Forget about traditional PC malware: Infecting routers and other Internet-connected devices is the new hotness among malicious actors, given its effectiveness and relative ease. But there’s a new sort of malware swirling across the web—vigilante code that infiltrates your router and Internet of Things devices and then actually hardens them against traditional attacks, leaving helpful messages and homages to free software activist Richard Stallman in its wake.
Seriously.
Symantec first became aware of the superhero malware—dubbed Linux.Wifatch—in 2014, when an independent researcher noticed weirdness occurring on his router. As it turns out, the router had been transformed into a zombie, thrall to a large, sophisticated peer-to-peer botnet. He reported via Twitter that he hadidentified over 13,000 other devices infected with it.
That prompted other researchers to chime in that they too had identified it, variously nicknaming itReincarnaandZollard— which was spotted in Internet-connected devices as far back as 2013.
The P2P network isn’t used to conduct denial of service attacks or distribute malware, however. Instead, it passes malware threat updates between the zombies in the botnet, because Wifatch actually eliminates any other malware on your device, including “well known families of malware targeting embedded devices,” according to Symantec.
That’s, well, pretty darn cool but the eradication of other malware isn’t a sign of a benevolent infection in and of itself, as nefarious malware has been known to run virus scans in the past not to protect the host device, but to muscle out the competition. Numerous other signs point to Wifatch’s vigilante nature, however.
Symantec A nice message left by the Linux.Wifatch malware.
Once installed, Wifatch hardens a device against traditional attack channels, including killing its legitimate Telnet daemon—but when it does so, it leaves a useful tip if you try to connect via Telnet afterward, imploring you to update the device’s firmware and change its Telnet password, as seen above.
Furthermore, the source code contains the following plea for law enforcement officials, which is a reference to the email signature of GNU guru Richard Stallman:
“To any NSA and FBI agents reading this: Please consider whether defending the US Constitution against all enemies, foreign or domestic, requires you to follow Snowden’s example.
EOF”
The Wifatch malware even includes an exploit module for Dahua DVR CCTV systems that forces them to reboot weekly. “One could speculate that because Wifatch may not be able to properly defend this type of device, instead, its strategy may be to reboot it periodically which would kill running malware and set the device back to a clean state,” Symantec’s Mario Ballano writes.
The author of Wifatch didn’t obfuscate its code; in fact, the malware’s source code includes numerous debug messages so that researchers can more easily dig through it, Symantec reports.
The impact on you at home: This all sounds pretty wonderful, but Symantec warns that Wifatch infects without consent and “contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions.” The security firm has been monitoring the Wifatch network for months, however, and hasn’t seen a single sign of malicious action—and the back doors are cryptographically signed to ensure commands come from the malware’s genuine author, reducing Wifatch’s risk of being hijacked by a truly malicious third party.
Simply resetting your router will kill Wifatch. To ward off potential infection, Symantec offers the very same advice as the malware itself: Update your device’s firmware and change its passwords.
IDG News Services’ Peter Sayer contributed additional reporting to this article.
Via The Verge
This story, “This vigilante virus protects you against malware attacks, quotes Richard Stallman” was originally published by