Author of BrickerBot Malware Retires, Says He Bricked 10 Million IoT Devices (bleepingcomputer.com) 149
An anonymous reader writes: The author of BrickerBot -- the malware that bricks IoT devices -- has announced his retirement in an email to Bleeping Computer, also claiming to have bricked over 10 million devices since he started the "Internet Chemotherapy" project in November 2016. Similar to the authors of the Mirai malware, the BrickerBot developer dumped his malware's source code online, allowing other crooks to profit from his code. The code is said to contain at least one zero-day. In a farewell message left on hundreds of hacked routers, the BrickerBot author also published a list of incidents (ISP downtimes) he caused, while also admitting he is likely to have drawn the attention of law enforcement agencies. "There's also only so long that I can keep doing something like this before the government types are able to correlate my likely network routes (I have already been active for far too long to remain safe). For a while now my worst-case scenario hasn't been going to jail, but simply vanishing in the middle of the night as soon as some unpleasant government figures out who I am," the hacker said.
Re:what a maroon (Score:5, Insightful)
Re: (Score:2)
That's just it though - he doesn't need the key to the fucking city.
Re:what a maroon (Score:4, Funny)
Re:what a maroon (Score:4, Funny)
Re:what a maroon (Score:2)
It could be worse, if it were intel management engine, it would have an empty root password.
If I recall the reports correctly, the IME didn't have an empty root password. Instead it checked the number of bytes that the code running in the remote browser said were the length of the hashed password - rather than the number of bytes the IME server-side code knew were the length of a hashed password.
So if you entered a zero-length password on the normal web page, you'd fail to log in. But if you hacked up you
Re: (Score:2)
... if you hacked up your own version of the page's code that would say the hashed password was zero-length, ...
I.e. send a "hashed password" that was zero-length.
Re: (Score:1)
That's exactly what my dad told me actually. He used to tell me I was bringing it upon myself by "being different." Of course he used to beat me too, so there is some question as to how unbiased his opinion on the matter really was.
Re: what a maroon (Score:2)
Re:what a maroon (Score:5, Insightful)
No, he bricked broken IOT(S) devices to stop them from attacking others. A bricked device is harmless, and there's even hope it gets returned to manufacturer. On the other hand, one that's part of a blackhat botnet is bad for everyone.
Re: (Score:1, Troll)
A bricked device is not harmless: it has to be replaced. If the average price of those devices was as low as $10, he caused $ 100 million in damage.
And he left the owners of those devices with no clue as to what was going on. The user only noticed his device had become unusable, and would be far more likely to assume a hardware problem than someone remotely disabling his device (let alone divine WHY someone chose to do that).
Re: (Score:1)
A bricked device is not harmless: it has to be replaced. If the average price of those devices was as low as $10, he caused $ 100 million in damage.
One can only hope the damage is big enough to make the manufacturer start paying attention to security. IoT with no security is a disaster waiting to happen, as they become part of botnets and then are used to DDoS important stuff, which will cause at least as much in damage as you are claiming...
Re: (Score:2)
One can only hope the damage is big enough to make the manufacturer start paying attention to security.
Right....because consumers are just going to pass those costs right back to the manufacturers...
Or do you have some juvenile fantasy that "word will get around" that $MANUFACTURER's devices are falling over, and refuse to buy any more, thereby forcing $MANUFACTURER to upgrade their security?
Re: (Score:3)
Yes, but that cost needs to be paid for by the manufacturer who has sold you a faulty device with a vulnerability.
Re: (Score:1)
Imagine if you were sold a car for example that had a design flaw in the locking system allowing anyone to remotely unlock the doors with an exploit, or start the engine. Obviously you'd want it fixed, but unless these things are brought to public attention the company could just claim that it's bad luck that your car got stolen and they've nothing to do with it.
This guy "called attention" to the flaw by setting fire to every car with a flaw in its locking system, inconveniencing the owners and NOT INDICATING why he did that. His "cure" was worse than the problem.
Re: what a maroon (Score:2)
Re: what a maroon (Score:2)
Re: what a maroon (Score:2)
Re: what a maroon (Score:2)
Re: what a maroon (Score:2)
Re:what a maroon (Score:5, Interesting)
He used publicly known exploits, so if he didn't get there first it was only a matter of time before someone else did.
Since most people wouldn't even know their device was part of a botnet, this is the best outcome. They will return it to the shop as defective or get a software update from the manufacturer.
Re: what a maroon (Score:2)
Spare us the left-wing lunacy! (Score:2)
For a while now my worst-case scenario hasn't been going to jail, but simply vanishing in the middle of the night as soon as some unpleasant government figures out who I am," the hacker said.
It's 2017, FFS. In the West, that insane drivel stopped the day W left office, and is Putin going to throw you in the Gulag, or have a show trial, and the throw you in (a very nasty, but public) prison.
Re: (Score:2)
Re: (Score:2)
Do we know what country he is in?
Re: Spare us the left-wing lunacy! (Score:2)
Well he is not that stupid is he?
