×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Chuck Norris Attacks Linux-Based Routers, Modems

timothy posted more than 4 years ago | from the witnesses-awarded-him-both-ears-and-the-tail dept.

Botnet 193

angry tapir writes "Discovered by Czech researchers, the Chuck Norris botnet has been spreading by taking advantage of poorly configured routers and DSL modems. The malware got the Chuck Norris moniker from a programmer's Italian comment in its source code: 'in nome di Chuck Norris,' which means 'in the name of Chuck Norris.' Chuck Norris is unusual in that it infects DSL modems and routers rather than PCs. It installs itself on routers and modems by guessing default administrative passwords and taking advantage of the fact that many devices are configured to allow remote access."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

193 comments

As far as misleading headlines go (5, Funny)

DavidR1991 (1047748) | more than 4 years ago | (#31228368)

this one really takes the cake!

Re:As far as misleading headlines go (5, Funny)

somersault (912633) | more than 4 years ago | (#31228420)

Actually, I think Chuck Norris would take the cake and use it to asphyxiate the headline, before drop-kicking said headline into the sun.

Re:As far as misleading headlines go (5, Funny)

spartacus_prime (861925) | more than 4 years ago | (#31228706)

Actually, I think Chuck Norris would take the cake and use it to asphyxiate the headline, before roundhouse kicking said headline into the sun.

Fixed that for you.

Re:As far as misleading headlines go (0)

Anonymous Coward | more than 4 years ago | (#31229072)

In the words of Peter Griffin... Road House!

R.I.P. - Patrick Swayze (Chuck never stood a chance.)

Re:As far as misleading headlines go (1)

BlackBloq (702158) | more than 4 years ago | (#31229306)

Actually, I think Chuck Norris would take the cake and use it to asphyxiate the headline, before reverse jump spin heel kicking said headline into the sun. RE-RE corrected as Chuck Norris would never finish on a roundhouse!

Re:As far as misleading headlines go (1, Interesting)

FluffyWithTeeth (890188) | more than 4 years ago | (#31228524)

I've also got to question the sense of naming a botnet like this. Sure it's memorable, but what's to stop Chuck Norris from taking legal action against the researchers who coined the name? I certainly wouldn't want my name associated with a criminal enterprise.

Re:As far as misleading headlines go (5, Funny)

Anonymous Coward | more than 4 years ago | (#31228632)

I've also got to question the sense of naming a botnet like this. Sure it's memorable, but what's to stop Chuck Norris from taking legal action against the researchers who coined the name? I certainly wouldn't want my name associated with a criminal enterprise.

...Chuck Norris is a fictional charactor...

Re:As far as misleading headlines go (0)

Anonymous Coward | more than 4 years ago | (#31228726)

I've also got to question the sense of naming a botnet like this. Sure it's memorable, but what's to stop Chuck Norris from taking legal action against the researchers who coined the name? I certainly wouldn't want my name associated with a criminal enterprise.

...Chuck Norris is a fictional charactor...

please tell me you're kidding?

he's an actor....

Re:As far as misleading headlines go (5, Funny)

ooshna (1654125) | more than 4 years ago | (#31229090)

...Chuck Norris is a fictional charactor...

Thats what they said about the fist in his beard

Re:As far as misleading headlines go (1)

daem0n1x (748565) | more than 4 years ago | (#31229118)

Ah, so much energy and money spent in lawsuits. Please leave the researchers alone. There are so many important things in life.

Re:As far as misleading headlines go (1)

cheshiremoe (1448979) | more than 4 years ago | (#31229270)

Haven't you seen is infomercials for the Total Gym? He is a real dude and he is going to break your face.

Re:As far as misleading headlines go (2, Informative)

Ltap (1572175) | more than 4 years ago | (#31229364)

Actually, he's Carlos Ray Norris and was born in 1940. The actor has the same name as most of his characters. Chuck Norris plays, well, Chuck Norris. Therefore they could even get the double whammy (or roundhouse kick?) of an infringement AND a libel lawsuit.

Re:As far as misleading headlines go (0)

Anonymous Coward | more than 4 years ago | (#31229516)

I've also got to question the sense of naming a botnet like this. Sure it's memorable, but what's to stop Chuck Norris from taking legal action against the researchers who coined the name? I certainly wouldn't want my name associated with a criminal enterprise.

