Hacker Distributes Backdoored Iot Vulnerability Scanning Script To Hack Script Kiddies

Nothing is gratis inwards this world.

If y'all are searching for gratis hacking tools on the Internet, hence beware—most freely available tools, claiming to survive the swiss regular army knife for hackers, are naught only a scam.

For example, Cobian RAT in addition to a Facebook hacking tool that nosotros previously reported on The Hacker News truly could hack, only of the ane who uses them in addition to non the ane y'all wishing to hack.

Now, a safety researcher has spotted closed to other hacking tool—this fourth dimension a PHP script—which is freely available on multiple pop subway scheme hacking forums in addition to allows anyone to discovery vulnerable internet-connected IP Cameras running the vulnerable version of GoAhead embedded web-server.

However, subsequently closely analysing the scanning script, Newsky Security researcher Ankit Anubhav constitute that the tool also contains a undercover backdoor, which essentially allows its creator to "hack the hacker."

"For an attacker’s betoken of view, it tin survive real beneficial to hack a hacker," Anubhav said.

"For example, if a script kiddie owns a botnet of 10,000 IoT in addition to if he gets hacked, the entire botnet is straightaway inwards command of the assaulter who got command of the organisation of this script kiddie. Hence, yesteryear exploiting ane device, he tin add together thousands of botnets to his army."

The ascension of IoT botnet in addition to publish of Mirai's source code—the biggest IoT-based malware threat that emerged concluding twelvemonth in addition to took downward Dyn DNS service—has encouraged criminal hackers to practise their massive botnet either to launch DDoS attacks against their targets or to rent them to earn money.

As shown inwards the self-explanatory flowchart, this IoT scanning script industrial plant inwards 4 steps:

• First, it scans a laid upwards of IP addresses to discovery GoAhead servers vulnerable to a previously disclosed authentication bypass vulnerability (CVE-2017-8225) inwards Wireless IP Camera (P2P) WIFI CAM devices.
• In the background, it secretly creates a backdoor user trouble organisation human relationship (username: VM | password: Meme123) on the wannabe hacker's system, giving the assaulter same privilege every bit root.
• Script also extracts the IP address of the wannabe hacker, allowing script writer to access the compromised systems remotely.
• Moreover, it also runs closed to other payload on the script kiddie’s system, eventually installing a well-known botnet, dubbed Kaiten.

This tool is closed to other instance of backdoored hacking tools increasingly beingness distributed at diverse subway scheme forums to hack the hacker.

In September, a backdoored Cobian RAT builder kit was spotted on multiple subway scheme hacking forums for gratis only was caught containing a backdoored module that aimed to render the kit's authors access to all of the victim's data.

Last year, nosotros reported virtually closed to other Facebook hacking tool, dubbed Remtasu, that truly was a Windows-based Trojan alongside the capability to access Facebook trouble organisation human relationship credentials, only of the ane who uses it to hack somebody else.

The bottom line: Watch out the gratis online materials real carefully earlier using them.

Share This :