12 ms·
A Teenager's IoT worm is bricking thousands of devices
- rimliu 7y agoOne of my favorite tidbits found on the HN was this: The 'S" in 'IoT' stands for 'Security' Alas, I do not remember whose comment was that.
- jcims 7y agoThat's a keeper, thanks for sharing :)
- henryackerman 7y agoYeah that phrase is all over the place. I even used it to open my presentation when I had to defend my bachelor's thesis :)
- 0xfffafaCrash 7y agoI think this may have originated with Oleg Šelajev's tweet[0] [0] https://twitter.com/shelajev/status/796685986365325312 https://twitter.com/shelajev/status/796685986365325312
- rimliu 7y agoI think you are right!
- theandrewbailey 7y agoThere is an "s" in the expanded form. It's last, unfortunately.
- gowld 7y agoIn the "Internet of Things", the "s" is for "security" and it comes after every "thing".
- devoply 7y agoIf they can be bricked, perhaps they should be bricked. Maybe this is something we should encourage going forward to encourage security for IoT? Maybe we should hold a Brickcon where security researchers try to develop ways to brick any insecure devices before they become a threat.
- adrianN 7y agoBefore you do this, please make a law that forces the manufacturers to replace the devices free of charge when they get bricked due to a security problem.
- Groxx 7y agoClass action lawsuits can be pretty effective at achieving this.
- tty2300 7y agoHaving a known security bug unpatched for longer than x days should be grounds for a warrenty refund. That should get companies moving when there is a real world cost for not dealing with security bugs.
- taneq 7y agoSounds like a grand way to ensure that nobody is willing to take the risk of building internet-enabled devices in the first place.
- dang 7y agoUrl changed from https://boingboing.net/2019/06/25/teenaged-kicks.html https://boingboing.net/2019/06/25/teenaged-kicks.html, which points to this.
- bifrost 7y agoTBH I trust Boingboing's integrity more than zdnet but I truly appreciate the transparency!
- tomhoward 7y agoI think it's more that the original source is preferred, out of respect to the producer of that content, rather than a "reblog" that doesn't add much substantive new info. BoingBoing is great, and plays an important role, but that role seems mostly to surface stories from elsewhere, highlight the key points and add its own editorial take, rather than generating original content.
- deleted 7y ago[deleted]
- gertrunde 7y agoI was wondering where the 'worm' designation for this came from, given that the source article doesn't mention the word at all, and the malware doesn't appear to hop from target to target as the term 'worm' would imply. Looks like boingboing embellished a little.
- Groxx 7y agoA quote from not the current worm's author, but the author of the worm that may be the inspiration for the current one: >The BrickerBot author argued that it would be better if the devices were destroyed, rather than sit around as cannon fodder for DDoS botnets, and haunting the internet for years. ... yea, broadly I'd agree. IoT vendors are causing a tragedy of the commons, inflicting quite a lot of damage without feeling any of the pain because it hits others. It's the sort of thing that should be addressed by legislation of some kind, but absent that (which includes nearly all international cases)... what else can you do to stop the worst offenders?
- Waterluvian 7y agoI don't think it's ever acceptable to make an "if I didn't do it, someone else may have done something worse" defense.
- Groxx 7y agoWhich is part of what causes tragedies of the commons, yes. I totally get your point, and it's valid, but it's being demonstrated right now that the current appropriate strategies have failed rather spectacularly. When appropriate measures have massively failed, what are the alternatives? Vigilante actions are one option, as is "watch the whole thing burn down", and probably an infinite variety of stuff in the middle and along different axes. What's your preferred option? edit: also, it's not quite "may [do] something worse". Insecure IoT things are used as botnets. Frequently. It's not a hypothetical threat at all, it's just a question of scale / frequency.
- tty2300 7y agoI see like a food safety inspector going around shutting down unsafe restaurants. These IoT devices are a danger to society and should be shut down.
- mehrdadn 7y agoDDoSes are as bad as food poisoning now?
- dvfjsdhgfv 7y agoThat's excellent. People still don't realize what the consequences of the so called "IoT" are - and the sooner they do, the better.
- SubiculumCode 7y agoThat's harsh, but probably spot on. Better to have the fear instilled while it is more of a PTA than a national catastrophe
- cs02rm0 7y agoWhat are the devices? Are all my lights going to turn off?
- wattengard 7y agoIf your light is exposed to the internet and use default security, maybe...
- mehrdadn 7y agoShouldn't be too hard to reset it if that happens. https://www.youtube.com/watch?v=1BB6wj6RyKo https://www.youtube.com/watch?v=1BB6wj6RyKo
- cs02rm0 7y agoI was joking, but it's sort of my point - who's exposing IoT devices to the internet?
