8 ms·

Vigilantes are working hard to infect IoT devices with the Hajime botnet

83 points by Fjolsvith 10y ago

H4CK3RM4N 10y ago
The article mentions Telnet login credentials about halfway through. Is that honestly what's happening? I'd assumed it was at least SSH logins being abused on the systems.
- Tepix 10y ago
  A typical cheap chinese webcam will have an open telnet port.
- taspeotis 10y ago
  There is probably a correlation between IoT devices that get pwned and IoT devices that use Telnet.
  - H4CK3RM4N 10y ago
    Probably a very strong one at that.
- Neliquat 10y ago
  The sheer number of open telnet ports on IoT devices is staggering and embarrassing to our industury as a whole.
  - louithethrid 10y ago
    Its the fact that there is no market here- people do not know and will never know what they actually buy wit a IOT Device. They can not evaluate quality, and noone is liable for the risks. I guess some citys will have to get the plague first, before the governments quarantining is accepted.
- tyingq 10y ago
  Here's a Jidetech Camera that serves up telnet: https://www.amazon.com/Wireless-Security-Recording-One-Key-Setting/dp/B06X41WH4V https://www.amazon.com/Wireless-Security-Recording-One-Key-S... And an article on how bad it is: http://www.networkworld.com/article/3143133/security/iot-security-camera-infected-within-98-seconds-of-plugging-it-in.html http://www.networkworld.com/article/3143133/security/iot-sec... (98 seconds to being infected after exposing it to the internet)
  - ihsw2 10y ago
    Sounds like the bad old days when WinXP boxes were directly connected to the internet (as opposed to behind a router).
  - mnw21cam 10y ago
    From the article you linked: > The correct mitigation, Graham said, is to “put these devices behind your firewall” because “many of the Mirai passwords can’t be changed.” No, the correct mitigation is to not have one of those devices. You don't buy a rotten apple, and then store it on your kitchen table, because "it's fine because it's sealed in a plastic bag". Richards' Laws of Data Security: 1. Don't buy a computer. 2. If you must buy a computer, don't turn it on.
- 0xfeba 10y ago
  Oh, shield your eyes. The land of IoT is a land of infosec hell.
- pdkl95 10y ago
  Defcon 20 - Dan Tentler - "Drinking from the caffeine firehose we know as shodan" https://www.youtube.com/watch?v=5cWck_xcH64 https://www.youtube.com/watch?v=5cWck_xcH64 Warning - watching this may readjust your faith in humanity. Telnet is just the tip of the iceberg. edit: (15:42) "Econolite [stoplights] listening on telnet. There are intersections [with] stoplights; you can telnet into them and put them in 'test mode'[sic], and the warning says, 'Don't do this, you could kill people!'"
brudgers 10y ago
A recent discussion of the news, https://news.ycombinator.com/item?id=14201908 https://news.ycombinator.com/item?id=14201908
- cryptarch 10y ago
  No, that discussion and article are about Janit0r and his BrickerBot software. This article is about Hajime, a sophisticated trackerless BitTorrent-backed botnet with resillience and stealth functionality. Self-professed greyhat. Still relevant to this discussion, though.
neom 10y ago
I hope we start to see some pretty strong regulation around what type of computer can be put inside of non-standard computing device, and guidance and regulation on how it must be secured and updated. I work in city tech specifically around IoT and I'm incredibly worried about where all of this is going, cities DDoSing themselves in critical infrastructure points sounds pretty annoying.
- proaralyst 10y ago
  > annoying More likely fatal, or at least very costly. To expand: there was the recent[0] attack on Dallas' tornado alarm. Imagine that was a disabling attack ahead of a tornado instead. [0]: https://www.theregister.co.uk/2017/04/13/dtmf_replay_phreaked_out_the_dallas_tornado_alarm_say_researchers/ https://www.theregister.co.uk/2017/04/13/dtmf_replay_phreake...
- pjmlp 10y ago
  Including programming language restrictions and who to sue, like in other areas where human life is at risk.
- weberc2 10y ago
  > around what type of computer can be put inside of non-standard computing device What does "type of computer" mean? And why would this need regulation (are some "types of computers" less secure than others)?
  - neom 10y ago
    This: https://news.ycombinator.com/item?id=14247715 https://news.ycombinator.com/item?id=14247715 -- But also, there is no need to put a computer with a huge amount of resource in say, a baby bottle that can tell an app what temperature the milk is. In theory you could do a lot more (or at least different) damage with a P5 than a 486. The IoT stuff is usually cobbled together components, so we'll see things like a 500gig HD on a device (such as an environmental sensor for a city intersection) that passes off data and at most needs a couple gigs for OS and cache stuff. It's harder to start installing stuff on devices that are at the minimum specs for what they are designed to do. I'm not sure if that makes sense but I'm pretty sure there is some logic in there somewhere. Correct me if I'm wrong. it was just a thought. :)
ircshotty 10y ago
This seems like a good thing in theory... but if it's all all successful, where goes the inventive for manufacturers to be more careful about their code? Why should they make secure code if it's just going to be fixed for them? Also, where's the incentive for lawmakers to regulate IoT security if less people are affected?
- csydas 10y ago
