Mirai Botnet Client, Echo Loader and CNC source code

LOL it's missing "admin/ztonpk, admin/tzlkisonpk, telekom/telekom" which are default passwords for root access on Telekom Serbia's modems (7-8 million devices including IPTV STBs)... It's so stupid I have to use their shitty modem and can't change the pwd because they occasionally flash new firmware to it and reset everything to default, because that's how they configure the xDSL settings.

If you can get access as riot then changing the password should be possible - assuming (and I haven't looked at the source yet) that the hacker doesn't when they first get control (although if the source is original it would have a/some passwords in it as you can't control something if you don't know the password). Modifying the existing code to find and remove the added components (as you know what's been added by the code, where it's been added to) before resetting the password ought to be doable. Changing the password ought to then alert the users that something's wrong ("hey, my internet connected [thing] isn't working?") so hopefully they will then contact the vendor, or bitch about the product on a review site, which will make the vendor sit up and notice if a lot of people do this. If it looks like this hits a company's bottom line it will have more impact. You may have to hit the machines more than once because support will probably start with 'flash the firmware' which will reset the password, so a couple of passes to ensure the users get fed up, and support suggest changing defaults might solve the problem. A more serious/damaging and potentially dangerous (depending what the IoT thing is being used for - ie fire detection, child monitoring) would potentially be - and this is not my field - to deploy null/corrupt/fake firmware to these devices to take them offline until a firmware flash is carried out. That would require different tactics than just modifying the source, and would be more complicated due to the different types of device. I'm not sure how easy it is to remote flash this stuff, whether you need certificates, whether you can flash entirely non-functioning code and how easily. As I say, not my area. Anyone know if it's possible to put this code on a DNS box and when an attack starts go to each source ip, attempt Telnet with default list, then clean/change password/reboot/re-firmware (whichever - any/all) to kill the sources our do these systems use ip masking/obfuscation?

In many cases, sure, but there is usually an easy way to reset such a device back to its factory defaults.

Could someone please illustrate a concrete example of how having the password to my camera (assuming it has an routing through NAT) can be used to generate outbound traffic?

I have five cameras set up with NAT port holes. My passwords are (I believe) secure. But even if they were on the list, how could that be used to generate outbound traffic to DDoS someone? Presumably, only by a further vulnerability in the firmware.

In all the media / HN coverage, even with the release of Mirai source, I have yet to see a concrete example of a brand/model of camera/DVR who's firmware is exploitable. Let alone a list of models that are.

One exception: The D-Link DCS-930L[1] has a known vulnerability.

[1]: https://www.exploit-db.com/exploits/39437/

Edit: Okay, if you can get in on telnet, then nevermind; you're p0wned. But if you're a webcam on port 8080, what is the attack vector?

IANAL, but I'm pretty sure the answer to that is "yes". It would set a terrible precedent by authorising vigilantism, and I'm not sure how you would define "vulnerable" under the law.