what if?". What if during that patch it bricked my device due to some fluke? What if I had a special customization that relied on a specific behavior on the component that was just updated without my consent? What if that patch attempt to a vehicle fails, leaving it unable to turn on? What if that vehicle was an ambulance?
  - anon4 11y ago
    I think their answer would be "the needs of the many outweigh the needs of the few"... And to flip that argument again - would you prefer your device to be bricked by someone trying to run a webserver serving child pornography, or by someone trying to protect you from the first?
    - ethbro 11y ago
      Aka the "yelling 'Fire!' in a crowded movie theater is not free speech" exception. It's good for the guy who wants to yell "Fire", but is it good for the majority? If you patch routers and 1% get bricked by some fluke, is that not a win for society? Also, to rebut the "How dare you change the firmware on my router without my consent?!" point, let's not forget these were essentially unprotected routers at this point in the applied_patch vs known_vulnerability cycle. If you don't want anyone patching your router without your permission... SECURE YOUR OWN PROPERTY. If I leave something on the sidewalk, I don't get angry when people cart it off / step on it. I especially don't get angry when they glue the broken bits back together and leave it on my doorstep with a note saying "We noticed this was broken. Superglue works wonders! Here's the number for a hardware store where you can buy it."
  - logfromblammo 11y ago
    What if someone could do any of those things intentionally and maliciously, instead of merely by accident? If the vehicle is an ambulance, a well-intentioned intruder could break it at any time, whereas a malicious one could break it at the worst possible time. While either one could cause a disaster while carrying a trauma patient at full speed on the highway, the accidental damage might also occur while motionless and empty in a parking lot. If grey-hats can patch a vulnerability against your will, it is very likely that they first tried disclosing the vulnerability to the manufacturer of your device, and they declined to fix it within a reasonable time, or you didn't run that update. Either way, whatever damage done to the device as a result of exploiting vulnerability would not have occurred if the vulnerability had already been repaired.
- noonespecial 11y ago
  A good analogy? It's batman. We're debating web batman. Cool.
- navait 11y ago
  Do we really need an analogy? What will it teach us that we can't conceive of now? There are benefits to someone doing this, and risks and costs to it, if benefit > (risk)(damage), it's good. If not, it's bad. Analogies just over-abstract the issue.
  - dvanduzer 11y ago
    Laws / moral codes are always abstractions. They have to be. It's useless to create a new rule that says "Hammurabi wasn't allowed to murder Gilgamesh last Tuesday." But there has always been a tension between the utilitarian criteria you're using, and the absolutist* criteria that others use when evaluating the morality of a decision. In practice, the most effective systems seem to strike a balance. Something like: "First, do no harm. Everything else is details. And the details matter, and the details need to be regularly debated, and the debate itself is an important part of the process." Abstract examples like the trolley problem don't teach us things that we can't conceive of. They can help us boil down and isolate specific aspects of absolutist thinking and determine if we're better off with the statistical approach to deciding if an action is good or bad. * Technically referred to as deontological ethics, but dang, software engineers ain't got nothing on philosophers when it comes to oblique terminology.
logfromblammo 11y ago
I have already considered this as an ethical hypothetical scenario. Is it acceptable to break in to someone else's system for the purposes of preventing other people with unknowable motives from breaking in, or to stop a break-in already in progress? For a full answer, I also need to answer some other questions. Is there any way to contact the owner of the device that has a reasonable chance of success? Are there any reasons why the owner might leave the device in an unsecured state intentionally? Is the device spreading harm to others because it is insecure? Is the owner aware that the device is not secure? I decided that the scenario was analogous not just to someone leaving their car doors unlocked in a high-crime neighborhood, but to a medical quarantine. An unlocked car doesn't really hurt anyone else, but an unaware carrier of a contagious pathogen is dangerous to himself and to others. It then becomes more acceptable to force treatment on an unwilling or unaware person, for the sake of public health. As a result, I figured that a program like the following would be ethically acceptable, but not necessarily virtuous: - uses a single specific vulnerability to compromise systems - immediately patches the vulnerability out of an infected system - attempts to detect and remove any known malware - goes dormant for a variable amount of time - attempts to infect other systems at a slow rate for a fixed amount of time - removes itself from the infected system - leaves behind a human-readable log of its activity It would also be helpful for it to be accompanied by a fix for the vulnerability in the official device update stream.
- AnimalMuppet 11y ago
  In the physical world, this type of "helpfulness" would get you shot dead, as you broke into someone's house for what you considered to be "helpful" reasons. The medical quarantine example is interesting, but there is a critical difference: There are officially recognized medical authorities with the legal power to require you to be quarantined. Currently, no such authorities exist on the network. So the example is more like: some people with medical knowledge but no actual standing try to quarantine you. But it's not quite as bad as it sounds, because there exists no Health Department to do so officially. (For that matter, there doesn't exist much government at all, in any form.) What's more, since there is no government to enforce this, the self-appointed expert quarantines you without your permission. I can see the reasoning behind it, but I'm not willing to go so far as to call it moral/ethical behavior.
rasz_pl 11y ago
The more clueless people pick the story the more distorted it gets. There are VERY FEW ARM based routers. Huge majority runs MIPS. You know what runs ARM? stupid IoT devices, security systems/cameras, and custom/very specialized niche jobs. Here is a graph from the original story: http://www.symantec.com/connect/sites/default/files/users/user-2598031/Fig4_10.png http://www.symantec.com/connect/sites/default/files/users/us...
imglorp 11y ago
The worm left backdoors for future use. It booted off competition so it would have the whole device to itself, ready for instructions.
- PhasmaFelis 11y ago
  IIRC, it also instructs the user to update and secure their firmware, wiping and blocking the vigilante worm as well as other malware. That doesn't seem like a plan for building a secure criminal botnet.
ix5 11y ago
I must admit, to me it first seemed more like someone wanted all those devices to be their own botnet without having script kiddies interfering and possibly causing a stirrup, instead preferring to keep everything for the exclusive use of the botnet owner.
jessaustin 11y ago
This is basically what sent Max Vision to prison in 2001, right? I hope there's better opsec with this. Also never talk to the cops...