  I think the general idea is more "they're not fixing it and there is no incentive, and while we wait and see if there is, botnets are spinning up huge DDoS attacks on demand, plus much much more." The vigilante concept implies some known disregard or dismissal for the current law/powers that be for whatever reason the vigilante is motivated by. Add in the vast number of products made in jurisdictions where regulations aren't well enforced or can be circumvented easily, and soon it starts to look a bit dire to wait for the proper authorities to work. I don't really know what to think about the Hajime botnet, but their motives are pretty easily understood.
  - noobiemcfoob 10y ago
    But they are fixing it. And there is incentive. People are just upset that it isn't happening faster, so they clamor for more incentive. IoT is a new born baby in an industrial filled with 3 year olds. I guarantee in 100 years, we all will seem bumpkins developing the WORST ideas of security.
Robotbeat 10y ago
Isn't this how Skynet starts in one of the Terminator films?
- overcast 10y ago
  Yes, the third one.
scrps 10y ago
It probably doesn't help that seemingly everyone is slapping a SoC into anything that has electricity, spending 0 time/effort to harden the device, providing little to no guidance to end-users on best security practices then pushing them out as fast as they can be manufactured at a fat markup. I recently saw an IoT room humidifier... Really?! How badly do you need to humidifier your (presumably unoccupied) room remotely? My garage door opener was internet-capable until I disable it. Some objects having remote accessibility makes sense but a lot of it is wow-factor marketing.
- noobiemcfoob 10y ago
  Just because you can't see a use for a connected device does not mean the use doesn't exist. And given the amount of time, energy and money that goes into developing any manufactured product, it doesn't happen on accident. There is a large market of people who have property too large to spend walking around all day turning on and off devices to keep everything copacetic. Simple, arguably stupid, devices with IoT capability can greatly reduce this. Then you move into any application slightly larger than a personal home and the power of managing all these devices with software at scale becomes immense. Specifically for the IoT room humidifier, I've seen such things in labs studying bugs or other exotic life that needs proper controls. These labs are setup by scientists who are just trying to get the conditions ideal and keep them that way and becomes an interesting mix of industrialized equipment and odd one-offs like a connected humidifier.
orng 10y ago
Anyone who has played Pandemic 2, or similar games where you control a virus intent on killing all humans, knows that the most effective strategy is to spread as far as possible with as little symptoms as possible before mutating into a killing machine. Apparently Hajime has update capabilities, so perhaps it is too soon to call the creators vigilantes?
- aaronchall 10y ago
  That's true, and a lot of effort is being poured into it. I hope that this activity is being sponsored by victims of botnets or their governments to reduce malicious infections, since the Internet of $#!^ has no incentive. This may be the best case scenario. You describe the worst case scenario. I hope you're wrong, but only time will tell.
- CLGrimes 10y ago
  This is a great point. While reading this, I thought it was Miari 2.0, but was pleasantly surprised to read that the creator(s) works as a benevolent vigilante. If (one of) the botnet creator(s) decides to become malicious, it will have a large network at it's disposal.
- brodie78382 10y ago
  Hajime is Japanese for 'beginning' - just saying.
jaboutboul 10y ago
If I really had to guess who was behind this I would guess it is the kid who was behind Mirai because of the similarities between the two. Seems like his unmasking by krebsonsecurity must have scared the crap out of him and he's now realized how stupid his pursuits were. May also be trying to find a way to lower the impending charges that will likely come. Plus, if his motivation was to take over other botnets, to earn some hacker street cred then what better way to win the ultimate battle by making sure no one else can hack into these devices again?
beeftime 10y ago
Good. I'd rather someone brick your wifi lightbulbs and discount guangdong webcams than hold the door open for ever-worse DDoS attacks.
rubatuga 10y ago
I'm disappointed with the media praising the actions of this IOT virus. Why do we have any reason to trust them? Articles should really be focusing on how these vulnerabilities are extremely dangerous, and that this should be a wakeup call for the introduction of stringent IOT standards
brodie78382 10y ago
Certain parts of the list of subnets avoided by Hajime strikes me as rather interesting... Some countries: - Ukraine; Region Vinnyts’ka Oblast’ /16 - Iran, Islamic Republic of; Region Tehran /16 - Germany Virtela Communications Inc Amsterdam, NL POP /16 - South Africa; Region Gauteng /16 Then: - General Electric's /8 - both Hewlett-Packard's /8 - US Postal Service's /8 and finally all of the US Department of Defence (obviously) I would have thought HP would be a goldmine seeing as they put anything and everything on public, proxied IP's. And why not avoid Xerox, Apple, and CIA subnets too while you're at it? Krebs has a more detailed writeup on this for anyone interested in reading more: https://security.rapiditynetworks.com/publications/2016-10-16/hajime.pdf https://security.rapiditynetworks.com/publications/2016-10-1...