...Chuck Norris is a fictional charactor...

Carlos Ray Norris Jr. [wikipedia.org] would like to disagree.

Re:As far as misleading headlines go (0)

Anonymous Coward | more than 4 years ago | (#31229596)

not to some ppl apparently >_> lol

Try lack of jurisdiction (3, Informative)

damn_registrars (1103043) | more than 4 years ago | (#31228692)

what's to stop Chuck Norris from taking legal action against the researchers who coined the name?

International boundaries, for one. Likely the author of the software for the botnet does not reside in the US (if that person's location is even known). Chuck Norris can take all the legal action he wants within the US against the botnet author or botnet master, it generally won't mean squat if they are in a different country.

Re:Try lack of jurisdiction (2, Insightful)

Sique (173459) | more than 4 years ago | (#31228830)

Moreso if anyone ever is able to detain the author and the deployer of the software and the operator of the botnet, then the nicknaming of it will be the least of their problems.

Re:Try lack of jurisdiction (2, Insightful)

FluffyWithTeeth (890188) | more than 4 years ago | (#31228838)

His name is only written in the source code, which I doubt anyone cares about. The issue is the researchers who decided to call it "The Chuck Norris Botnet" and then publish papers about it, using that name.

Re:Try lack of jurisdiction (1)

jeffmeden (135043) | more than 4 years ago | (#31228880)

The question was actually about the researcher; surely the author is already taking action to avoid the recourse of getting caught distributing/running a malicious botnet. However, the researcher (in this case Czech, could have easily been from the US) was the one that coined the name based on the code found. Would someone doing that be subject to legal action as a result? It's a gray area, but it wouldn't be hard to argue defamation if the researcher titled all his papers "Malicious Activity by Chuck Norris Botnet". Despite *our* ability to easily determine that the name has little to actually do with Chuck Norris, a less informed individual wouldn't be able to.

Re:Try lack of jurisdiction (3, Insightful)

cbiltcliffe (186293) | more than 4 years ago | (#31229070)

Despite *our* ability to easily determine that the name has little to actually do with Chuck Norris, a less informed individual wouldn't be able to.

And that is exactly the problem with the legal system.

Since when is it my responsibility to make sure you're educated in all the correct fields so that you don't get offended, or misinterpret something I say?

The fact that someone who's not informed could misunderstand me should not be able to present me with any legal problems at all.

Unfortunately, it does, because the system sucks.

Re:Try lack of jurisdiction (1)

Neoprofin (871029) | more than 4 years ago | (#31228910)

Or, and hear me out on this, he could take legal action, if there is any to be taken, in the applicable country. It seems to be a much disregarded fact on Slashdot that you don't need to be the citizen of, resident of, or even present in, a country to hire a lawyer there to file whatever papers you choose.

Chuck Norris sued "Penguin" (1)

YaHooL (1745114) | more than 4 years ago | (#31229092)

I've also got to question the sense of naming a botnet like this. Sure it's memorable, but what's to stop Chuck Norris from taking legal action against the researchers who coined the name? I certainly wouldn't want my name associated with a criminal enterprise.

Reuters Fri Dec 21, 2007 7:21pm: Tough-guy actor and martial arts expert Chuck Norris sued publisher Penguin on Friday over a book he claims unfairly exploits his famous name, based on a satirical Internet list of "mythical facts" about him.

"Norris, whose real name is Carlos Ray Norris, claims in the suit he is protective of what his name is associated with."

http://www.reuters.com/article/idUSN2129580420071222 [reuters.com]

Re:As far as misleading headlines go (1)

AttilaSz (707951) | more than 4 years ago | (#31229288)

The only legal action Chuck Norris takes is one where he is the judge, the jury, and the executioner.

Re:As far as misleading headlines go (1)

LordSnooty (853791) | more than 4 years ago | (#31229320)

I'd be more concerned with having my name associated with a very unamusing and old Internet meme...

Re:As far as misleading headlines go (0)

Anonymous Coward | more than 4 years ago | (#31229324)

So, why do you think a criminal enterprise would care about this? They've already demonstrated a disregard for the law.

Re:As far as misleading headlines go (5, Insightful)

suso (153703) | more than 4 years ago | (#31228564)

Yes, this is very misleading. I thought that maybe the Linux network stack was suddenly vulnerable or something, but you're just talking about it taking advantage of default passwords, which is pretty old if you ask me.

