BrickerBot, the Permanent Denial-of-Service Botnet, Is Back With a Vengeance (arstechnica.com) 113
An anonymous reader quotes a report from Ars Technica: BrickerBot, the botnet that permanently incapacitates poorly secured Internet of Things devices before they can be conscripted into Internet-crippling denial-of-service armies, is back with a new squadron of foot soldiers armed with a meaner arsenal of weapons. Pascal Geenens, the researcher who first documented what he calls the permanent denial-of-service botnet, has dubbed the fiercest new instance BrickerBot.3. It appeared out of nowhere on April 20, exactly one month after BrickerBot.1 first surfaced. Not only did BrickerBot.3 mount a much quicker number of attacks -- with 1,295 attacks coming in just 15 hours -- it used a modified attack script that added several commands designed to more completely shock and awe its targets. BrickerBot.1, by comparison, fired 1,895 volleys during the four days it was active, and the still-active BrickerBot.2 has spit out close to 12 attacks per day. Shortly after BrickerBot.3 began attacking, Geenens discovered BrickerBot.4. Together, the two newly discovered instances have attempted to attack devices in the research honeypot close to 1,400 times in less than 24 hours. Like BrickerBot.1, the newcomer botnets are made up of IoT devices running an outdated version of the Dropbear SSH server with public, geographically dispersed IP addresses. Those two characteristics lead Geenens to suspect the attacking devices are poorly secured IoT devices themselves that someone has compromised and used to permanently take out similarly unsecured devices. Geenens, of security firm Radware, has more details here.
Denial-of-Service? (Score:5, Insightful)
BrickerBot, the botnet that permanently incapacitates poorly secured Internet of Things devices
Denial-of-Service botnet? Sounds more like a Public-Service botnet to me.
Re:Denial-of-Service? (Score:5, Funny)
Securing them for good before they can secured for evil.
Re: (Score:2)
Re: (Score:2, Insightful)
I would mod parent up if I could.
We made a big mistake when we made cracking into things illegal. We should have made cracking into things legal and made people put up impenetrable walls. This is computers and data. There are walls that anyone can put up that can keep out governments. This would have created demand for real security and by now we'd have it ubiquitously without trying.
I hope this guy doesn't get caught, and I appreciate and do not encourage his actions.
Re:Denial-of-Service? (Score:5, Insightful)
While I generally agree, I cannot second the idea that it should be legal to break into computers that are insufficiently secured. That would make the internet an even worse place than it already is.
What we need is something like the famous FCC part 15 sticker rules. You know the ones, you can find it on pretty much any electronic device:
(1) This device may not cause harmful interference, and
(2) this device must accept any interference received, including interference that may cause undesired operation.
We need something like this for IoT devices.
Re: (Score:2)
What, you mean like the early 1970's? Because laws outlawing hacking, or "phreaking" as it was called in the day are about that old.
Re: (Score:2)
Understand that this was a very different time than today. When back then someone hacked you, it was for shits 'n giggles. You did it to show off, or you needed a few MB of space online so you created a backdoor to a server where you and a friend could move some data to and from. The damage was negligible. What we did was mostly repurposing resources for our own little benefit.
What you're dealing with today is criminal organizations aiming for money. To draw a parallel, what we did was going out in our litt
Re: (Score:2)
Re: (Score:2)
Few here are probably old enough to actually know how those stickers helped.
Of course the stickers themselves did little. But the requirements to be allowed to glue those stickers to your gear are as described on the sticker. And before the stickers, electric gadgets interfering with each other was a big deal. Even well after WW2 high frequency interference from electric tools was still a big issue. Today, with electric appliances working on FAR lower voltages and using FAR less electricity, along with bett
Re: (Score:2)
Better that IoT toys should display a message from BrickerBot to the effect that "The manufacturer of this device compromised your security. It has been disabled to protect you. Contact the manufacturer for further details."
This dumps the burden back on the creator of the garbage so they either move security up the priority list or go out of business. OK, so maybe it fibs a little, but only a little.
Re: (Score:2)
Re: (Score:2)
Well, IoT devices are at least halfway there. A lot of them will in fact accept any "interference" at all, and happily do whatever they are asked. Even if they are asked to violate the first rule.
Re: (Score:2)
Technically, you don't have to break into anything when the door is left wide open.