83 points by Fjolsvith 10y ago

The article mentions Telnet login credentials about halfway through. Is that honestly what's happening? I'd assumed it was at least SSH logins being abused on the systems.

Tepix 10y ago
A typical cheap chinese webcam will have an open telnet port.
taspeotis 10y ago
There is probably a correlation between IoT devices that get pwned and IoT devices that use Telnet.
- H4CK3RM4N 10y ago
  Probably a very strong one at that.
Neliquat 10y ago
The sheer number of open telnet ports on IoT devices is staggering and embarrassing to our industury as a whole.
- louithethrid 10y ago
  Its the fact that there is no market here- people do not know and will never know what they actually buy wit a IOT Device. They can not evaluate quality, and noone is liable for the risks. I guess some citys will have to get the plague first, before the governments quarantining is accepted.
tyingq 10y ago
Here's a Jidetech Camera that serves up telnet: https://www.amazon.com/Wireless-Security-Recording-One-Key-Setting/dp/B06X41WH4V https://www.amazon.com/Wireless-Security-Recording-One-Key-S... And an article on how bad it is: http://www.networkworld.com/article/3143133/security/iot-security-camera-infected-within-98-seconds-of-plugging-it-in.html http://www.networkworld.com/article/3143133/security/iot-sec... (98 seconds to being infected after exposing it to the internet)
- ihsw2 10y ago
  Sounds like the bad old days when WinXP boxes were directly connected to the internet (as opposed to behind a router).
- mnw21cam 10y ago
  From the article you linked: > The correct mitigation, Graham said, is to “put these devices behind your firewall” because “many of the Mirai passwords can’t be changed.” No, the correct mitigation is to not have one of those devices. You don't buy a rotten apple, and then store it on your kitchen table, because "it's fine because it's sealed in a plastic bag". Richards' Laws of Data Security: 1. Don't buy a computer. 2. If you must buy a computer, don't turn it on.
0xfeba 10y ago
Oh, shield your eyes. The land of IoT is a land of infosec hell.
pdkl95 10y ago
Defcon 20 - Dan Tentler - "Drinking from the caffeine firehose we know as shodan" https://www.youtube.com/watch?v=5cWck_xcH64 https://www.youtube.com/watch?v=5cWck_xcH64 Warning - watching this may readjust your faith in humanity. Telnet is just the tip of the iceberg. edit: (15:42) "Econolite [stoplights] listening on telnet. There are intersections [with] stoplights; you can telnet into them and put them in 'test mode'[sic], and the warning says, 'Don't do this, you could kill people!'"