102 points by cdubzzz 11y ago

Link to the GitLab page: https://gitlab.com/rav7teif/linux.wifatch https://gitlab.com/rav7teif/linux.wifatch

Trying to think of a real world analogy - let's say your car was compromised and hackers were using it when it was idle to launch attacks, or make money. Would I be mad if someone entered my car and turned on/activated the locks?

hugozap 11y ago
There must be better analogies.
- dogma1138 11y ago
  "Canadian man breaks into home, cooks meals, does laundry, writes in owner’s diary"? http://www.nydailynews.com/news/crime/canadian-man-breaks-home-feeds-animals-laundry-article-1.2385010 http://www.nydailynews.com/news/crime/canadian-man-breaks-ho...
- ef4 11y ago
  You see someone tie their boat to a dock and walk away. Then you notice that their knot is terrible, and the boat is about to drift off, so you untie it and re-tie it for them.
  - josefresco 11y ago
    Meh. People aren't losing their routers completely, they're just being used without their knowledge or permission. Maybe if you noticed that local kids were hosting parties on the boat and you closed the gate so they could not longer enter?
    - dogma1138 11y ago
      Closing a gate isn't really a violation of privacy, if we use the boat analogy it would be more like you've noticed that some thief's are about to steal the boat so you sail it out yourself. This is still quite a big violation of privacy, even if was done for good reasons. It's like some one notices that your window is open so they pick the lock on you front door and enter your home to close it.
      - AnimalMuppet 11y ago
        > It's like some one notices that your window is open so they pick the lock on you front door and enter your home to close it. Beautifully put. And they justify doing it because of the danger of someone breaking and entering. But someone might have broken and entered, and they definitely did, so the justification sounds very hollow.
CorpOverreach 11y ago
Assuming everything went as planned, no problem. But to play devil's advocate... The risk with these things is always the "what if?". What if during that patch it bricked my device due to some fluke? What if I had a special customization that relied on a specific behavior on the component that was just updated without my consent? What if that patch attempt to a vehicle fails, leaving it unable to turn on? What if that vehicle was an ambulance?
- anon4 11y ago
  I think their answer would be "the needs of the many outweigh the needs of the few"... And to flip that argument again - would you prefer your device to be bricked by someone trying to run a webserver serving child pornography, or by someone trying to protect you from the first?
  - ethbro 11y ago
    Aka the "yelling 'Fire!' in a crowded movie theater is not free speech" exception. It's good for the guy who wants to yell "Fire", but is it good for the majority? If you patch routers and 1% get bricked by some fluke, is that not a win for society? Also, to rebut the "How dare you change the firmware on my router without my consent?!" point, let's not forget these were essentially unprotected routers at this point in the applied_patch vs known_vulnerability cycle. If you don't want anyone patching your router without your permission... SECURE YOUR OWN PROPERTY. If I leave something on the sidewalk, I don't get angry when people cart it off / step on it. I especially don't get angry when they glue the broken bits back together and leave it on my doorstep with a note saying "We noticed this was broken. Superglue works wonders! Here's the number for a hardware store where you can buy it."
- logfromblammo 11y ago
  What if someone could do any of those things intentionally and maliciously, instead of merely by accident? If the vehicle is an ambulance, a well-intentioned intruder could break it at any time, whereas a malicious one could break it at the worst possible time. While either one could cause a disaster while carrying a trauma patient at full speed on the highway, the accidental damage might also occur while motionless and empty in a parking lot. If grey-hats can patch a vulnerability against your will, it is very likely that they first tried disclosing the vulnerability to the manufacturer of your device, and they declined to fix it within a reasonable time, or you didn't run that update. Either way, whatever damage done to the device as a result of exploiting vulnerability would not have occurred if the vulnerability had already been repaired.
noonespecial 11y ago
A good analogy? It's batman. We're debating web batman. Cool.
navait 11y ago
Do we really need an analogy? What will it teach us that we can't conceive of now? There are benefits to someone doing this, and risks and costs to it, if benefit > (risk)(damage), it's good. If not, it's bad. Analogies just over-abstract the issue.
- dvanduzer 11y ago
  Laws / moral codes are always abstractions. They have to be. It's useless to create a new rule that says "Hammurabi wasn't allowed to murder Gilgamesh last Tuesday." But there has always been a tension between the utilitarian criteria you're using, and the absolutist* criteria that others use when evaluating the morality of a decision. In practice, the most effective systems seem to strike a balance. Something like: "First, do no harm. Everything else is details. And the details matter, and the details need to be regularly debated, and the debate itself is an important part of the process." Abstract examples like the trolley problem don't teach us things that we can't conceive of. They can help us boil down and isolate specific aspects of absolutist thinking and determine if we're better off with the statistical approach to deciding if an action is good or bad. * Technically referred to as deontological ethics, but dang, software engineers ain't got nothing on philosophers when it comes to oblique terminology.