Re: (Score:2)
Yet still when I enter your home unasked it's trespassing, even with your door wide open.
Re: (Score:1)
I would mod parent up if I could.
We made a big mistake when we made cracking into things illegal. We should have made cracking into things legal and made people put up impenetrable walls. This is computers and data. There are walls that anyone can put up that can keep out governments. This would have created demand for real security and by now we'd have it ubiquitously without trying.
I hope this guy doesn't get caught, and I appreciate and do not encourage his actions.
So you have people with no technical skill in coding, or getting into their hardware buying a device, just say baby monitor and it is alright for a person to hack into it because these people do not have the technical knowledge to secure it better? This is asinine. It is like saying "It is fine to steal a persons car if you can because the person should have secured it better". Doesn't matter if it had an alarm and an immobilizer, was locked in a secure garage that was alarmed. If I can steal it it si the o
Re: (Score:2)
Actually, no... If you leave your keys in your car, you simply cannot make a recognized insurance claim if it is stolen. It may certainly be illegal to leave the keys in a car that you do *not* own without consent of the owner, however, but it is not illegal to leave your keys in your own car. Waxing hypothetical, here, it would only be illegal to leave your keys in your own car if it were somehow an actual legal requirement for you to
Re: (Score:2)
So you have people with no technical skill in coding, or getting into their hardware buying a device, just say baby monitor and it is alright for a person to hack into it because these people do not have the technical knowledge to secure it better?
Right, just like all of those people who have no experience in machining who are all buying that one car where every car opens and starts with the same publicly-known key, and they are getting their cars stolen just because they don't have the experience to manufacture their own lock, ignition system, and key?
Man, it's almost like the burden should be on the manufacturer to deliver a product that can't easily be broken into by default.
Re: (Score:2)
If you're stupid enough to buy broken devices... at least consumer protection laws lets you return the crap.
Re: (Score:2)
consumer protection would outlaw insecure devices. the consumer is not at fault for believing the device maker as atleast made an attempt to make the device safe for use, like all other things consumable. otherwise the maker gets sued... or perhaps its time for the makers to get sued.
Re: (Score:2)
I would suggest that just as much responsibility should be on the consumer to try and verify that the device they purchase is actually secure as should be on the provider of those devices. If consumers are too lazy or indifferent to bother, they should be treated exactly the same as small children who haven't yet learned that they need to look both ways before crossing a street.
If a person runs a red light and kills somebody, you don't go after the automobile manufacturer... you go after the guy who br
Re: (Score:2)
your analogy doesn't fit a secure worthiness of a electronic device. Most users would be just at loss when considering the myriad safety features and potential pitfalls of their vehicles and thus rely on the almost perfect (right!!) *** rating system. and at least its rather understandable to consider seatbelts (check) brakes (check) airbag (check) vs... is this device running the latest updated version of the linux distro, the apps are secured and there is firewall in place not to mention default username
Re: (Score:2)
How should the consumer verify this? It's not like there is a button they could push to verify the security of the device. Hell, until the hack comes alone, more often than not even the manufacturer doesn't know it.
Re: (Score:2)
Re: (Score:2)
Unfortunately we security researchers don't get preview demos of those things. We buy them just the same way you do.
Re: (Score:2)
Re: (Score:2)
Certainly, but by the time we finally get to report it (because, face it, if you really have something cool you wait for the next big conference to let the bomb go off, who gives a shit about publishing something on his homepage when Black Hat is in 3 weeks?) thousands have already bought the insecure piece of junk and the damage is done.
Re: (Score:2)
My point was that experts can teach people what things to look for... that was my point... ideally people will learn about the technology themselves from such people and learn what sort of things they should be looking for when it comes to vulnerabilities.
I'm not suggesting that such education should necessarily be freely given by experts without any compensation, but I don't think it's an unreasonable demand on consumers who don't know how to tell if their devices are secure to put some effort into lear
Re: (Score:2)
Teaching and learning depends on two people's agreement: One who teaches, and one who learns.
We have been trying to teach. But the only ones that learned something were we: We learned that nobody wants to learn.
Warranty law (Score:2)
TODO:
Change your US warranty laws, so such bricked device must be replaced for free. (See europe for an example)
(It's a device. It was used as it is supposed to be by the end user. The end user didn't subject it to any abuse.