This doesn't necessarily mean that say a Linux router that was installed on PC class hardware and has been kept up to date and properly secured is vulnerable to this botnet.

Re:As far as misleading headlines go (0)

Anonymous Coward | more than 4 years ago | (#31228594)

Amazing how posts get modded insightful even though they take no time to explain their possition.

Given the track record of Slashdot recently I could probably put this on every article and get modded up.

Re:As far as misleading headlines go (4, Insightful)

Dunbal (464142) | more than 4 years ago | (#31228744)

Amazing how posts get modded insightful even though they take no time to explain their possition.

      The mod system shares the same flaw as democracy: Morons also have a vote.

Re:As far as misleading headlines go (2, Funny)

FlyingBishop (1293238) | more than 4 years ago | (#31228784)

Bigger problem is the inability to change your vote, and locating positive and negative mods in close proximity to each other so it's easy to accidentally mod someone up/down with no recourse.

Re:As far as misleading headlines go (3, Informative)

andi75 (84413) | more than 4 years ago | (#31229024)

If you really screwed up moderating, just post a reply in the same thread, that will undo all your moderations.

Re:As far as misleading headlines go (2, Insightful)

jeffmeden (135043) | more than 4 years ago | (#31228906)

I will take a shot at this, although I am not the OP. The botnet has little to do with Chuck Norris OR Linux in particular, only that these names come up when investigating it. It is a run of the mill botnet, it takes advantage of default/weak passwords.

If you're planning on making a 'kick joke' (0, Troll)

Fanboy Fantasies (917592) | more than 4 years ago | (#31228382)

Please insert your head here.
*_g_o_a_t_s_e_x_*_g_o_a_t_s_e_x_*_g_o_a_t_s_e_x_*_
g_______________________________________________g_ _
o_/_____\_____________\____________/____\_______o_ _
a|_______|_____________\__________|______|______a_ _
t|_______`._____________|_________|_______:_____t_ _
s`________|_____________|________\|_______|_____s_ _
e_\_______|_/_______/__\\\___--___\\_______:____e_ _
x__\______\/____--~~__________~--__|_\_____|____x_ _
*___\______\_-~____________________~-_\____|____*_ _
g____\______\_________.--------.______\|___|____g_ _
o______\_____\______//_________(_(__>__\___|____o_ _
a_______\___.__C____)_________(_(____>__|__/____a_ _
t_______/\_|___C_____)/INSERT\_(_____>__|_/_____t_ _
s______/_/\|___C_____)_GERBIL|__(___>___/__\____s_ _
e_____|___(____C_____)\_HERE_/__//__/_/_____\___e_ _
x_____|____\__|_____\\_________//_(__/_______|__x_ _
*____|_\____\____)___`----___--'_____________|__*_ _
g____|__\______________\_______/____________/_|_g_ _
o___|______________/____|_____|__\____________|_o_ _
a___|_____________|____/_______\__\___________|_a_ _
t___|__________/_/____|_________|__\___________|t_ _
s___|_________/_/______\__/\___/____|__________|s_ _
e__|_________/_/________|____|_______|_________|e_ _
x__|__________|_________|____|_______|_________|x_ _
*_g_o_a_t_s_e_x_*_g_o_a_t_s_e_x_*_g_o_a_t_s_e_x_*_


Important Stuff: Please try to keep posts on topic. Try to reply to other people's comments instead of starting new threads. Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) If you want replies to your comments sent to you, consider logging in or creating an account.

Important Stuff: Please try to keep posts on topic. Try to reply to other people's comments instead of starting new threads. Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) If you want replies to your comments sent to you, consider logging in or creating an account.

Important Stuff: Please try to keep posts on topic. Try to reply to other people's comments instead of starting new threads. Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) If you want replies to your comments sent to you, consider logging in or creating an account.

Re:If you're planning on making a 'kick joke' (-1, Troll)

somersault (912633) | more than 4 years ago | (#31228438)

Please try to keep posts on topic, Mr gerbil<=>arse obsessed dude.

Is anything (3, Funny)

AllyGreen (1727388) | more than 4 years ago | (#31228430)

safe from Chuck Norris??

