White hat hackers are correcting flaws left in them from the manufacturer. Who'd a thunk?

Susoni

Most router malware just sits on your home network and uses the device to launch further attacks. In particular, infected routers are useful for generating power for distributed denial of service (DDoS) attacks, where servers are flooded with traffic from hacked machines.

But there’s a curious kind of malware (if you can call it that) going around that not only cleans the device of other infections but even encourages users to update their passwords, according to research from security giant Symantec.

The Wifatch software, now resident on at least 10,000 routers running the Linux operating system, runs across a peer-to-peer network. When it discovers that a potentially vulnerable Telnet port – a port typically used to control functions on the device and is often protected with default, crackable passwords – Wifatch shuts it down. It then asks the user to change passwords and update the firmware on the router. Furthermore, Wifatch has a module that tries to remove “well-known families of malware targeting embedded devices”.

Symantec researcher, Mario Ballano, suspects a “white hat” vigilante might be behind the malware. There’s another reason to suspect a vigilante: they left comments in the code, including a signature included in the emails of free software advocate Richard Stallman: “To any NSA and FBI agents reading my email: please consider whether defending the US Constitution against all enemies, foreign or domestic, requires you to follow Snowden’s example.”

FORBES emailed Richard Stallman, but he hadn’t responded to a request for comment at the time of publication.

The malware writer, or writers, didn’t go to any lengths to hide their code, though it “would have been easy”, wrote Bollano in a blog post. “It looks like the author wasn’t particularly worried about others being able to inspect the code,” he added.

Internet vigilantes are rare. The Anonymous hacktivist group used only aggressive means, carrying out DDoS attacks to make their point known, whilst LulzSec often breached companies and exposed their data to highlight insecurities. Whoever is behind Wifatch has an entirely different, ostensibly more altruistic, modus operandi.

Despite their best intentions, Wifatch’s creator is carrying out illegal acts solely by infecting machines without the permission of the owners. “We believe that most of Wifatch’s infections are happening over Telnet connections to devices using weak credentials. After monitoring Wifatch’s network for a number of months, we estimate it to include somewhere in the order of tens of thousands of devices,” Bollano added. Infected devices could include other so-called Internet of Things (IoT) machines, such as automated kitchen goods or connected toys. He noted the malware writers would also have the ability to carry out more malicious actions if they wanted, though there’s little sign they do.

“There is no doubt that Linux.Wifatch is an interesting piece of code. Whether the author’s intentions were to use their creation for the good of other IoT users – vigilante style – or whether their intentions were more malicious remains to be seen,” Bollano added.

IoT security expert Ted Harrington, of Independent Security Evaluators, said people should be wary of the code. “My hypothesis would be that the author of this malware may have become frustrated with how often basic security flaws persist across devices, especially in connected devices. Well known, easily addressed, readily understood security flaws are constantly being introduced to connected devices,” he told FORBES.