The device suddenly stopped working unexpectedly. It has to be replaced under warranty).
That will teach the manufacturer of shitty goods.
BrickerBot (Score:4, Insightful)
Re: (Score:2)
The hero the Internet of Things both deserves _and_ needs.
I hope they catch the wrong guy/gal.
Re: (Score:3)
The hero the Internet of Things both deserves _and_ needs.
Yeah .. there's nothing like a vigilante of whom you approve.
Re: (Score:2)
The hero the Internet of Things both deserves _and_ needs.
Yeah .. there's nothing like a vigilante of whom you approve.
I think it maybe Fratman
Re: (Score:3, Insightful)
The hero the Internet of Things both deserves _and_ needs.
Yeah .. there's nothing like a vigilante of whom you approve.
Yes it is vigilante and we suppose to condemn such things. However, what the alternative? Internet Weather with DDoS storms routinely taking big chunks of it down? Markets completely failed to solve this problem, legislation isn't feasible considering international nature of this... so vigilante is least bad solution here.
Re: (Score:2)
so vigilante is least bad solution here.
A bad solution is still a bad solution. And vigilanteism is still vigilanteism. And DDOS attacks using infected devices are nothing new, it is just that IoT have opened up a new attack vector. Look at how many Windows based computers have been involved in DDOS in the past.
What we have here is:
1. Unknown person breaks into a computer they do not own.
2. Unknown person does stuff to this computer (unknown to the owner) under the pretense of "fixing it".
3. Ironically (according to TFS) the unknown person may
Re: (Score:2)
Yes, it's a bad solution, and it's undeniably vigilantism as well. But, like democracy, it's still the best (and at present, only) solution we currently have that is working at scale. The Zero Day Initiative typically gives vendors 90
Re: BrickerBot (Score:1)
Re: (Score:2)
It's a tough question tyhough. I can't say I support BrickerBot, but at the same time, how would you feel if your website (or just one you really want to browse) is down and unlikely to return because of a bunch of internet enabled paper clips?
Re: (Score:2)
A bad solution is still a bad solution.
Just out of curiosity, what is the good solution to the problem of a vast network of unsecured or insecure IoT devices that have already been deployed? Instead of describing what manufacturers should have done, what good solution do you have for the existing problem?
How would you feel if this was your IoT device that was attacked?
How do you feel when IoT botnets deliver DDOS attacks in the range of hundreds of gigabits per second? Are you still looking for that good solution to the existing problem?
Re: (Score:1)
Yeah .. there's nothing like a vigilante of whom you approve.
That Batman is the #1 superhero indicates that a very large majority of the public recognizes that the State is limited in ability, resources, effectiveness, and competence.
Imagine you're at a shopping mall, some nut comes in and starts throwing knives at passersby, taking out one shopper every five to ten seconds. There's a grandpa there packing a 9mm under his coat. Do you:
a) want the grandpa to take out the knife-attacker
b) call 911 and wait
Re: (Score:2)
Imagine you're at a shopping mall, some nut comes in and starts throwing knives at passersby, taking out one shopper every five to ten seconds. There's a grandpa there packing a 9mm under his coat.
False equivalence. In order to be comparable your "grandpa" would have be driving around town, spotting people with knives that grandpa considers dangerous, and then executing them. See Duterte for a great example of how this goes.
Re: (Score:2)
With the difference that the grandpa can flawlessly identify those that pose a threat. Because the IoT devices that get bricked that way are exactly those that would get taken over by a botnet. If they can't be taken over by botnets, the brickerbot cannot affect them either.
Re: (Score:2)
I'm very skeptical of this "police are less dangerous than armed citizens because of their training" argument. Police get stressed just like everyone else and their track record on protecting innocent bystanders is less than stellar.
Remember those idiots in California who fired over 100 rounds at two women in a blue Toyota .... which they somehow managed to mistake for Chris Dorner's gray Nissan? How about the cops in NYC who shot 3 innocent bystanders and injured 6 others near the Empire State Building a
Re: (Score:2)
Vigilantes rise where the law is insufficiently able or completely unable or, worse, unwilling to deal with criminals that affect the population. There, and only there, you will find vigilantism.
