Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mirai Botnet Client, Echo Loader and CNC source code

github.com

Post reply on HN
Print view View original

11–20 of 51 posts

Re: Mirai Botnet Client, Echo Loader and CNC source code

#11

Post by yes_or_gnome »

Cyph0n wrote: post #7
Jeraimee wrote: post #2

This source is incomplete. See https://github.com/0x27/linux.mirai for a full mirror of the release.

Thanks. Question for the C folks. The author seems to have reimplemented functions such as strlen, memcpy, and atoi in 'bot/util.h' instead of using the stdlib. Anyone know why? https://github.com/0x27/linux.mirai/blob/master/mirai/bot/ut...

Because you cannot rely on some chintzy IoT device to have dynamically loadable libraries. In all likelihood, they don't. But let's assume they do have loadable stdlib, would would you trust the integrity of your botnet to dozens of poorly designed IoT devices?

Re: Mirai Botnet Client, Echo Loader and CNC source code

#17

Post by Animats »

This thing's strategy for finding machines to take over is so simple it's embarrassing. It tries to open an unencrypted Telnet connection to random IP addresses. If it gets a response, it tries the following username/password combinations:

    root     xc3511
    root     vizxv
    root     admin
    admin    admin
    root     888888
    root     xmhdipc
    root     default
    root     juantech
    root     123456
    root     54321
    support  support
    root     (none)
    admin    password
    root     root
    root     12345
    user     user
    admin    (none)
    root     pass
    admin    admin1234
    root     1111
    admin    smcadmin
    admin    1111
    root     666666
    root     password
    root     1234
    root     klv123
    Administrator admin
    service  service
    supervisor supervisor
    guest    guest
    guest    12345
    guest    12345
    admin1   password
    administrator 1234
    666666   666666
    888888   888888
    ubnt     ubnt
    root     klv1234
    root     Zte521
    root     hi3518
    root     jvbzd
    root     anko
    root     zlxx.
    root     7ujMko0vizxv
    root     7ujMko0admin
    root     system
    root     ikwb
    root     dreambox
    root     user
    root     realtek
    root     00000000
    admin    1111111
    admin    1234
    admin    12345
    admin    54321
    admin    123456
    admin    7ujMko0admin
    admin    1234
    admin    pass
    admin    meinsm
    tech     tech
    mother   fucker
That's it.

Deploying millions of devices with fixed passwords that dumb is clear evidence of gross negligence on the part of IoT device manufacturers. If this gets to court, some lawyer is going to enter that list as evidence and read it to a jury.

"That's the kind of combination an idiot would have on his luggage!" - Spaceballs

Post reply on HN