New Linux worm targets routers, cameras, “Internet of things” devices

http://arstechnica.com/security/2013/11/new-linux-worm-targets-routers-cameras-internet-of-things-devices/

by hepha1979 • 13 years ago

34 16 13 years ago

arstechnica.com

greenyoda• 13 years ago

Aren't most home routers, by default, configured to not accept HTTP connections from outside the local network?

fla• 13 years ago

Probably but, (all routers - most routers) = still a huge number of exposed routers with default passwords.

Note that the article mentions Intel routers (x86 cpus?). Those are indeed not very common to my knowledge.

superpatosainz• 13 years ago

fla: The article also mentions that these ELF binaries can be made compatible with ARM and other targets easily by just changing the Compile Target metadata in the binary itself. Making it quite simple to also target almost all routers.

0x0• 13 years ago

It's still possible to trick the browser of a user on the inside to HTTP POST a form invisibly to 192.168.1.1, by javascript hosted on an external web page.

shubb2• 13 years ago

I tried to figure out how to do this a while ago. Doesn't anti cross site scripting built into most modern browsers stop this? The flash and java security models certainly do.

I think you can do this by serving the user a hidden form that e.g. sends a firmware to the device, and a real form that they are likely to submit. The hidden form is the one that actually gets submitted. But I thought anything via XHR wouldn't work. Which is needed for a brute force attack say.

What did you find?

Nick_C2• 13 years ago

One thing I do is put my router and network on a different Class C than the default, for example 192.168.56.0 .

bcl• 13 years ago

Manufacturers need to do a better job making these appliances easier for consumers to keep updated. And this isn't just a problem with Linux, it is a problem with the designs being fire and forget.

13thw• 13 years ago

Can I use this to root my printer?

sehrope• 13 years ago

While not posing much of a real-world threat now, Darlloz demonstrates a major shortcoming with most Internet-of-things devices available today—they typically run Linux or other types of open source code that are woefully out of date.

This make no sense. Running Linux (or an OSS stack in general) is not what makes devices out of date. Not updating them does.

If updates are not automatic then the vast majority of people will not perform them. If they're not automatic and a pain in the ass to do (ever tried updating the firmware on a TV?) then even less will do it.

I'm not saying I want auto updates for everything (I personally don't like them though the option is nice) but for the vast majority of folks it's the right option. $NON_TECH_SAVVY_RELATIVE is not going to keep tabs on the latest exploits for her router and know when to login to the management console (assuming she can login) and apply an update.

wlesieutre• 13 years ago

This make no sense. Running Linux (or an OSS stack in general) is not what makes devices out of date. Not updating them does.

I can see how you'd read it that way, but I think the intent of the sentence is to state that they're running woefully out of date versions of Linux, not that Linux itself is woefully out of date.

Crito• 13 years ago

He parsed that (ambiguous, I agree) section like that because of the "or other types of open source code" section, and because the word "version" (or similar) was not included.

Had it instead said:

  *"they typically run Linux versions that are woefully out of date."*

  *"they typically run versions of Linux or other operating systems that are out of date."*

then there would not be a problem.

Since the real problem is out of date software, not the license that software happens to have, mentioning the license makes it sound like the author is blaming the license (a problem that is made worse by not including some "version" wording).

Considering the awkwardness of the phrase "other types of open source code" (what do we mean other "types"? Other licenses? Other languages? I don't think they intend either of those, what they mean is other projects, not types), I have to assume that the author did not intend any sort of slight and this is just a misunderstanding.

They probably included the "other types of open source code" section because that is frankly what is common with these sort of devices. It is an incidental detail that got confused with the point because the author is not as precise with the language surrounding this topic as we are.

New Linux worm targets routers, cameras, “Internet of things” devices

Related Stories