Re: (Score:2)
Vigilantes also rise from ideology, more commonly in orthodox religious or right-wing political leaning ones historically, though recently(as in the last 60 years), left-wing and some more liberal religious groups have started to engage in vigilante behaviour too
Re: (Score:2)
Criminal neglect is still criminal.
Vigilante definition (Score:2)
Vigilante definition, from Online Webster:
: a member of a volunteer committee organized to suppress and punish crime summarily (as when the processes of law are viewed as inadequate); broadly : a self-appointed doer of justice
Note the parenthetic comment - "when the processes of law are viewed as inadequate".
In this case, the processes of law are NON-EXISTENCE. It is by definition inadequate. Yes, this is vigilante justice, mainly because our governments have totally failed to properly regulate these issues.
We need a simple government agency to report internet based vulnerabilities. Once reported, the manufacturer should have one month to fix it - and push the fix out. With monetary
Re: (Score:2)
"We need a simple government agency"
LOL Don't you keep up with the news? When government agencies find vulnerabilities, they don't report them, they exploit them!
Re: (Score:2)
Yes because that is their mission. Your complaint is that they are too EFFECTIVE.
There are lots of solid evidence that people dislike government because it is too good at what it does. Then they undermine the government and laugh and say "Hey, now that we have handcuffed them, they can't do anything right.!
Which is why I want to create one to protect us rather than spy on us.
Government agencies are actually more effective than businesses (two thirds accomplish thier goal, vs 1 third for small business).
Re: (Score:1)
Nothing is completely secure and anyone who claims otherwise is full of shit. I'm not going to get into an OS war, but event he most secure OS has it's flaws, the biggest being the users. You can't fix stupid and stupid people are going to make stupid decisions with security. If you hardcode password/key that is the same on every device, put in a back door, install outdated software, or make other bad configuration mistake you are going to get hacked no matter how secure your OS is. The majority of these Io
Re: (Score:2)
If Linux is so secure, then why is it being exploited in this case,
'Linux' isn't being exploited, the crappy applications people wrote to run on Linux are.
Any app that accepts incoming data from the internet can be vulnerable to buffer overflows, etc.
Apps written by the cheapest available people in a 3rd world country? Doubly so.
Re: I thought Linux was supposed to be secure? (Score:1)
Re:I thought Linux was supposed to be secure? (Score:4, Interesting)
The problem is threefold.
Firstly lack of updates, SoC vendors are notorious for porting one or two versions of Linux, throwing it over the wall to device vendors and then doing nothing to keep it up to date. Some SoCs can be use with upstream kernels but very often with reduced functionality. The device vendors in turn add their own customisations to that kernel that the SoC vendor threw over the wall. Quickly you end up with something that cannot reasonablly be updated to a new upstream version. It is possible to some extent to backport security fixes, but it's a lot of work so it is likely to get skipped entirely or at least restricted to the most-severe vulnerabilties.
Secondly the vendors doing the work often do it without really caring about security which can lead to busting big holes in the user-security model. Remember "exynos-mem"?
Thirdly if your application layer is full of holes then attackers will be able to get whatever privilages that application has. If that is root then the attacker has full control of the device. Even if it is not root the attacker may well be able to elavate to root due to the first and second points.
Re: (Score:2)
Maybe we need to forget trying to secure devices and instead try to secure the router. Each device would have a profile, something like "can only access this short list of IP addresses, rate limited to X bytes/second and capped to X bytes/day." Literal alarm bells when limits are exceeded, with the device auto quarantined.
Re: I thought Linux was supposed to be secure? (Score:2)
Insecurity isn't a necessary component of corporate data-harvesting... it's quite possible to make a device with robust, impenetrable security that encrypts & transports vast quantities harvested data to its corporate masters.
These are the REAL problems with most IoT devices:
1. Devices with 8-bit MCUs that treat the internet like a UDP-implemented serial port & have no meaningful security of their own.
2. Linux's (intentional) lack of a stable kernel ABI, which makes it all-but-impossible for end use
Re: (Score:2)
The lack of stable interfaces (both ABIs and APIs) mean that not only can you not upgrade the propitary bits but you can't easilly upgrade the rest of the kernel either. Your hardware drivers stop you from easilly upgrading your network stack or the code that manages privilage seperation.
