Need a unique gift idea?
A Pastebin account makes a great Christmas gift

Internet Chemotherapy

a guest Dec 15th, 2017 45 Never
Upgrade to PRO!
ENDING IN00days00hours00mins00secs
  1. 12/10 2017
  3. --[ 1 - Internet Chemotherapy
  5. Internet Chemotherapy was a 13 month project between Nov 2016 - Dec 2017.
  6. It has been known under names such as 'BrickerBot', 'bad firmware
  7. upgrade', 'ransomware', 'large-scale network failure' and even
  8. 'unprecedented terrorist actions.' That last one was a little harsh,
  9. Fernandez, but I guess I can't please everybody.
  11. You can download the module which executes the http and telnet-based
  12. payloads from this router at Due to
  13. platform limitations the module is obfuscated single threaded python, but
  14. the payloads are in plain view and should be easy to figure out for any
  15. programmer worth his/her/hir salt. Take a look at the number of payloads,
  16. 0-days and techniques and let the reality sink in for a moment. Then
  17. imagine what would've happened to the Internet in 2017 if I had been a
  18. blackhat dedicated to building a massive DDoS cannon for blackmailing the
  19. biggest providers and companies. I could've disrupted them all and caused
  20. extraordinary damage to the Internet in the process.
  22. My ssh crawler is too dangerous to publish. It contains various levels of
  23. automation for the purpose of moving laterally through poorly designed
  24. ISP networks and taking them over through only a single breached router.
  25. My ability to commandeer and secure hundreds of thousands of ISP routers
  26. was the foundation of my anti-IoT botnet project as it gave me great
  27. visibility of what was happening on the Internet and it gave me an
  28. endless supply of nodes for hacking back. I began my non-destructive ISP
  29. network cleanup project in 2015 and by the time Mirai came around I was
  30. in a good position to react. The decision to willfully sabotage other
  31. people's equipment was nonetheless a difficult one to make, but the
  32. colossally dangerous CVE-2016-10372 situation ultimately left me with no
  33. other choice. From that moment on I was all-in.
  35. I am now here to warn you that what I've done was only a temporary band-
  36. aid and it's not going to be enough to save the Internet in the future.
  37. The bad guys are getting more sophisticated, the number of potentially
  38. vulnerable devices keep increasing, and it's only a matter of time before
  39. a large scale Internet-disrupting event will occur. If you are willing to
  40. believe that I've disabled over 10 million vulnerable devices over the 13-
  41. month span of the project then it's not far-fetched to say that such a
  42. destructive event could've already happened in 2017.
  46. such an event is immeasurable given how digitally connected our societies
  47. have become, yet CERTs, ISPs and governments are not taking the gravity
  48. of the situation seriously enough. ISPs keep deploying devices with
  49. exposed control ports and although these are trivially found using
  50. services like Shodan the national CERTs don't seem to care. A lot of
  51. countries don't even have CERTs. Many of the world's biggest ISPs do not
  52. have any actual security know-how in-house, and are instead relying on
  53. foreign vendors for help in case anything goes wrong. I've watched large
  54. ISPs withering for months under conditioning from my botnet without them
  55. being able to fully mitigate the vulnerabilities (good examples are BSNL,
  56. Telkom ZA, PLDT, from time to time PT Telkom, and pretty much most large
  57. ISPs south of the border). Just look at how slow and ineffective Telkom
  58. ZA was in dealing with its Aztech modem problem and you will begin to
  59. understand the hopelessness of the current situation. In 99% of the
  60. problem cases the solution would have simply been for the ISPs to deploy
  61. sane ACLs and CPE segmentation, yet months later their technical staff
  62. still hasn't figured this out. If ISPs are unable to mitigate weeks and
  63. months of continuous deliberate sabotage of their equipment then what
  64. hope is there that they would notice and fix a Mirai problem on their
  65. networks? Many of the world's biggest ISPs are catastrophically negligent
  66. and this is the biggest danger by a landslide, yet paradoxically it
  67. should also be the easiest problem to fix.
  69. I've done my part to try to buy the Internet some time, but I've gone as
  70. far as I can. Now it's up to you. Even small actions are important. Among
  71. the things you can do are:
  73. * Review your own ISP's security through services such as Shodan and take
  74.   them to task over exposed telnet, http, httpd, ssh, tr069 etc. ports on
  75.   their networks. Refer them to this document if you have to. There's no
  76.   good reason why any of these control ports should ever be accessible
  77.   from the outside world. Exposing control ports is an amateur mistake.
