[Khác] A silent guardian, a watchful protector

nhatanh · 3/10/15

Tens of Thousands of Routers, IP Cams Infected by Vigilante Malware
By Eduard Kovacs on October 01, 2015

PRAGUE - Virus Bulletin 2015 - A mysterious piece of malware has infected tens of thousands of devices across the world, but its operator hasn’t used them for any malicious purposes.

The bot, dubbed by Symantec “Linux.Wifatch,” was first spotted in November 2014 when an independent researcher noticed some interesting processes on his home router. Symantec has been monitoring the threat since March 2015 and the security firm has been trying to solve the mystery of Wifatch ever since.

Symantec researchers have avoided calling Wifatch a piece of malware because it doesn’t actually do anything malicious. Instead, it appears to be the work of what experts call an “Internet of Things (IoT) vigilante” who wants to protect routers and other IoT devices from malicious actors.

Wifatch seems to scan the Web for devices that it can infect over telnet likely using weak credentials. Once it infects a device, the threat can be controlled by its operator using commands signed with a private Elliptic Curve Digital Signature Algorithm (ECDSA) key.

The malware is developed in Perl and each sample comes with its own Perl interpreter. Infected devices are connected to a peer-to-peer (P2P) network that is used to distribute updates, researchers said.

The backdoors set up by Wifatch would normally allow infected devices to be abused for a wide range of activities, from distributed denial-of-service (DDoS) attacks to DNS poisoning. However, the actor behind the malware is using it to scan the device for known malware families based on their signatures, and disables telnet to keep others out.

While it’s not uncommon for malware to attempt to keep other threats out of the infected system, Wifatch actually informs users trying to connect over Telnet that the service has been disabled to prevent further infection of the device, and even provides recommendations for preventing attacks.

In the case of the Dahua DVR CCTV system, a special module allows Wifatch to configure the device so that it reboots every week. Since rebooting a device usually removes the malware running on it, this could be an attempt to defend these types of systems in case the malware cleanup mechanism cannot be run or Telnet cannot be disabled.

Symantec has identified tens of thousands of devices infected with Wifatch, most of which are routers and IP cameras. Roughly one third of the infections have been spotted in China, followed by Brazil (16%), Mexico (9%), India (9%), Vietnam (7%), Italy (7%), Turkey (7%), South Korea (5%), and the United States (5%).

The threat is designed to target several types of architectures, but most of the infected devices are based on ARM (83%), followed by MIPS (10%), and SH4 (7%).

The author of Wifatch has also taken precautions to ensure that the botnet cannot be hijacked by others. Since it relies on a P2P architecture, there is no command and control (C&C) server, and since all commands are signed with a private ECDSA key, it’s very difficult for unauthorized users to send commands.

Symantec researcher Mario Ballano told SecurityWeek in an interview at the Virus Bulletin conference in Prague that the author of the threat seems to be an expert in cryptography and he has taken the necessary measures to prevent takeovers.

Wifatch could be operated by a group of individuals, but based on the consistency of the code Ballano believes it’s likely the work of a single individual. The author of Wifatch is not easy to track down since he uses the Tor anonymity network for sending commands to the bots.

While the Wifatch botnet could always be repurposed for malicious activities considering that it’s a fairly sophisticated threat, researchers haven’t spotted any malicious traffic so far and there appear to be no malicious routines. Furthermore, unlike other pieces of malware, Wifatch’s code has not been obfuscated or encrypted (it has only been compressed), and it contains a lot of debug information.

Further indication that this could be the work of a “vigilante” is provided by the following comment in the source code, which has been attributed to software freedom activist Richard Stallman: “To any NSA and FBI agents reading my email: please consider whether defending the US Constitution against all enemies, foreign or domestic, requires you to follow Snowden's example.”
Click to expand...

http://www.securityweek.com/tens-thousands-routers-ip-cams-infected-vigilante-malware
TL;DR: Malware nhiễm vào vài chục ngàn routers và âm thầm bảo vệ vật chủ khỏi các threat khác Chưa rõ danh tính tác giả nhưng dựa vào độ nhất quán của code thì có vẻ đây không phải 1 tổ chức/1 nhóm mà chỉ có 1 cao nhân ở ẩn. Tác giả tỏ ra rất thiện chí: code không bị obsfucated (đếch biết dịch thế nào, đại khái là làm mờ code đi để khó bị reverse engineer hơn), không bị mã hóa, chỉ đơn giản là compressed, đã thế còn để lại rất nhiều thông tin debug. Đại khái là cái này giống như tuột quần lột áo rồi chổng mông lên cho ai muốn xem gì thì xem vậy
À mà con batman này viết bằng Perl nhưng thôi ở đây chắc ĐAQT.

1s1k_d2006 · 3/10/15

Lại nhớ top answer McAfee AMA ở reddit https://www.reddit.com/r/netsec/comments/3hr9f0/i_am_john_mcafee_ama/cu9x2tj

Đừng Ban Em · 3/10/15

thế tức là malware tốt, nên để máy tính nhiễm à :-O

herowinb · 3/10/15

nhatanh nói: ↑

À mà con batman này viết bằng Perl nhưng thôi ở đây chắc ĐAQT.
Click to expand...

