3 ms·

This was my exact thought. If we have the source code, it seems as if it wouldn't be too hard to make our own version which seeks and destroys other versions, p

This was my exact thought. If we have the source code, it seems as if it wouldn't be too hard to make our own version which seeks and destroys other versions, possibly patching the system, or at least changing the password to be something secure. Is there a reason this can't be done? (Other than a legal reason, which hackers don't tend to care too much about.)

arachnophobe 10y ago
If you can get access as riot then changing the password should be possible - assuming (and I haven't looked at the source yet) that the hacker doesn't when they first get control (although if the source is original it would have a/some passwords in it as you can't control something if you don't know the password). Modifying the existing code to find and remove the added components (as you know what's been added by the code, where it's been added to) before resetting the password ought to be doable. Changing the password ought to then alert the users that something's wrong ("hey, my internet connected [thing] isn't working?") so hopefully they will then contact the vendor, or bitch about the product on a review site, which will make the vendor sit up and notice if a lot of people do this. If it looks like this hits a company's bottom line it will have more impact. You may have to hit the machines more than once because support will probably start with 'flash the firmware' which will reset the password, so a couple of passes to ensure the users get fed up, and support suggest changing defaults might solve the problem. A more serious/damaging and potentially dangerous (depending what the IoT thing is being used for - ie fire detection, child monitoring) would potentially be - and this is not my field - to deploy null/corrupt/fake firmware to these devices to take them offline until a firmware flash is carried out. That would require different tactics than just modifying the source, and would be more complicated due to the different types of device. I'm not sure how easy it is to remote flash this stuff, whether you need certificates, whether you can flash entirely non-functioning code and how easily. As I say, not my area. Anyone know if it's possible to put this code on a DNS box and when an attack starts go to each source ip, attempt Telnet with default list, then clean/change password/reboot/re-firmware (whichever - any/all) to kill the sources our do these systems use ip masking/obfuscation?

arachnophobe 10y ago

If you can get access as riot then changing the password should be possible - assuming (and I haven't looked at the source yet) that the hacker doesn't when they first get control (although if the source is original it would have a/some passwords in it as you can't control something if you don't know the password). Modifying the existing code to find and remove the added components (as you know what's been added by the code, where it's been added to) before resetting the password ought to be doable. Changing the password ought to then alert the users that something's wrong ("hey, my internet connected [thing] isn't working?") so hopefully they will then contact the vendor, or bitch about the product on a review site, which will make the vendor sit up and notice if a lot of people do this. If it looks like this hits a company's bottom line it will have more impact. You may have to hit the machines more than once because support will probably start with 'flash the firmware' which will reset the password, so a couple of passes to ensure the users get fed up, and support suggest changing defaults might solve the problem. A more serious/damaging and potentially dangerous (depending what the IoT thing is being used for - ie fire detection, child monitoring) would potentially be - and this is not my field - to deploy null/corrupt/fake firmware to these devices to take them offline until a firmware flash is carried out. That would require different tactics than just modifying the source, and would be more complicated due to the different types of device. I'm not sure how easy it is to remote flash this stuff, whether you need certificates, whether you can flash entirely non-functioning code and how easily. As I say, not my area. Anyone know if it's possible to put this code on a DNS box and when an attack starts go to each source ip, attempt Telnet with default list, then clean/change password/reboot/re-firmware (whichever - any/all) to kill the sources our do these systems use ip masking/obfuscation?