logfromblammo 11y ago

I have already considered this as an ethical hypothetical scenario. Is it acceptable to break in to someone else's system for the purposes of preventing other people with unknowable motives from breaking in, or to stop a break-in already in progress? For a full answer, I also need to answer some other questions. Is there any way to contact the owner of the device that has a reasonable chance of success? Are there any reasons why the owner might leave the device in an unsecured state intentionally? Is the device spreading harm to others because it is insecure? Is the owner aware that the device is not secure? I decided that the scenario was analogous not just to someone leaving their car doors unlocked in a high-crime neighborhood, but to a medical quarantine. An unlocked car doesn't really hurt anyone else, but an unaware carrier of a contagious pathogen is dangerous to himself and to others. It then becomes more acceptable to force treatment on an unwilling or unaware person, for the sake of public health. As a result, I figured that a program like the following would be ethically acceptable, but not necessarily virtuous: - uses a single specific vulnerability to compromise systems - immediately patches the vulnerability out of an infected system - attempts to detect and remove any known malware - goes dormant for a variable amount of time - attempts to infect other systems at a slow rate for a fixed amount of time - removes itself from the infected system - leaves behind a human-readable log of its activity It would also be helpful for it to be accompanied by a fix for the vulnerability in the official device update stream.

AnimalMuppet 11y ago
In the physical world, this type of "helpfulness" would get you shot dead, as you broke into someone's house for what you considered to be "helpful" reasons. The medical quarantine example is interesting, but there is a critical difference: There are officially recognized medical authorities with the legal power to require you to be quarantined. Currently, no such authorities exist on the network. So the example is more like: some people with medical knowledge but no actual standing try to quarantine you. But it's not quite as bad as it sounds, because there exists no Health Department to do so officially. (For that matter, there doesn't exist much government at all, in any form.) What's more, since there is no government to enforce this, the self-appointed expert quarantines you without your permission. I can see the reasoning behind it, but I'm not willing to go so far as to call it moral/ethical behavior.

rasz_pl 11y ago

The more clueless people pick the story the more distorted it gets. There are VERY FEW ARM based routers. Huge majority runs MIPS. You know what runs ARM? stupid IoT devices, security systems/cameras, and custom/very specialized niche jobs. Here is a graph from the original story: http://www.symantec.com/connect/sites/default/files/users/user-2598031/Fig4_10.png http://www.symantec.com/connect/sites/default/files/users/us...

imglorp 11y ago

The worm left backdoors for future use. It booted off competition so it would have the whole device to itself, ready for instructions.

PhasmaFelis 11y ago
IIRC, it also instructs the user to update and secure their firmware, wiping and blocking the vigilante worm as well as other malware. That doesn't seem like a plan for building a secure criminal botnet.

ix5 11y ago

I must admit, to me it first seemed more like someone wanted all those devices to be their own botnet without having script kiddies interfering and possibly causing a stirrup, instead preferring to keep everything for the exclusive use of the botnet owner.

jessaustin 11y ago

This is basically what sent Max Vision to prison in 2001, right? I hope there's better opsec with this. Also never talk to the cops...