The malware hardcodes 62 common username:password pairs like root:12345 [0] and apparently there are millions of IOT devices out there where these trivial passwords will get you root.

[0] https://github.com/0x27/linux.mirai/blob/6d5a3e2760852444de9...

I think he's asking more about how the attackers get past the simple NAT. I mean, unless you deliberately expose the device as a webserver to the public internet, a device should be by-default hidden theoretically unless it goes looking for trouble online. Of course, considering the quality of most routers, it's not like the NAT itself is terribly safe.

They don't need to. Millions of devices have their telnet port open to the Internet (just check Shodan), after infecting those, Mirai has a beach head to scan and attack the rest of the network.

This is what so few people seem to talk about. Why? I'm baffled.

The simplest idea is to put your exploit as JS payload in some shady ad network or auto-cracked PHP website, and get to the devices by scanning & fingerprinting devices on the browser's rfc1918 network. Then use a reverse shell style connection to c&c.

malicious javascript can only send packets on your rfc1918 network via a DNS rebinding attack, which is not trivial to pull off and is not very reliable

all of these iot devices use upnp to bypass the nat 'firewall'

This approach seems to work without DNS rebinding: https://thehackerblog.com/sonar-a-framework-for-scanning-and...

Edit: Note that the example does try to do some DNS rebinding on the router, but that's the end goal. The attack itself doesn't rely on rebinding. It does require "already logged on to the router" users, but I suspect an attack using default login credentials is possible as well.

I'd like to see someone actually name & shame the devices involved. With evidence, of course.

I've had a quick poke around my house, and the couple of devices I have (wemo, philips hue) are holding pretty persistent outbound http connections - not dropping their trousers and exposing telnet.

Persistently exposed telnet sounds more to me like industrial control devices, network appliances, etc. But "IoT" is so vague that we're immediately jumping to blaming consumer devices.

Dahua. And then there are the Alibaba Chinese Hikvision cameras that generally can't be firmware updated. Seems like plenty of people port forward to their cameras as most of the camera forums say over and over to use VPN and not port forward.

"The specific Dahua IPC-HFWxxx old type vulnerable password was the one used to let this in, but that depends on how we apply our traps." http://blog.malwaremustdie.org/2016/10/mmd-0058-2016-elf-lin...

> get past the simple NAT.

UPnP

Though you still have to exploit.

I wonder how many are running some linux variant though, and have some remote execution vulnerability on their web UI (maybe even without logging in)..

Sadly the present state of software engineering is mostly incapable of archieving what your reasonable expectation is. Malware can exploit bugs in the devices to get arbitrary code execution (=run any code the attacker wants).