- martin__ 7y agoAll IoT devices are exposed to the internet by design. That's what the "I" stands for, Internet.
- deleted 7y ago[deleted]
- henryfjordan 7y agoBut are the addressable? My IoT devices are on my network but you would need to get yourself inside my network to talk to them. I'm not exposing ports for my lights...
- SmellyGeekBoy 7y agoPeople use them as intended?
- deadbunny 7y ago
- reshie 7y ago"It's using known default credentials for IoT devices to log in and kill the system" basically its like knowing a computers root password with remote access apparently from anywhere. it looks pretty simple but effective and many iot devices are known for their lack of or lacking in security measures.
- wjnc 7y ago.. But is it a parthenogenetic worm? I recently read the Shockwave Rider [1] in which the word 'worm' was first coined, thanks to the discussion on HN [2] on Stand on Zanzibar. Can recommend both books for those into SciFi and would like to thank the community. [1] https://en.wikipedia.org/wiki/The_Shockwave_Rider https://en.wikipedia.org/wiki/The_Shockwave_Rider [2] https://news.ycombinator.com/item?id=19879830 https://news.ycombinator.com/item?id=19879830
- jcims 7y agoThe original title would be good enough for this story imho. Worked in a bug bounty program for a spell, there are some young folks out there with borderline scary levels of talent and tenacity. Making this about the age of the person doesn't really add anything. (This is coming from a relative dinosaur, so maybe I'm just age-sensitive haha)
- notyourwork 7y agoIn high school and middle school you also have a lot more flexibility to devote a substantial amount of time to this type of stuff. You are right, it can result in really technically literate individuals.
- kahlonel 7y agoFunny how they believe that he is actually a teenager. Like the creator will reveal his real age.
- Nokinside 7y agoIf you have seen electric wiring inside houses from 1920's, that's the state of IoT and internet connected devices today. Bad things must happen first for standardization and regulation to happen. Consumer devices and gadgets are not my main concern. Internet connected building automation is in similar sorry state. Someone will do large scale apartment automation systems attack, maybe just single manufacturer is targeted and as a result 5-15% of apartments go nuts at once. Just messing with the air conditioning can kill old and sick people until things get fixed.
- tgsovlerkhgsel 7y agoMessing with the air conditioning can affect a lot more than just the people who have the vulnerable IoT air conditioner, if it manages to bring the grid down. The grid is able to cope with fluctuations in demand, but that's a totally different ballgame than switching massive loads on and off, synchronized to within something like 20 milliseconds (a single 50 Hz cycle), in a controlled, intentional and malicious way - and potentially worse, the attacker could observe the grid and react to the countermeasures (e.g. to detect how quickly the grid reacts, and trigger oscillations in some system never designed to deal with something like that).
- BorRagnarok 7y agoGreat article, but for the Iran smearing. Come on zdnet, you know better. Out of the thousands of ip addresses related to this attack, including a command and control center etc, whilst knowing that an attack from a VPN in Iran does in no way prove that the attacker is indeed from Iran or even Iranian, still you managed to insert a whole paragraph titled "Attacks carried out from Iranian server" in there, even though the researcher says the ip only "appears" to be from Iran, and he describes one (1!) attack from that ip. This wasn't even the command-and-control server. And that 14-year old is living in Europe, not Iran. Please leave the propaganda out of your tech news, zdnet.
- SmellyGeekBoy 7y agoWe've always been at war with Eurasia!
- chrisjc 7y agoInteresting that you interrupted it in this way. Maybe that speaks more of your own biases than it does of those in the HN community? :) Anyway, my immediate thought (before the article got to the teen) was that this attack might have be spillover from an attack by the US on Iranian systems. Or at least an hint at how exposed Iran's digital infrastructure might be to future attack from the US in light of recent events. Or maybe how this will get Iran to tighten up it's digital infrastructure before such an attack from the US could happen. I also immediately didn't think that the origin of Cashdollar's attack had anything to do with the origin of the creator or perpetrator.
- blue_devil 7y ago>It's expected that some owners will most likely throw devices away, thinking they've had a hardware failure without knowing that they've been hit by malware. And... more trash. Ugh
- SmellyGeekBoy 7y agoHopefully a lot of these devices are still under warranty and will be returned, but yeah...
- OJFord 7y agoThat's surely just adding miles to the journey, I doubt a returned bricked device is getting repaired or salvaged for parts by the OEM.
- icebraining 7y agoAccording to the article, it just needs a firmware reflash, so I don't see why a manufacturer couldn't repair it and return it to the customer.
- cameronbrown 7y agoMoney - not to mention these devices will just get re-bricked. They have to fix the fundamental problem first.
- kuon 7y agoI did a few stupid things when I was around this age, but Internet was nearly non existent so it was mostly within LANs. I agree that IoT is a real problem, and I fear people will realize too late, with an accident or something, but this kid should have known better, depending in how it unfolds he could be in trouble.