Re:Is anything (1, Funny)

Anonymous Coward | more than 4 years ago | (#31228484)

Only Chuck Norris is safe from Chuck Norris.

Re:Is anything (1)

Culture20 (968837) | more than 4 years ago | (#31228652)

Only Chuck Norris is safe from Chuck Norris.

Are you implying that Chuck Norris could beat up Chuck Norris?

Re:Is anything (1)

Razalhague (1497249) | more than 4 years ago | (#31228862)

No, he's implying that Chuck Norris couldn't beat up Chuck Norris.

Re:Is anything (4, Funny)

hvm2hvm (1208954) | more than 4 years ago | (#31228968)

If Chuck Norris ever fights himself (like if he goes back in time) he will win. End of story.

Re:Is anything (1)

JustOK (667959) | more than 4 years ago | (#31229014)

Imagine a Beowulf cluster of time traveling Chuck Norrises fighting each other.

Re:Is anything (2, Insightful)

Culture20 (968837) | more than 4 years ago | (#31229032)

Imagine a Beowulf cluster of time traveling Chuck Norrises fighting each other.

Please sell the movie rights to your idea. I. Want. To. See. That.

the REAL Chuck Noris (5, Funny)

bsDaemon (87307) | more than 4 years ago | (#31228436)

The REAL Chuck Noris wouldn't have to guess the default password, he'd just round-house kick the modem until it let him in without it.

Re:the REAL Chuck Noris (5, Funny)

Anonymous Coward | more than 4 years ago | (#31228548)

There is no password behind Chuck Norris' router, there is only another fist.

Re:the REAL Chuck Noris (4, Funny)

L4t3r4lu5 (1216702) | more than 4 years ago | (#31228932)

Chuck Norris has no need of a router. He simply stares at an inexpensive hub until it starts packet switching out of fear.

His last hub was only rebooted once. Rebooted into the sun.

And will the Bruce Lee Bot Net be fighting it? (1)

wintercolby (1117427) | more than 4 years ago | (#31228442)

So . . . Where's the Bruce Lee Bot Net in all this? Will it be involved in some botnet tournament, fighting over Linksys, D-Link and Netgear routers in a winner takes all competition?

Only time will tell if this botnet can withstand the test of time, only to appear in really cheesey YouTube shows about a botnet turned good out to beat some serious Texas Worm's butt.

Re:And will the Bruce Lee Bot Net be fighting it? (4, Funny)

Xemu (50595) | more than 4 years ago | (#31228512)

Will it be involved in some botnet tournament, fighting over Linksys, D-Link and Netgear routers in a winner takes all competition?

That would be the "Highlander" botnet

Re:And will the Bruce Lee Bot Net be fighting it? (0)

Anonymous Coward | more than 4 years ago | (#31229038)

I do believe that the vxworks based SB5120 and SMC connect devices will win the fight. http://www.exploit-db.com/download_pdf/11194

Only Jack Bauer can beat Chuck Norris! (-1, Troll)

Anonymous Coward | more than 4 years ago | (#31228444)

And in just 24 hours.

nobody can resist Chuck Norris (1)

Fotograf (1515543) | more than 4 years ago | (#31228452)

not even linux for god sake, look him up in Google, and if you are brave enough in Google Images! (i warned you)

Stupid jokes incoming in 3...2...1... (2, Funny)

selven (1556643) | more than 4 years ago | (#31228466)

Not even Bruce Schneier [schneierfacts.com] can protect your router from Chuck.

Re:Stupid jokes incoming in 3...2...1... (5, Funny)

krou (1027572) | more than 4 years ago | (#31228560)

The malware got the Chuck Norris moniker from a programmer's Italian comment in its source code: 'in nome di Chuck Norris,' which means 'in the name of Chuck Norris.'

In other news, an Italian programmer was found dead after taking Chuck Norris's name in vain.

Re:Stupid jokes incoming in 3...2...1... (4, Funny)

rubycodez (864176) | more than 4 years ago | (#31228734)

...with the impression of a foot in the side of his head

Re:Stupid jokes incoming in 3...2...1... (1)

krou (1027572) | more than 4 years ago | (#31228860)

The only impression Chuck Norris leaves is the quite accurate impression that you're dead.

non Linux based routers (3, Insightful)

viralMeme (1461143) | more than 4 years ago | (#31228488)

'It installs itself on routers and modems by guessing default administrative passwords and taking advantage of the fact that many devices are configured to allow remote access."'