Re: (Score:2)
Don't forget they're trying to hit impossible price points with terrible economies of scale. Any feature that's not directly visible to the consumer (like quality software engineering) is a non-starter.
Re: (Score:3)
Nothing is so secure that a complete idiot can't screw it up and render it insecure (consider, fort Knox but someone stands the guards down and leaves the doors and vaults open).
When we say Linux is more secure, what we mean is that a reasonably competent person has a better chance of coming up with a reasonably secure Linux machine than they do using another OS.
Re: (Score:2)
The hero the Internet of Things both deserves _and_ needs.
A hero of the Internet? We shall dub them, Bricky McBrickerson! ;)
Re: (Score:1)
Is it a bird? (Score:2)
Is it a plane?
No it's Super Hacker Nerd!!
Leaping the Internet Of Things in a single bound
Re: (Score:2)
The idea behind the IoT isn't bad. The execution is horrible.
The idea that you can use the internet as a medium to access parts of your home isn't that bad an idea. That the whole shit is done by corporations that only care about their bottom line and offer your gimmicky toys that are security nightmares is the horrible execution thereof.
Re: Good - burn it down (Score:1)
Looking at my firewall logs (Score:5, Informative)
If you're reading, Janit0r (or whatever your current pseudonym is), keep up the good work! Might be worth taking a look at what's going on with Port 81 as well... Just sayin'
Re: (Score:2)
So all IoT toys use the same port number??
I find that impossible to believe.
Re: (Score:2)
You may have read too much into that post.
Re: (Score:2)
impossible? or just really stupid...
Ignoring the real problem, lack of a secure OS (Score:2)
People want to be able to put code in a box, and have code to function without unwanted side effects. The consistent cognitive bias is towards placing blame on certain groups or practices as being at fault, then piling on.
This approach consistently ignores the root cause, the lack of a widely used, secure operating system for anything smaller than an IBM mainframe.
If your OS can't be counted on to limit the side effects of a program to those chosen at runtime, you can't trust it.
Windows doesn't do this, no
What Solutions are there? (Score:1)
Hmm.
Nobody likes vigilantes! (Not even Batman).
But a serious question: How can people be protected?
While the techies can home brew something, what real products or solutions are
there for the "casuals", the civilians and the "tech-vulnerable" ??
Are there are any fairly cheap, zero configuration overhead solutions out there right now?
Any options?
Re: (Score:2)
Yeah. Don't buy IoT devices. Actually, that's the best option for geeks, too. If you want an IoT device, build it yourself.
Re: (Score:1)
In the ideal world, everyone would do so, but we do not live in that one.
And the list of IoT devices will expand to include, basically, ... everything.
Every electricity meter, every freezer, every microwave, every TV.
So for the people who cannot create their own solutions, what options are there?
Re: (Score:2)
"If this goes on..." then there aren't any solutions for anyone. That's one of the arguments for why BirckerBot & kin are social services.
For *now* the correct solution is to refuse to buy IoT devices, or if you must, refuse to register them, or don't connect them to the internet and put them in a Faraday cage (if they use WiFi). (Well, you don't need a full-blown Faraday cage...just blocking a few wave-lengths sufficiently should suffice.) And if that won't work, return them as defective.
This rewards IoT device developers (Score:2)
2. BrickerBot renders them nonfunctional.
3. Customers no longer have a working IoT device, so they're in the market for a replacement.
4. Profit!
reward: short term vs long term (Score:1)
5. Consumers have to return broken device or re-purchase cheap IoT until they felt it is no longer worth constantly replacing broken device. Lowering the demand for IoT device.
6. IoT developers have to constantly replace broken device until they either drop the IoT design, update security or face bankruptcy.
they may sell more IoT device in the short term, but overall they will fail to profit in the long term.
WTF is telnet enabled, and default passwords? (Score:2)
The real problem is that IDIOT (Insecurely Designed Internet Of Things) devices can be accessed from the net via telnet, with default passwords, or even no passwords. I don't care if you're running linux, Windows, BSD, OS/2, or whatever; using telnet is begging to be owned.
Telnet is an ancient, insecure protocol, from "a kinder/gentler time". When DARPAnet was started as a US-only project, you needed security clearance to access a mainframe or mini computer that could access the net. Every April 1st, there
Hyderabad escort service (Score:1)