brudgers 10y ago

A recent discussion of the news, https://news.ycombinator.com/item?id=14201908 https://news.ycombinator.com/item?id=14201908

cryptarch 10y ago
No, that discussion and article are about Janit0r and his BrickerBot software. This article is about Hajime, a sophisticated trackerless BitTorrent-backed botnet with resillience and stealth functionality. Self-professed greyhat. Still relevant to this discussion, though.

neom 10y ago

I hope we start to see some pretty strong regulation around what type of computer can be put inside of non-standard computing device, and guidance and regulation on how it must be secured and updated. I work in city tech specifically around IoT and I'm incredibly worried about where all of this is going, cities DDoSing themselves in critical infrastructure points sounds pretty annoying.

proaralyst 10y ago
> annoying More likely fatal, or at least very costly. To expand: there was the recent[0] attack on Dallas' tornado alarm. Imagine that was a disabling attack ahead of a tornado instead. [0]: https://www.theregister.co.uk/2017/04/13/dtmf_replay_phreaked_out_the_dallas_tornado_alarm_say_researchers/ https://www.theregister.co.uk/2017/04/13/dtmf_replay_phreake...
pjmlp 10y ago
Including programming language restrictions and who to sue, like in other areas where human life is at risk.
weberc2 10y ago
> around what type of computer can be put inside of non-standard computing device What does "type of computer" mean? And why would this need regulation (are some "types of computers" less secure than others)?
- neom 10y ago
  This: https://news.ycombinator.com/item?id=14247715 https://news.ycombinator.com/item?id=14247715 -- But also, there is no need to put a computer with a huge amount of resource in say, a baby bottle that can tell an app what temperature the milk is. In theory you could do a lot more (or at least different) damage with a P5 than a 486. The IoT stuff is usually cobbled together components, so we'll see things like a 500gig HD on a device (such as an environmental sensor for a city intersection) that passes off data and at most needs a couple gigs for OS and cache stuff. It's harder to start installing stuff on devices that are at the minimum specs for what they are designed to do. I'm not sure if that makes sense but I'm pretty sure there is some logic in there somewhere. Correct me if I'm wrong. it was just a thought. :)

ircshotty 10y ago

This seems like a good thing in theory... but if it's all all successful, where goes the inventive for manufacturers to be more careful about their code? Why should they make secure code if it's just going to be fixed for them? Also, where's the incentive for lawmakers to regulate IoT security if less people are affected?

csydas 10y ago
I think the general idea is more "they're not fixing it and there is no incentive, and while we wait and see if there is, botnets are spinning up huge DDoS attacks on demand, plus much much more." The vigilante concept implies some known disregard or dismissal for the current law/powers that be for whatever reason the vigilante is motivated by. Add in the vast number of products made in jurisdictions where regulations aren't well enforced or can be circumvented easily, and soon it starts to look a bit dire to wait for the proper authorities to work. I don't really know what to think about the Hajime botnet, but their motives are pretty easily understood.
- noobiemcfoob 10y ago
  But they are fixing it. And there is incentive. People are just upset that it isn't happening faster, so they clamor for more incentive. IoT is a new born baby in an industrial filled with 3 year olds. I guarantee in 100 years, we all will seem bumpkins developing the WORST ideas of security.