Does this botnet attack also work on non Linux based routers and if so the what is the logic behind the subject line ?

Re:non Linux based routers (5, Informative)

Flibberdy (780254) | more than 4 years ago | (#31228554)

'It installs itself on routers and modems by guessing default administrative passwords and taking advantage of the fact that many devices are configured to allow remote access."' Does this botnet attack also work on non Linux based routers and if so the what is the logic behind the subject line ?

No, It requires the router to be running Linux on a MIPS system.

Re:non Linux based routers (2, Informative)

langelgjm (860756) | more than 4 years ago | (#31228562)

It doesn't help that standard installs of Comcast and Verizon FiOS provided routers not only leave the default administrative usernames and passwords intact, but also enable only WEP security. I know people claim that they have to do this because of compatibility, but really, has anyone bought anything in the last five years that doesn't support WPA? I've seen techs enable WEP for a person with a single Macbook.

Granted, they don't enable remote access, but really, what is so hard about writing down passwords and taping them to the bottom of the router?

Re:non Linux based routers (0)

Anonymous Coward | more than 4 years ago | (#31228582)

Well that takes about 1-2 minutes that I could use for downloading porn. And porn wins, every time.

Re:non Linux based routers (3, Informative)

Nursie (632944) | more than 4 years ago | (#31228654)

Apparently the nintendo DS, unless some sort of update has been released, only does WEP.

This is not a good thing.

Re:non Linux based routers (2, Interesting)

Anderu67 (1179779) | more than 4 years ago | (#31229018)

There's no way to update the DS, as the wi-fi stack is built into each game cartridge. Chances are you wouldn't be using a DS online enough to want to lower your security though...

Re:non Linux based routers (2, Informative)

Anonymous Coward | more than 4 years ago | (#31228716)

but really, has anyone bought anything in the last five years that doesn't support WPA?

Yes. The Nintendo DS and DS Lite only support WEP. They launched in 2004 and 2006, respectively. Only the third iteration of the device (the DSi) has WPA support, but it's less than a year old, and the DS Lite seems to still be selling.

Re:non Linux based routers (2, Informative)

petermgreen (876956) | more than 4 years ago | (#31229310)

It's worse than that, on the DS games drive the wifi hardware directly so while the DSi does support WPA you can only use it in games that specifically support it.

Re:non Linux based routers (1)

lyinhart (1352173) | more than 4 years ago | (#31228958)

The Actiontec Mi424-WR Verizon provides for FiOS supports WPA and WPA2, at least from Revision D on. But by default, it uses WEP (the web admin console actually recommends WEP). One of the Westell routers I've seen for a Verizon Business DSL installation a few years back only supports WEP. So I just disabled wireless outright for that installation.

Re:non Linux based routers (1)

Rich0 (548339) | more than 4 years ago | (#31229568)

I just got a FIOS wireless router a few months ago, and I only see WEP in the configuration settings. I disabled it entirely and am using a separate access point running DD-WRT.

I'm just utterly amazed that in 2010 that EVERYTHING doesn't support WPA2.

Also - it is very annoying that there is no standard for providing secure WiFi connections that doesn't involve a shared secret. It is like http all over again (also no standard for secure connections that doesn't involve a trusted certificate). Even if you can't get authentication you should at least be able to secure a connection against passive listeners with either technology, and this should be the default.

Re:non Linux based routers (1)

thedonger (1317951) | more than 4 years ago | (#31229268)

Granted, they don't enable remote access, but really, what is so hard about writing down passwords and taping them to the bottom of the router?

The Chuck Norris botnet can read the password taped to the bottom of your router.

Re:non Linux based routers (1)

AHuxley (892839) | more than 4 years ago | (#31228578)

"guessing default administrative" could be looked up and listed in their code via sites like
http://www.portforward.com/ [portforward.com]
Then just hope like a UFO hunter on a US mil network, its a default hunt.

Re:non Linux based routers (1, Insightful)

Culture20 (968837) | more than 4 years ago | (#31228604)

non Linux based routers

Quick! This man is talking but something is not right. The words are real, but they don't make sense in this sequence. Chuck Norris must have given him a roundhouse kick to the head.
These days, "non Linux based router" is like saying "non carbon based life" (assuming we're talking about home networks.