Re: (Score:2)
Exactly. He might not be in 'the west.' He may well be in the sort of country where it is reasonable to fear the government may disappear him, or an angry business owner might ask the local mafia to take care of him.
Re: (Score:3)
He is obviously in Italy since this is published on it.slashdot.org
Re: (Score:1)
I don't think he means vanished into a prison or shallow grave. It's more likely a vanished in the way scientists connected to German weapons programs vanished from Germany at the end of ww2.
aka you don't have a choice you are coming to work for us.
Re: (Score:2)
It's more likely a vanished in the way scientists connected to German weapons programs vanished from Germany at the end of ww2.
Preposterous.
#1 PAPERCLIP scientists were glad to go to the US (the two obvious reasons are "not wanting to be pick up by the Sovs" and "doing what they love in a land of milk and honey, compared to war-destroyed Germany") and continue working on rockets.
#2 Forcing someone to be a secret hacker is guaranteed to get your secret documents sent to the Eneremy.
Re: (Score:2)
It's 2017, FFS. In the West, that insane drivel stopped the day W left office,
Drone strikes on weddings. Extraordinary rendition... Gitmo. Yeah, Obama sure was different.
Re: Spare us the left-wing lunacy! (Score:2)
War is war. If they don't fight by the rules the so be it.
Re: (Score:2)
#1 The drivel by the Left about Americans getting thrown in Gitmo silenced the day W left office.
#2 Provide links to MSM news stories about extraordinary rendition during the Obama reign.
Re: (Score:2)
I don't know what exactly you would consider "extraordinary"...
https://www.washingtonpost.com... [washingtonpost.com]
http://america.aljazeera.com/o... [aljazeera.com]
It sounds to me like rendition continued, but with some attempt to ensure the suspects were not tortured.
Yep - public service... (Score:4, Insightful)
(1) He's destroying devices that destroy privacy in themselves ... open Telnet ports
(2) He's destroying devices that are insecure by design
Not crying for the owners of this junk. He's indeed doing the Internet a service...
Re: (Score:3)
So he sterilized the devices so the couldn't reproduce the same traits in future generation. Where have I heard that before?
Re: Yep - public service... (Score:2)
Re: (Score:1)
Not crying for the owners of this junk. He's indeed doing the Internet a service...
I am. Why should the end user pay for a manufacturer's .... I dare not call it a mistake. The world is full of people with wide skillsets in wide areas. You can't expect everyone to be an expert on everything. There are very few people out there with the capability of analysing their own network security.
At the very least these things better be covered by warranty, or fit for service laws.
Re: (Score:2)
> You can't expect everyone to be an expert on everything.
And even if they are, you can't expect everyone to spend uncountable amounts of time confirming everything from first principles.
We have the lives we have because we specialize and regulate the specialists. I don't have to do destructive chemical and mechanical testing of my car tires to have confidence they are safe. I don't have to test samples of my morning cereal before sitting down to eat breakfast. I generally expect the probability of my
Thank you (Score:3, Insightful)
This guy is my hero.
$100 in damages (Score:1)
Times 10 million devices. A billion dollar lawsuit filed against an individual might break some records.
And no, I'm not playing anything. Just noting something hypothetical here. Personally I want to see every buggy piece of shit IoT removed from the Internet. They can go start their own garbage network to run their shitbox hardware on.
Re: $100 in damages (Score:2)
My one friend did actually get sued for 200 million USD by his employer but the case was dropped.
Re: 10 million IoT (Score:2)
Some heroes don't wear capes. (Score:2)
Give this man a fucking prize.
Seriously, IoT devices should come with goddamn warning labels.
This device in known to the surgeon-general of cyberspace to pose a serous risk to your personal privacy, and the personal privacy of those around you. This device may also cause undesired network traffic, communicate with unauthorized systems, and promote the spread of malware to other network connected devices.
Re: (Score:2)
Who made this asshole "surgeon-general of cyberspace" and gave him the authority to destroy people's devices, dickface?
Provide an answer to that which doesn't make you look like an arrogant piece of shit.
He was unanimously approved for the position by the same voters that overwhelmingly support the repeal of net-neutrality. Try to keep up.
Headline should read: Author of BrickerBot Malware (Score:5, Funny)
... finally gets a job.
Re: Headline should read: Author of BrickerBot Mal (Score:2)
Where's the source (Score:1)
I am admittedly lazy. Can someone point me at his source. I couldn't find it in a cursory google search. I'm not planning to use it in the wild, just curious about which exploits he used exactly.
thanks
Re: (Score:1)
Beware the ides of IOT! (Score:1)
Re: (Score:2)
it's only about 456 years.
Re: (Score:1)
Clearly missing the / 24 part.
Re: Great (Score:1)
He disabled insecure devices before they could be taken over as part of a botnet.
Re:For all to see (Score:5, Insightful)
Screw jail. This guy needs to be drawn and quartered.
Nonsense. Having guys like him probing our infrastructure is a lot better than leaving the holes wide open for Putin and Xi Jingping. He is providing a public service. It may not be pleasant when you get pwned, but flu shots aren't pleasant either.
