SoylentNews is people
SoylentNews
An Ars Technica story from 17 April, 2017 introduced us to Hajime, the vigilante botnet that infects IoT devices before blackhats can hijack them. A technical analysis published Wednesday reveals for the first time just how much technical acumen went into designing and building the renegade network, which just may be the Internet's most advanced IoT botnet.
Hajime [PDF] was first reported on in October, 2016 by Sam Edwards and Ioannis Profetis, security researchers at Rapidity Networks, a Boulder, CO based ISP.
As previously reported, Hajime uses the same list of user name and password combinations used by Mirai, the IoT botnet that spawned several record-setting denial-of-service attacks last year. Once Hajime infects an Internet-connected camera, DVR, and other Internet-of-things device, the malware blocks access to four ports known to be the most widely used vectors for infecting IoT devices. It also displays a cryptographically signed message on infected device terminals that describes its creator as "just a white hat, securing some systems."
Not your father's IoT botnet
But unlike the bare-bones functionality found in Mirai, Hajime is a full-featured package that gives the botnet reliability, stealth, and reliance that's largely unparalleled in the IoT landscape. Wednesday's technical analysis, which was written by Pascal Geenens, a researcher at security firm Radware, makes clear that the unknown person or people behind Hajime invested plenty of time and talent.
From the Ars Technica piece:
Hajime uses a decentralized peer-to-peer network to issue commands and updates to infected devices. This design makes it more resistant to takedowns by ISPs and Internet backbone providers. Hajime uses the same list of user name and password combinations Mirai uses, with the addition of two more. It also takes steps to conceal its running processes and files, a feature that makes detecting infected systems more difficult. Most interesting of all: Hajime appears to be the brainchild of a grayhat hacker, as evidenced by a cryptographically signed message it displays every 10 minutes or so on terminals. The message reads:
Just a white hat, securing some systems.
Important messages will be signed like this!
Hajime Author.
Contact CLOSED
Stay sharp!Another sign Hajime is a vigilante-style project intended to disrupt Mirai and similar IoT botnets: It blocks access to four ports known to be vectors used to attack many IoT devices. Hajime also lacks distributed denial-of-service capabilities or any other attacking code except for the propagation code that allows one infected device to seek out and infect other vulnerable devices.
Is it right for geeks to use their powers in this way?
(Score: 2) by edIII on Wednesday May 03 2017, @09:18PM (1 child)
I don't think it's right. At least, he loses his white-hat status. A white-hat never does things like that, which is why when you hear white-hat, you don't expect them to be hacking into networks they don't own or were hired to pen test.
If he did it to devices attacking his network I might see some self-defense there, but without that, vigilante is the best word. We may as well be deciding about the morality of Bat Man today :)
That being said, the scope of what has happened here matters too. A vigilante defeating 3 or 4 criminals is one thing, but a vigilante that saves a city against a horde of millions of IoT zombies? Pretty sure most everybody gives him a pass.
Still, he shouldn't call himself a white-hat while doing that.
Technically, lunchtime is at any moment. It's just a wave function.
(Score: 2) by butthurt on Thursday May 04 2017, @11:12AM
Eternal vigilantism is the price of liberty.