Re:non Linux based routers (3, Informative)

morgan_greywolf (835522) | more than 4 years ago | (#31228720)

Not so.

For example, some Linksys routers run Linux, but others run a proprietary VxWorks-based OS. They're all, to my knowledge, based on MIPS processors.

Re:non Linux based routers (1)

phrostie (121428) | more than 4 years ago | (#31229098)

I have to agree with the lighten up part.
if this is the best they can do, then bring it on.

besides, i'm more of a Jackie Chan fan myself

Re:non Linux based routers (1)

Nutria (679911) | more than 4 years ago | (#31228674)

Well, it's Monday morning (where I am, in America, which is all that counts!), so a serious case of lack-of-humor is to be expected on the part of some commenters.

Thus: lighten up people.

Re:non Linux based routers (1)

Daley_G (1592515) | more than 4 years ago | (#31229204)

'...what is the logic behind the subject line ?'

Marketing. It got us to click on it, which is what the goal was.

Wow, wasn't aware Chuck Norris was a botnet (4, Funny)

knewter (62953) | more than 4 years ago | (#31228666)

Am I the only one who was entirely terrified by this headline?

Re:Wow, wasn't aware Chuck Norris was a botnet (1)

FlyingBishop (1293238) | more than 4 years ago | (#31228792)

I thought Chuck Norris was speaking out against the use of socialist software.

Re:Wow, wasn't aware Chuck Norris was a botnet (0)

Anonymous Coward | more than 4 years ago | (#31228884)

Linux isn't socialist. We know this because it actually works.

Re:Wow, wasn't aware Chuck Norris was a botnet (0)

Anonymous Coward | more than 4 years ago | (#31229208)

By that logic, Linux must not be Republican.

Re:Wow, wasn't aware Chuck Norris was a botnet (0)

Anonymous Coward | more than 4 years ago | (#31228946)

In Soviet Russia Linux-Based Routers attack Chuck Norris.

Re:Wow, wasn't aware Chuck Norris was a botnet (1)

AP31R0N (723649) | more than 4 years ago | (#31228864)

Chuck Norris isn't a BotNet, it's just that he's so deadly that his AIM status message leaves devastation in its wake.

Chuck Norris Doesn't Even Need to Attack Them (1)

cfriedt (1189527) | more than 4 years ago | (#31228938)

Chuck Norris doesn't even need to attack them, they just submit because they know he could fry their CPU with a single packet!

Re:Chuck Norris Doesn't Even Need to Attack Them (1)

Eternauta3k (680157) | more than 4 years ago | (#31229322)

Chuck Norris doesn't even need to attack them, they just submit because they know he could fry their CPU with a single packet!

Actually, if they submit they're probably sending a couple of HTTP packets

Have we found his one weakness? (2, Funny)

L4t3r4lu5 (1216702) | more than 4 years ago | (#31228980)

Is Chuck Norris really defeated by changing the admin password on your home router?!

That would have made Bruce Lee's job a lot easier.

Source code? (1)

marciot (598356) | more than 4 years ago | (#31229080)

"The malware got the Chuck Norris moniker from a programmer's Italian comment in its source code: 'in nome di Chuck Norris'"

Source code? How did they get the source code? Wouldn't a virus in the wild be compiled? Is this some strange virus that carries around its source code and compiles itself for every new host it infects?

If so, I believe a Gentoo programmer is behind this virus outbreak.

So, and I'm guessing here... (2, Insightful)

stakovahflow (1660677) | more than 4 years ago | (#31229132)

---
Note to Consumers:

I'm just guessing that the user name is "admin", "Admin", "root", or "user" and the password is either "password", "admin", or "actiontec"...

I've setup some of those modems/routers, mainly for people who went to Best Buy (EEK!) and thought "Hey! That's exactly what I'm looking for! That will work great for my Verizon DSL connection! Hey, it's got the Verizon logo right there!"...

FAIL!

!!!!!!!!!!!
Beware anything branded by an ISP, to begin with... And most devices created for a not-so-security-savvy consumer... If all else fails, have a pro come in and set it up for you...
They will be able to have you reset the password and setup some sort of encryption/authentication for your wireless network...
!!!!!!!!!!!

The problem here is that the default username & password for almost every new (Home-based) router or modem is going to be "admin" & "admin" or "admin" & "password"...