Re: (Score:1, Insightful)
He was doing more than probing. Anyone who thinks this bottom feeder was performing a public service is an idiot. And this guy will probably find out the retiring doesn't mean law enforcement will stop looking for him. And implying he would be "disappeared" is indicative of his warped view of reality. How many people have been "disappeared" for hacking? This guy, and people like him, are also responsible for giving law enforcement the political support needed to attach harsher penalties for these types of c
Re:For all to see (Score:4, Interesting)
He was doing more than probing. Anyone who thinks this bottom feeder was performing a public service is an idiot.
I think he should get a gold medal for each bricked device. He deserves it.
Re: For all to see (Score:2)
He deserves to be probed. In the ass. With a sharp stick. Coated with capsaicin.
Re: (Score:2)
Wow, .759 people! That's pretty cool. What happened to the .241 of them?
Re: (Score:2)
I guess those fractions represent missing arms, legs and other appendages.
Re: (Score:1)
Just the second period would be enough, we're not that dense.
Re: (Score:1)
I would have written it as 9.786.759,0 with the ,0 there to indicate to dumb-ass Americans they are not the only people in the world.
Says the one mindlessly clutching to the losing convention for historical accuracy? tradition? feels? Who knows why. But, good one. You've got your own groove. Get it, stella!
Re: (Score:2, Insightful)
Dumbass mainland Europeans think it's OK to write in English but not follow English numeric conversions resulting in documentation that either makes no sense or worse gives values that are plain wrong.
Re: (Score:1)
9786.759 people have disappeared because of these activities this year alone. Its easy to access this information for yourself, just log on to www.CIA/bagmen/illegal/assassinations.org where the government tracks all of these instances for you.
You sound awfully sarcastic. I'd hate to think you didn't think the CIA has ever killed anyone. If you do - read the following - and know it's not the only record from an 'authoritative' source on the subject:
[The dart from this secret CIA weapon can penetrate clothing and leave nothing but a tiny red dot on the skin. On penetration of the deadly dart, the individual targeted for assassination may feel as if bitten by a mosquito, or they may not feel anything at all. The poisonous dart completely disintegra
Re: (Score:2)
Make sure you steal his ECU or otherwise "brick" his car. He shouldn't drive it until it's secured properly.
Re: (Score:2)
The next time you fail to lock your car door, I will be sure to rob you and leave a note that says "shit security".
In Australia leaving your car door unlocked when the vehicle is unattended in a public place will get you a fine.
It would be nice if we could get the same sort of treatment for the idiots who code for these IOT devices.
BTW, it seems a lot of his victims were ISPs who are professionals and should know better as to how to set up their equipment.
Re: For all to see (Score:2)
Re: For all to see (Score:2)
Re: (Score:2)
Re: (Score:2)
No thanks. No, the only "unpleasant figure" in this story is this criminal.
Re: For all to see (Score:3)
Re: (Score:1)
Right, so the solution is to punish the owners by destroying their devices to send a "message" to vendors? How's that working out so far? Are IoT device vendors scrambling to secure their shit so it doesn't get bricked? No?
Fuck, if the ends justify the means why didn't he just start murdering insecure IoT device owners until the vendors agreed to change their ways? It would have been a lot more effective and he would have had just as many morons like yourself riding his nuts.
What's a little collateral d
Re: For all to see (Score:2)
Re: For all to see (Score:2)
Re: For all to see (Score:2)
Re: For all to see (Score:2)
Re: (Score:2)
Chemotherapy sucks balls, but death sucks worse. News at 11.
Re: (Score:1)
Nonsense. Having guys like him probing our infrastructure is a lot better than leaving the holes wide open for Putin and Xi Jingping. He is providing a public service. It may not be pleasant when you get pwned, but flu shots aren't pleasant either.
What?!? So if I am creating an IOT of things with my 7 year old, I don't know a simple weather station just say, and we don't secure it because it is a project for a 7 year old where there is no security risk of leaving it exposed, and it is easier for them to experiment with and this guy bricks it, maybe permanently, how is this a public service?
It is vandalism. It is no different then him walking down the street looking at a weather station attached to a wooden fence post in someones yard and smashing
Re: (Score:2)
To clarify the argument (without endorsing this position). It would be like you created an internet connected IOT weather station that because it was unsecured got hijacked to be included in a DDoS swarm.
The problem with poor IoT security is that, even if the device is useful for nothing else to the hacker, if it has a network stack and a connection it can DDoS someone else and there are millions of these devices. If this guy can get in and brick it, than someone else can get in and use it to DDoS
Re: (Score:1)
Re: For all to see (Score:2)
Re: (Score:2)
Nonsense. Having guys like him probing our infrastructure is a lot better than leaving the holes wide open for Putin and Xi Jingping. He is providing a public service. It may not be pleasant when you get pwned, but flu shots aren't pleasant either.
The difference is I choose whether or not to get a flu shot. If someone walked down the street jabbing random people with a hypodermic, I'd suggest harsh penalties for them too.
Re: (Score:3)