  78.   If enough customers complain they might actually do something about it!
  80. * Vote with your wallet! Refuse to buy or use 'intelligent' products
  81.   unless the manufacturer can prove that the product can and will receive
  82.   timely security updates. Find out about the vendor's security track
  83.   record before giving them your hard-earned money. Be willing to pay a
  84.   little bit more for credible security.
  86. * Lobby your local politicians and government officials for improved
  87.   security legislation for IoT (Internet of Things) devices such as
  88.   routers, IP cameras and 'intelligent' devices. Private or public
  89.   companies currently lack the incentives for solving this problem in the
  90.   immediate term. This matter is as important as minimum safety
  91.   requirements for cars and general electrical appliances.
  93. * Consider volunteering your time or other resources to underappreciated
  94.   whitehat organizations such as GDI Foundation or Shadowserver
  95.   Foundation. These organizations and people make a big difference and
  96.   they can significantly amplify the impact of your skillset in helping
  97.   the Internet.
  99. * Last but not least, consider the long-shot potential of getting IoT
  100.   devices designated as an 'attractive nuisance' through precedent-
  101.   setting legal action. If a home owner can be held liable for a
  102.   burglar/trespasser getting injured then I don't see why a device owner
  103.   (or ISP or manufacturer) shouldn't be held liable for the damage that
  104.   was caused by their dangerous devices being exploitable through the
  105.   Internet. Attribution won't be a problem for Layer 7 attacks. If any
  106.   large ISPs with deep pockets aren't willing to fund such precedent
  107.   cases (and they might not since they fear that such precedents could
  108.   come back to haunt them) we could even crowdfund such initiatives over
  109.   here and in the EU. ISPs: consider your volumetric DDoS bandwidth cost
  110.   savings in 2017 as my indirect funding of this cause and as evidence
  111.   for its potential upside.
  113. --[ 2 - Timeline
  115. Here are some of the more memorable events of the project:
  117. * Deutsche Telekom Mirai disruption in late November 2016. My hastily
  118.   assembled initial TR069/64 payload only performed a 'route del default'
  119.   but this was enough to get the ISP's attention to the problem and the
  120.   resulting headlines alerted other ISPs around the world to the
  121.   unfolding disaster.
  123. * Around January 11-12 some Mirai-infected DVRs with exposed control port
  124.   6789 ended up getting bricked in Washington DC, and this made numerous
  125.   headlines. Gold star to Vemulapalli for determining that Mirai combined
  126.   with /dev/urandom had to be 'highly sophisticated ransomware'. Whatever
  127.   happened to those 2 unlucky souls in Europe?
  129. * In late January 2017 the first genuine large-scale ISP takedown occured
  130.   when Rogers Canada's supplier Hitron carelessly pushed out new firmware
  131.   with an unauthenticated root shell listening on port 2323 (presumably
  132.   this was a debugging interface that they forgot to disable). This epic
  133.   blunder was quickly discovered by Mirai botnets, and the end-result was
  134.   a large number of bricked units.
  136. * In February 2017 I noticed the first Mirai evolution of the year, with
  137.   both Netcore/Netis and Broadcom CLI-based modems being attacked. The
  138.   BCM CLI would turn out to become one of the main Mirai battlegrounds of
  139.   2017, with both the blackhats and me chasing the massive long tail of
  140.   ISP and model-specific default credentials for the rest of the year.
  141.   The 'broadcom' payloads in the above source may look strange but
  142.   they're statistically the most likely sequences to disable any of the
  143.   endless number of buggy BCM CLI firmwares out there.
  145. * In March 2017 I significantly increased my botnet's node count and
  146.   started to add more web payloads in response to the threats from IoT
  147.   botnets such as Imeij, Amnesia and Persirai. The large-scale takedown
  148.   of these hacked devices created a new set of concerns. For example,
  149.   among the leaked credentials of the Avtech and Wificam devices there
  150.   were logins which strongly implied airports and other important
  151.   facilities, and around April 1 2017 the UK government officials
  152.   warned of a 'credible cyber threat' to airports and nuclear
  153.   facilities from 'hacktivists.' Oops.
  155. * The more aggressive scanning also didn't escape the attention of
  156.   civilian security researchers, and in April 6 2017 security company
  157.   Radware published an article about my project. The company trademarked
  158.   it under the name 'BrickerBot.' It became clear that if I were to
  159.   continue increasing the scale of my IoT counteroffensive I had to come
  160.   up with better network mapping/detection methods for honeypots and
  161.   other risky targets.
