An anonymous researcher created a massive botnet by hijacking about 420,000 Internet-accessible embedded devices with default or no login passwords and used it to map the entire Internet.
The botnet, which was dubbed Carna after the Roman goddess of physical health, ran between March and December 2012, and was used to perform "the largest and most comprehensive IPv4 [Internet Protocol version 4] census ever," the researcher said Sunday on a website dedicated to the project.
[ The Web browser is your portal to the world -- as well as the conduit that lets in many security threats. InfoWorld's expert contributors show you how to secure your Web browsers in this "Web Browser Security Deep Dive" PDF guide. ]
The data collected by the botnet -- a total of 9TB -- was released into the public domain for anyone to download and analyze. It includes the results of port scans that show what services are most commonly used on the Internet and the software used to run them, information about the total number of IPv4 addresses that are actually in use, millions of traceroute records, and much more.
Even though this particular botnet doesn't appear to have been used for malicious purposes, it highlights the potential for abuse of poorly configured embedded devices by cyber criminals, other researchers said.
The botnet client software that ran on the insecure devices was written in plain C, was 60KB in size, and had a self-propagation and device re-infection mechanism. The spreading mechanism scanned public IP addresses for insecure devices and tried to access them over the telnet protocol using default login credentials like root:root, admin:admin, root with no password, or admin with no password.
Rebooting an infected device automatically led to the removal of the Carna botnet client. However, the remaining active clients would automatically reinfect it upon its return online.
The anonymous researcher claims that he took some precautions when designing the botnet client software so that it wouldn't disrupt the normal operation of the infected devices. "Our binaries were running with the lowest possible priority and included a watchdog that would stop the executable in case anything went wrong," he said. "Our scanner was limited to 128 simultaneous connections and had a connection timeout of 12 seconds."
The botnet binary ignored all activity from the internal networks of the compromised devices, the researcher said. "We used the devices as a tool to work at the Internet scale. We did this in the least invasive way possible and with the maximum respect to the privacy of the regular device users."
Even so, the methodology used in this "Internet Census 2012" project is highly illegal in most countries, said Mark Schloesser, a security researcher at vulnerability and risk management firm Rapid7, Tuesday via email. "Using insecure configurations and default passwords to gain access to remote devices and run code on them is unethical, and taking precautions to not interfere with any normal operation of the devices being used doesn't make it OK."
The researcher responsible for the project said Tuesday via email that he prefers to remain anonymous precisely because he doesn't want to figure out the legal aspects of it in detail.
Even though the Carna botnet grew to reach about 420,000 clients, the actual number of "open" devices -- devices with default or no access passwords -- was much higher. "Approximately 70 percent of all open devices are either too small, don't run Linux, or only have a very limited telnet interface, making it impossible to start or even upload a binary," the researcher said on the Internet Census 2012 website.