What really needs to be done here is that, by default, the device should not be able to connect to the Interwebz with the default settings. If nothing else, have the external web/console interface blocked... "Security through obscurity", including an odd http/https port is only so effective... And most of the time, in my little bit of experience, it is not that obscure... Once the device is out there, its configuration will be scrutinized and, in most cases, prodded by hackers & crackers alike, for "security" concerns.

And don't give me the "Oh, it's Linux. Secure by default!" bit. Any operating system is only as secure as the person controlling it. If you were to have no clue as to how an internal combustion engine works, would you take on the task of rebuilding your (gas-guzzling) car's engine? Most likely not... Why would you think that you could secure your Internet connection if you have no knowledge of how the Internet and, even more than that, people work?

Just another bad thought...

Cheers!

--Stak

Linux fanism (0, Troll)

mozzis (231162) | more than 4 years ago | (#31229170)

So if Confiker owns Windows boxen it's because Windows is awful and shoddy. But if CN owns Linux boxen it's because they are "misconfigured". Grow up, /.

Re:Linux fanism (1)

Midnight Thunder (17205) | more than 4 years ago | (#31229392)

So if Confiker owns Windows boxen it's because Windows is awful and shoddy. But if CN owns Linux boxen it's because they are "misconfigured". Grow up, /.

You are obviously new around here.

Re:Linux fanism (2, Informative)

mikechant (729173) | more than 4 years ago | (#31229450)

So if Confiker owns Windows boxen it's because Windows is awful and shoddy. But if CN owns Linux boxen it's because they are "misconfigured".

Given that confiker exploited actual bugs in windows which MS had to patch, and that 'Chuck Norris' is exploiting the fact that certain appliance suppliers deliberately 'configured' Linux with a fixed and known id and password, the statement above that you deride is *in this particular case* clearly accurate.

You do understand the difference between an actual bug causing a security problem and a deliberate choice to 'leave the front door open' don't you?

Re:Linux fanism (2, Informative)

slimjim8094 (941042) | more than 4 years ago | (#31229456)

Conficker exploited Windows machines with an unpatched security hole. True, Microsoft had patched the hole but it shouldn't have been there in the first place.

Using a default password to gain what is technologically legitimate access to the operating system is not a vulnerability.

It's like phishing - the fact that someone is too stupid to use online banking safely doesn't imply that their computer was hacked.

It's easy to get rid of (1, Informative)

Anonymous Coward | more than 4 years ago | (#31229176)

"Because the Chuck Norris botnet lives in the router's RAM, it can be removed with a restart.

Users who don't want to be infected can mitigate the risk -- the simplest way of doing this is by using a strong password on the router or modem. "

1 - disconnect from internet
2 - reset the router by removing the power for thirty seconds.
3 - change the router's password.
        If you've never changed the router's settings:
        You could rtfm (read the fine manual).
        You can usually get to the router's settings from your browser. Try typing 192.168.1.1 into the the
        browser's URL bar.
        The browser will present you with a logon screen. The user name is often blank and the password is
        often 'admin'. That's the password you want to change. Don't change the password that logs you onto
        the internet. Stick a piece of tape onto the router and write on the new user name and password.
4 - ???
5 - profit!

(sorry, I got carried away)

Chuck Norris... (2, Funny)

DarthVain (724186) | more than 4 years ago | (#31229242)

doesn't need computers in his Botnet, he just ...er infects routers and modems...

and my all time favorite:

Chuck Norris doesn't do push ups. He pushes the planet down.

What now? (1)

drej (1663541) | more than 4 years ago | (#31229326)

The logical action one takes after reading a newspost such as this is to fix the holes/bugs mentioned in TFA. But...if it all happens in the name of Chuck Norris, should one really dare?

Next up: (1)

Hurricane78 (562437) | more than 4 years ago | (#31229374)

The Leonidas botnet and the Techno Viking botnet team up to fight the Vin Diesel botnet and the Mr T botnet.
The winner gets to rip Chuck Norris apart.

I can't stop..... (1)

MooPi (1235436) | more than 4 years ago | (#31229616)

Either the effects of insomnia are finally sending me over the edge or this is my favorite ./ thread ever. Besides has anyone ever seen a Chuck Norris round house. No because you can't.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...