ĐAQT là Điện Ảnh Quốc Tế ah

otcayxe · 3/10/15

đọc như kiểu có mùi gì đó đen tối cho một âm mưu kinh khủng khiếp sau này

nhatanh · 3/10/15

herowinb nói: ↑

ĐAQT là Điện Ảnh Quốc Tế ah
Click to expand...

Đáp Án Que Thử

hunterchicks · 3/10/15

herowinb nói: ↑

ĐAQT là Điện Ảnh Quốc Tế ah
Click to expand...

lịch sự thi là "đâu ai quan tâm" :")

Tyrant 076 · 3/10/15

herowinb nói: ↑

ĐAQT là Điện Ảnh Quốc Tế ah
Click to expand...

đéo ai quan tâm :(

enbeen · 3/10/15

Để anh quất thử

_[Kyo]_ · 3/10/15

Đít Anh Quá To

viendu · 3/10/15

Thích cái phong trào tóm tắt cho TL;DR

[MAX]Gear · 3/10/15

có mùi Kingsman

rekkhan · 3/10/15

đừng ai quay tay, đéo ai quay tay, để anh quay tay, điện ảnh quay tay, đề án quay tay?

FROZENSATTHU · 3/10/15

herowinb nói: ↑

ĐAQT là Điện Ảnh Quốc Tế ah
Click to expand...

Đít anh quá thâm

squall9588 · 3/10/15

Đu Anh Quá Trời

mafiaboy8xx · 3/10/15

Đít anh quá tê ê ê ê....

Nyaruko · 3/10/15

Đít Anh Quá T....hơm

A4_160 · 3/10/15

Đá Anh Quấn Trym

living2nd · 3/10/15

Đâm anh quá thốn

14041989 · 3/10/15

Thường thì những thằng nguy hiểm là những thằng cho mình cảm giác an toàn nhất lúc mới tiếp cận, sau nó quay qua đâm cho thì thấu tim

Đăng nhập

[Khác] A silent guardian, a watchful protector

nhatanh Samus Aran the Bounty Hunter Lão Làng GVN

1s1k_d2006 The Warrior of Light Lão Làng GVN

Đừng Ban Em Legend of Zelda

herowinb Sonic the Hedgehog

otcayxe Fire in the hole!

nhatanh Samus Aran the Bounty Hunter Lão Làng GVN

hunterchicks T.E.T.Я.I.S Lão Làng GVN

Tyrant 076 KỲ THỦ CỜ VÂY CHAMPION ⚜ Duel Master ⚜ Lão Làng GVN

enbeen Mayor of SimCity Lão Làng GVN

_[Kyo]_ Persian Prince

viendu Mega Man Lão Làng GVN

[MAX]Gear Persian Prince Lão Làng GVN

rekkhan Dragon Quest Lão Làng GVN

FROZENSATTHU Mr & Ms Pac-Man Lão Làng GVN

squall9588 Marcus Fenix, savior of Sera Lão Làng GVN

mafiaboy8xx Dragon Quest Lão Làng GVN

Nyaruko Bác sĩ wibu Lão Làng GVN Nhân Viên Y Tế

A4_160 You Must Construct Additional Pylons Lão Làng GVN

living2nd ✣✣✣ Xiaolonista✣✣✣ CHAMPION ✡ Shine Wizard ✡ Lão Làng GVN

14041989 T.E.T.Я.I.S Lão Làng GVN

Chia sẻ trang này

Đăng nhập

[Khác] A silent guardian, a watchful protector

nhatanh Samus Aran the Bounty Hunter Lão Làng GVN

1s1k_d2006 The Warrior of Light Lão Làng GVN

Đừng Ban Em Legend of Zelda

herowinb Sonic the Hedgehog

otcayxe Fire in the hole!

nhatanh Samus Aran the Bounty Hunter Lão Làng GVN

hunterchicks T.E.T.Я.I.S Lão Làng GVN

Tyrant 076 KỲ THỦ CỜ VÂY CHAMPION ⚜ Duel Master ⚜ Lão Làng GVN

enbeen Mayor of SimCity Lão Làng GVN

_[Kyo]_ Persian Prince

viendu Mega Man Lão Làng GVN

[MAX]Gear Persian Prince Lão Làng GVN

rekkhan Dragon Quest Lão Làng GVN

FROZENSATTHU Mr & Ms Pac-Man Lão Làng GVN

squall9588 Marcus Fenix, savior of Sera Lão Làng GVN

mafiaboy8xx Dragon Quest Lão Làng GVN

Nyaruko Bác sĩ wibu Lão Làng GVN Nhân Viên Y Tế

A4_160 You Must Construct Additional Pylons Lão Làng GVN

living2nd ✣✣✣ Xiaolonista✣✣✣ CHAMPION ✡ Shine Wizard ✡ Lão Làng GVN

14041989 T.E.T.Я.I.S Lão Làng GVN

Chia sẻ trang này

Tìm kiếm hữu ích