Kaspersky Lab not too long ago blogged a couple of mysterious little bit of malware referred to as “Hajime” that’s particularly focusing on Internet of Things units. This worm has contaminated round 300,000 units up to now, with Vietnam, Iran and Brazil seeing the best incidences of infections. It was first reported in October 2016 by the safety analysis group (SRG) at Rapidity Networks.
The Goal Is Propagation
What makes this piece of malware attention-grabbing is that it doesn’t include any assault code. Its function, proper now not less than, seems solely to be propagation.
Konstantin Zykov, senior safety researcher at Kaspersky Lab, factors out that this botnet has not been concerned in any recognized assaults or malicious exercise. This lack of exercise runs counter to the current historical past of contaminated IoT units. They’ve been utilized in numerous assaults, similar to the October 2016 Dyn distributed denial of service attack.
Most of those botnet assaults have a selected structure — managed via a centralized malware distribution server. That’s not the case for Hajime-infected units.
Instead, they talk through a decentralized peer-to-peer community. Security specialists consider this decentralized strategy to propagation is deliberate and makes it harder to take down the Hajime botnet.
Exploring the Mirai-Hajime Connection
The preliminary report by the SRG at Rapidity Networks notes an attention-grabbing connection between Hajime and the Mirai virus. Hajime carefully resembles the reconnaissance and an infection behaviors of the notorious Mirai, which has been very profitable at infecting poorly secured IoT units. The SRG suggests there is perhaps some connection between the 2.
The timeframe of when Hajime was activated within the wild probably overlapped with the general public launch date of the Mirai supply code on Oct. 14, 2016. The SRG believes that the worm’s similarities to Mirai serve to masks its presence, main safety professionals and community directors to dismiss it as a Mirai assault and never trouble to extra carefully scrutinize its code.
But there seems to be extra to the Hajime-Mirai connection than the SRG revealed. ExtremeTech reports that as soon as Hajime infects a machine, it covers its tracks and hides itself inside the file system. Then it blocks entry to 4 ports which might be particular targets of the Mirai assault and shows the next message each 10 minutes on the machine’s entry terminal:
Could Hajime Actually Be a Savior?
Is there extra to Hajime than meets the attention? By blocking ports 23, 7547, 555 and 5358 — the Mirai assault vectors — Hajime is definitely making its contaminated units safer. Combined with the above terminal message, some specialists consider that Hajime is the work of a white hat hacker vigilante looking for to safe IoT units.
More attention-grabbing, Hajime’s design permits solely its writer to open a shell script on any contaminated machine within the botnet and add new capabilities, that are then distributed via all the community.
And the writer has seen the eye his or her creation has garnered from researchers. The SRG’s preliminary report identifies bugs within the worm and gives signatures for detecting them. Since the report’s launch, the bugs have been mounted. This process may solely have been achieved by the unique writer of the worm.
Skepticism About Hajime Remains
Despite the obvious good intentions of Hajime’s creator, the worm nonetheless worries safety specialists for numerous causes.
Among them, it’s very unusual for a malware writer to instantly take safety analysis and enhance a creation. This may set a sample for extra malicious-minded hackers doing the identical factor — actively making their viruses much more dangerous.
And there’s a great deal of skepticism amongst safety groups as to the actual intention of Hajime, with some suggesting that it may rapidly be coded for nefarious functions, given its peer-to-peer design. Time will inform if Hajime is actually the start of a brand new period in malware design and distribution.