  163. * Around April 11th 2017 something very unusual happened. At first it
  164.   started like so many other ISP takedowns, with a semi-local ISP called
  165.   Sierra Tel running exposed Zyxel devices with the default telnet login
  166.   of supervisor/zyad1234. A Mirai runner discovered the exposed devices
  167.   and my botnet followed soon after, and yet another clash in the epic
  168.   BCM CLI war of 2017 took place. This battle didn't last long. It
  169.   would've been just like any of the hundreds of other ISP takedowns in
  170.   2017 were it not for something very unusual occuring right after the
  171.   smoke settled. Amazingly, the ISP didn't try to cover up the outage as
  172.   some kind of network issue, power spike or a bad firmware upgrade. They
  173.   didn't lie to their customers at all. Instead, they promptly published
  174.   a press release about their modems having been vulnerable which allowed
  175.   their customers to assess their potential risk exposure. What did the
  176.   most honest ISP in the world get for its laudable transparency? Sadly
  177.   it got little more than criticism and bad press. It's still the most
  178.   depressing case of 'why we can't have nice things' to me, and probably
  179.   the main reason for why 99% of security mistakes get covered up and the
  180.   actual victims get left in the dark. Too often 'responsible disclosure'
  181.   simply becomes a euphemism for 'coverup.'
  183. * On April 14 2017 DHS warned of 'BrickerBot Threat to Internet of
  184.   Things' and the thought of my own government labeling me as a cyber
  185.   threat felt unfair and myopic. Surely the ISPs that run dangerously
  186.   insecure network deployments and the IoT manufacturers that peddle
  187.   amateurish security implementations should have been fingered as the
  188.   actual threat to Americans rather than me? If it hadn't been for me
  189.   millions of us would still be doing their banking and other sensitive
  190.   transactions over hacked equipment and networks. If anybody from DHS
  191.   ever reads this I urge you to reconsider what protecting the homeland
  192.   and its citizens actually means.
  194. * In late April 2017 I spent some time on improving my TR069/64 attack
  195.   methods, and in early May 2017 a company called Wordfence (now Defiant)
  196.   reported a significant decline in a TR069-exploiting botnet that had
  197.   previously posed a threat to Wordpress installations. It's noteworthy
  198.   that the same botnet temporarily returned a few weeks later using a
  199.   different exploit (but this was also eventually mitigated).
  201. * In May 2017 hosting company Akamai reported in its Q1 2017 State of the
  202.   Internet report an 89% decrease in large (over 100 Gbps) DDoS attacks
  203.   compared with Q1 2016, and a 30% decrease in total DDoS attacks. The
  204.   largest attack of Q1 2017 was 120 Gbps vs 517 Gbps in Q4 2016. As large
  205.   volumetric DDoS was one of the primary signatures of Mirai this felt
  206.   like concrete justification for all the months of hard work in the IoT
  207.   trenches.
  209. * During the summer I kept improving my exploit arsenal, and in late July
  210.   I performed some test runs against APNIC ISPs. The results were quite
  211.   surprising. Among other outcomes a few hundred thousand BSNL and MTNL
  212.   modems were disabled and this outage become headline news in India.
  213.   Given the elevated geopolitical tensions between India and China at the
  214.   time I felt that there was a credible risk of the large takedown being
  215.   blamed on China so I made the rare decision to publically take credit
  216.   for it. Catalin, I'm very sorry for the abrupt '2 day vacation' that
  217.   you had to take after reporting the news.
  219. * Previously having worked on APNIC and AfriNIC, on August 9th 2017 I
  220.   also launched a large scale cleanup of LACNIC space which caused
  221.   problems for various providers across the subcontinent. The attack made
  222.   headlines in Venezuela after a few million cell phone users of Movilnet
  223.   lost service. Although I'm personally against government surveillance
  224.   of the Internet the case of Venezuela is noteworthy. Many of the
  225.   LACNIC ISPs and networks have been languishing for months under  
  226.   persistent conditioning from my botnet, but Venezuelan providers have
  227.   been quick to fortify their networks and secure their infrastructure.
  228.   I believe this is due to Venezuela engaging in far more invasive deep
  229.   packet inspection than the other LACNIC countries. Food for thought.
  231. * In August 2017 F5 Labs released a report called "The Hunt for IoT: The
  232.   Rise of Thingbots" in which the researchers were perplexed over the
  233.   recent lull in telnet activity. The researchers speculated that the
  234.   lack of activity may be evidence that one or more very large cyber
  235.   weapons are being built (which I guess was in fact true). This piece
  236.   is to my knowledge the most accurate assessment of the scope of my
  237.   project but fascinatingly the researchers were unable to put two and
  238.   two together in spite of gathering all the relevant clues on a single
  239.   page.