- chrismatheson 7y agoI’d love to read this article, but it’s so covered with ads and shit I can’t. Reader mode is usually my saviour in this situation, but it’s not working in this site.
- jeroenhd 7y agoI personally see Brickerbot as the IoT version of Shodan. Port scanning and probing is considered illegal and immoral in many countries around the world yet Shodan has made the Internet more secure, by opening access to port scanning and making it impossible for companies to just "hide" new tools. I'd prefer to see ISPs/governments taking action against dangerous IoT devices in their network (sending probes to vulnerable devices and blocking Internet access until the owners of the devices have secured their shit or provide proof of running a honeypot). We can't really expect such measures from companies right now, but a tool like Brickerbot might kickstart a movement. I'd prefer the bot to just change the password and disable vulnerable services though (which still might brick devices if their web servers are vulnerable). Still, I do believe that why device fallen to Brickerbot would have fallen to any other botnet within days anyway, so the botnet is not inherently bad in my opinion. This problem should stary disappearing as soon as legislation is introduced by governments to make the parties producing software or hardware responsible for the stuff they dump on the open market. Until then, steps have to be taken to stop DDoS attacks as they are getting worse and worse.
- autoexec 7y ago> Port scanning and probing is considered illegal and immoral in many countries Do you know of a country where this is true? I know there are some broadly worded laws in England against the use of "hacking tools" but there are so many legitimate uses of port scanning that it'd be hard to explain why a port scanner is any more of a hacker tool than traceroute is.
- fyfy18 7y agoIn the UK it's not illegal per se, but if you go by the letter of the law you could be convicted under the Computer Misuse Act for it. But at the same time you could be convicted for sending a HTTP GET request to a server you don't have permission to access - this law is rather broad. I'm not sure if there's even been a case to test it though, and as the general population becomes more tech savvy it seems unlikely such a conviction would be made for port scanning on it's own.
- jeroenhd 7y ago
- b_tterc_p 7y agoI do wonder... manufacturers aren’t liable if you allow your device to be bricked by third parties. But if such attacks were so extremely normative and carried out in such a way that they informed the user why they are possible... could the manufacturers become liable to address it?
- PhilDunphy23 7y agoI always asked myself this question: does this kind of attacks try to authenticate to every single IP address (for loop, excluding ranges from Google, Microsoft, Apple...) or does it penetrate the victim network first by executing some random file from the internet that the victim downloaded?
- prewett 7y agoI'm going to suggest that maybe this is a good thing. If the worm is really good at its job, it can take out all those zombie IoT devices that are being used for botnets. And it maybe it will act as a wake up call to consumers, regulators, and, perhaps, companies. Not that I condone destroying people's property to accomplish that, but at least there is a potential upside.
- bcheung 7y agoWhich IoT devices does this affect? Is it just devices that run Linux and have an exposed SSH? Wondering if things like the Particle.io / Obniz / ESP8266 are affected.
- ViViDboarder 7y agoThe article says the kid wants to add SSH later and suggests that it uses telnet today.
- deanclatworthy 7y agoInteresting that this “worm” just bricks the devices instead of repurposing them to attack targets autonomously.
- eleitl 7y agoHe's doing $deity's work. The Internet of shit needs to be culled, before it can wreck more damage.
- Glyptodon 7y agowreak?
- noonespecial 7y agoWould be way better if the worm reported back which devices were vulnerable (for naming and shaming) as it found them instead of ruining peoples' stuff just to make a point (or worse, plain lulz)
- iforgotpassword 7y agoSo what would that look like? You found some vulnerable webcam, great now you can add its IP address to your public shaming list. That'll teach that random farmer somewhere in Iowa. Listing the device name and count wouldn't do anything; the vulnerability is already known otherwise the worm wouldn't exist... And either the manufacturer doesn't care, or there's an update and nobody cares. If otoh you brick the device in a way that requires flashing via jtag and suddenly have hundreds of people all over the country return their broken webcam to WalMart you make a little more impact. The thing is, it would have to keep happening for stores to start noticing a pattern and start caring. If it was a one time thing it might be cheaper for then to just throw them in the trash and hand out new ones or refund.
- wjp3 7y agoVLAN your devices, and deny and outside route, if you can.
- throwayEngineer 7y ago"It's using known default credentials for IoT devices to log in and kill the system", Ah the good ol, "guessed the password". The longer I live, the less impressed I am of "hackers". 99% social engineering...
- oytis 7y ago> Who's behind the Silex malware? Maybe people who set the same password on the whole fleet and don't make the user override it? Come on, you can't take the responsibility from well-paid incompetent professionals and put it on a teenager from a third-world country.