Robotbeat 10y ago

Isn't this how Skynet starts in one of the Terminator films?

overcast 10y ago
Yes, the third one.

scrps 10y ago

It probably doesn't help that seemingly everyone is slapping a SoC into anything that has electricity, spending 0 time/effort to harden the device, providing little to no guidance to end-users on best security practices then pushing them out as fast as they can be manufactured at a fat markup. I recently saw an IoT room humidifier... Really?! How badly do you need to humidifier your (presumably unoccupied) room remotely? My garage door opener was internet-capable until I disable it. Some objects having remote accessibility makes sense but a lot of it is wow-factor marketing.

noobiemcfoob 10y ago
Just because you can't see a use for a connected device does not mean the use doesn't exist. And given the amount of time, energy and money that goes into developing any manufactured product, it doesn't happen on accident. There is a large market of people who have property too large to spend walking around all day turning on and off devices to keep everything copacetic. Simple, arguably stupid, devices with IoT capability can greatly reduce this. Then you move into any application slightly larger than a personal home and the power of managing all these devices with software at scale becomes immense. Specifically for the IoT room humidifier, I've seen such things in labs studying bugs or other exotic life that needs proper controls. These labs are setup by scientists who are just trying to get the conditions ideal and keep them that way and becomes an interesting mix of industrialized equipment and odd one-offs like a connected humidifier.

orng 10y ago

Anyone who has played Pandemic 2, or similar games where you control a virus intent on killing all humans, knows that the most effective strategy is to spread as far as possible with as little symptoms as possible before mutating into a killing machine. Apparently Hajime has update capabilities, so perhaps it is too soon to call the creators vigilantes?

aaronchall 10y ago
That's true, and a lot of effort is being poured into it. I hope that this activity is being sponsored by victims of botnets or their governments to reduce malicious infections, since the Internet of $#!^ has no incentive. This may be the best case scenario. You describe the worst case scenario. I hope you're wrong, but only time will tell.
CLGrimes 10y ago
This is a great point. While reading this, I thought it was Miari 2.0, but was pleasantly surprised to read that the creator(s) works as a benevolent vigilante. If (one of) the botnet creator(s) decides to become malicious, it will have a large network at it's disposal.
brodie78382 10y ago
Hajime is Japanese for 'beginning' - just saying.

jaboutboul 10y ago

If I really had to guess who was behind this I would guess it is the kid who was behind Mirai because of the similarities between the two. Seems like his unmasking by krebsonsecurity must have scared the crap out of him and he's now realized how stupid his pursuits were. May also be trying to find a way to lower the impending charges that will likely come. Plus, if his motivation was to take over other botnets, to earn some hacker street cred then what better way to win the ultimate battle by making sure no one else can hack into these devices again?

beeftime 10y ago

Good. I'd rather someone brick your wifi lightbulbs and discount guangdong webcams than hold the door open for ever-worse DDoS attacks.

rubatuga 10y ago

I'm disappointed with the media praising the actions of this IOT virus. Why do we have any reason to trust them? Articles should really be focusing on how these vulnerabilities are extremely dangerous, and that this should be a wakeup call for the introduction of stringent IOT standards

brodie78382 10y ago

Certain parts of the list of subnets avoided by Hajime strikes me as rather interesting... Some countries: - Ukraine; Region Vinnyts’ka Oblast’ /16 - Iran, Islamic Republic of; Region Tehran /16 - Germany Virtela Communications Inc Amsterdam, NL POP /16 - South Africa; Region Gauteng /16 Then: - General Electric's /8 - both Hewlett-Packard's /8 - US Postal Service's /8 and finally all of the US Department of Defence (obviously) I would have thought HP would be a goldmine seeing as they put anything and everything on public, proxied IP's. And why not avoid Xerox, Apple, and CIA subnets too while you're at it? Krebs has a more detailed writeup on this for anyone interested in reading more: https://security.rapiditynetworks.com/publications/2016-10-16/hajime.pdf https://security.rapiditynetworks.com/publications/2016-10-1...