  241. * In August 2017 Akamai's Q2 2017 State of the Internet report announces
  242.   the first quarter in 3 years without the provider observing a single
  243.   large (over 100 Gbps) attack, and a 28% decrease in total DDoS attacks
  244.   vs Q1 2017. This seems like further validation of the cleanup effort.
  245.   This phenomenally good news is completely ignored by the mainstream
  246.   media which operates under an 'if it bleeds it leads' mentality even
  247.   when it comes to information security. This is yet another reason why
  248.   we can't have nice things.
  250. * After the publication of CVE-2017-7921 and 7923 in September 2017 I
  251.   decided to take a closer look at Hikvision devices, and to my horror
  252.   I realized that there's a technique for botting most of the vulnerable
  253.   firmwares that the blackhats hadn't discovered yet. As a result I
  254.   launched a global cleanup initiative around mid-September. Over a
  255.   million DVRs and cameras (mainly Hikvision and Dahua) were disabled
  256.   over a span of 3 weeks and publications such as wrote several
  257.   articles about the attacks. Dahua and Hikvision wrote press releases
  258.   mentioning or alluding to the attacks. A huge number of devices finally
  259.   got their firmwares upgraded. Seeing the confusion that the cleanup
  260.   effort caused I decided to write a quick summary for the CCTV people at
  262.   (sorry for the NSFW language of the pastebin service). The staggering
  263.   number of vulnerable units that were online months after critical
  264.   security patches were available should be the ultimate wakeup call to
  265.   everyone about the utter dysfunctionality of the current IoT patching
  266.   process.
  268. * Around September 28 2017 Verisign releases a report saying that DDoS
  269.   attacks declined 55% in Q2 2017 vs Q1, with a massive 81% attack peak
  270.   decline.
  272. * On November 23rd 2017 the CDN provider Cloudflare reports that 'in
  273.   recent months, Cloudflare has seen a dramatic reduction in simple
  274.   attempts to flood our network with junk traffic.' Cloudflare speculates
  275.   it could've partly been due to their change in policies, but the
  276.   reductions also line up well with the IoT cleanup activities.
  278. * At the end of November 2017 Akamai's Q3 2017 State of the Internet
  279.   report sees a small 8% increase in total DDoS attacks for the quarter.
  280.   Although this was a significant reduction compared to Q3 2016 the
  281.   slight uptick serves as a reminder of the continued risks and dangers.
  283. * As a further reminder of the dangers a new Mirai strain dubbed 'Satori'
  284.   reared its head in November-December of 2017. It's particularly
  285.   noteworthy how quickly the botnet managed to grow based on a single
  286.   0-day exploit. This event underlines the current perilous operating
  287.   state of the Internet, and why we're only one or two severe IoT
  288.   exploits away from widespread disruption. What will happen when nobody
  289.   is around to disable the next threat? Sinkholing and other whitehat/
  290.   'legal' mitigations won't be enough in 2018 just like they weren't
  291.   enough in 2016. Perhaps in the future governments will be able to
  292.   collaborate on a counterhacking task force with a global mandate for
  293.   disabling particularly severe existential threats to the Internet, but
  294.   I'm not holding my breath.
  296. * Late in the year there were also some hysterical headlines regarding a
  297.   new botnet that was dubbed 'Reaper' and 'IoTroop'. I know some of you
  298.   will eventually ridicule those who estimated its size at 1-2 million
  299.   but you should understand that security researchers have very limited
  300.   knowledge of what's happening on networks and hardware that they don't
  301.   control. In practice the researchers could not possibly have known or
  302.   even assumed that most of the vulnerable device pool had already been
  303.   disabled by the time the botnet emerged. Give the 'Reaper' one or two
  304.   new unmitigated 0-days and it'll become as terrifying as our worst
  305.   fears.
  307. --[ 3 - Parting Thoughts
  309. I'm sorry to leave you in these circumstances, but the threat to my own
  310. safety is becoming too great to continue. I have made many enemies. If
  311. you want to help look at the list of action items further up. Good luck.
  313. There will also be those who will criticize me and say that I've acted
  314. irresponsibly, but that's completely missing the point. The real point
  315. is that if somebody like me with no previous hacking background was able
  316. to do what I did, then somebody better than me could've done far worse
  317. things to the Internet in 2017. I'm not the problem and I'm not here to
  318. play by anyone's contrived rules. I'm only the messenger. The sooner you
  319. realize this the better.
  321. -Dr Cyborkian a.k.a. janit0r, conditioner of 'terminally ill' devices.
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand