Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mirai Botnet Client, Echo Loader and CNC source code

github.com

Post reply on HN
Print view View original

31–40 of 51 posts

Re: Mirai Botnet Client, Echo Loader and CNC source code

#31

Post by justincormack »

yes_or_gnome wrote: post #11
Cyph0n wrote: post #7

Earlier quoted context omitted.

Thanks. Question for the C folks. The author seems to have reimplemented functions such as strlen, memcpy, and atoi in 'bot/util.h' instead of using the stdlib. Anyone know why? https://github.com/0x27/linux.mirai/blob/master/mirai/bot/ut...

Because you cannot rely on some chintzy IoT device to have dynamically loadable libraries. In all likelihood, they don't. But let's assume they do have loadable stdlib, would would you trust the integrity of your botnet to dozens of poorly designed IoT devices?

You can statically link the binary you build, doesnt mean you need to reimplement.

Re: Mirai Botnet Client, Echo Loader and CNC source code

#32

Post by viraptor »

justincormack wrote: post #31
yes_or_gnome wrote: post #11

Earlier quoted context omitted.

Because you cannot rely on some chintzy IoT device to have dynamically loadable libraries. In all likelihood, they don't. But let's assume they do have loadable stdlib, would would you trust the integrity of your botnet to dozens of poorly designed IoT devices?

You can statically link the binary you build, doesnt mean you need to reimplement.

But it is easier to copy/paste those few functions rather than play with static libc and then making sure all the other functions don't get linked into the final binary.

Re: Mirai Botnet Client, Echo Loader and CNC source code

#34

Post by Klathmon »

coord wrote: post #24
Animats wrote: post #17

This thing's strategy for finding machines to take over is so simple it's embarrassing. It tries to open an unencrypted Telnet connection to random IP addresses. If it gets a response, it tries the following username/password combinations: root xc3511 root vizxv root admin admin admin root 888888 root xmhdipc root default root juantech root 123456 root 54321 support support root (none) admin password root root root 1…

I cannot wait for some type of top-down pressure to force IoT developers to take security seriously. The movement has been pushed into overdrive thanks to insane levels of competition where you either crush your R&D into the smallest breakneck period or you live to see your creation being sold for half of what your budget can allow by other firms lifting your efforts while you're still at the workbench.[1] I've been…

> the IoT community

I hate this phrase. It's not like a bunch of people gathered and said "let's make shitty IoT stuff!". It's not a "community", there aren't groups around advocating against security best practices.

If anything the actual community around IoT stuff takes security more seriously than most HNers.

The problem is the companies and manufacturers that aren't part of the community.

And I take issue with your [4]. That has nothing to do with security. It was a glitch, and it happened, and I personally don't like Nest as a company very much and think they make pretty shitty products, but they take security seriously, and in a discussion about IoT security linking a non-security related software bug serves no purpose. Everything has bugs, that doesn't mean it's absolute shit when something goes wrong.

Your [3] is also incorrect. The Arduino IoT Manifesto's second point is that a dev should make sure their product can be updated, and even if it's abandoned it should be able to be repurposed in something else, or updated by someone else.

Re: Mirai Botnet Client, Echo Loader and CNC source code

#35

Post by user5994461 »

The IoT devices can be accessed over telnet. Out of curiosity: Is there a self destruct command? or a way to make one?

It seems to me that destroying the vulnerable devices would solve the DDoS problem and gives a big kick in the face of the affected manufacturers plus a good press coverage.

Re: Mirai Botnet Client, Echo Loader and CNC source code

#36

Post by throw2016 »

The whole focus on IOT and random individual devices on the network seems misplaced. If all it takes is misconfiguration of random devices that join the network to take it down then you have a larger problem than these devices.

Since there is no way to police this and 'wack a mole' for billions of devices is not a practical strategy this security focus on IOT devices while nice does not address the core problem of vulnerable networks and ddos. It distracts and diverts from it.

Re: Mirai Botnet Client, Echo Loader and CNC source code

#37

Post by peller »

ianhawes wrote: post #33
yyyyyyyyyyyy wrote: post #8

There is an irc snippet in the source - https://github.com/0x27/linux.mirai/blob/master/dlr/release/... From the full mirror linked below

Glad to see these are American hackers and not Russian.

https://github.com/0x27/linux.mirai/blob/master/mirai/prompt... looks awfully Cyrillic to me, anybody know what it means?

Re: Mirai Botnet Client, Echo Loader and CNC source code

#38

Post by misnome »

Animats wrote: post #17

This thing's strategy for finding machines to take over is so simple it's embarrassing. It tries to open an unencrypted Telnet connection to random IP addresses. If it gets a response, it tries the following username/password combinations: root xc3511 root vizxv root admin admin admin root 888888 root xmhdipc root default root juantech root 123456 root 54321 support support root (none) admin password root root root 1…

Dammit, I thought we solved this 10+ years ago when home router manufacturers finally started printing unique passwords on the base of the product.

Re: Mirai Botnet Client, Echo Loader and CNC source code

#39

Post by christophilus »

user5994461 wrote: post #35

The IoT devices can be accessed over telnet. Out of curiosity: Is there a self destruct command? or a way to make one? It seems to me that destroying the vulnerable devices would solve the DDoS problem and gives a big kick in the face of the affected manufacturers plus a good press coverage.

This was my exact thought. If we have the source code, it seems as if it wouldn't be too hard to make our own version which seeks and destroys other versions, possibly patching the system, or at least changing the password to be something secure.

Is there a reason this can't be done? (Other than a legal reason, which hackers don't tend to care too much about.)

Re: Mirai Botnet Client, Echo Loader and CNC source code

#40

Post by milankragujevic »

peller wrote: post #37
ianhawes wrote: post #33

Earlier quoted context omitted.

Glad to see these are American hackers and not Russian.

https://github.com/0x27/linux.mirai/blob/master/mirai/prompt... looks awfully Cyrillic to me, anybody know what it means?

"I love chicken nuggets"
Post reply on HN