Pwn goal: Hackers used the username root, password root for botnet control database login

An IoT botnet has been commandeered by white hats after its controllers used a weak username and password combination for its command-and-control server. Ankit Anubhav, of Newsky Security, said researchers with the company were able to take over the MySQL server used to control the Owari botnet – thanks to its creator leaving …

[J. R. Hartley]

The title is no longer required.

Facepalm

[The Hat In A Cat]

Re: The title is no longer required.

That comment and then this one isn't required either.

[Anonymous Coward]

They should've picked a better name

Mirai = future

Owari = the end

Add them together, their malware future has ended.

[jake]

Those aren't hackers.

Those are script kiddies.

[Anonymous Coward]

Unauthorised access

Are the white hats liable to prosecution for unauthorised access of the MYSQL server? Seems to be the case when white hats access other systems, even if they are just trying to point out to the owner that it needs fixing.

[Nick Kew]

Re: Unauthorised access

That was my first thought, too.

Even if it wasn't a clear breach under old law, Leveson is firmly stamping on this kind of thing.

[Steve Aubrey]

Don't be so hard on them

It was on their to-do list. Even hackers have tech debt.

[FuzzyWuzzys]

When will devs speak to their infrastructure teams?! Ha!

As usual the developers go charging off and putting dev code out into production before they speak with the DBA and infrastructure teams! Bloody typical! Although in fairness, I can imagine these hacker devs probably has some arsehole project manager beating them with the paperwork and demanding a stupid release date be met! Ha ha!

[T. F. M. Reader]

Throwaway by design?

And maybe no really important information to protect? So no real reason to invest in security? Easy to remember creds on a shared system, and who cares if they are weak?

Maybe these guys are not completely daft, after all. The article seems to suggest the white hats didn't manage to do much even with everything they discovered...

Not sure why the bad guys had any history. That may cause some information leakage (though it seems to have leaked their competitors' IP addresses only in this case, eh?). That actually does sound like development infrastructure left in "production" code by negligence...

[Brewster's Angle Grinder]

The Al Capone manoeuvre

But it does mean we can prosecute them under the GDPR. They might think twice about their exploits, then.

[Nick Kew]

Re: Throwaway by design?

Interesting thought. Honeypot or false flag spring to mind.

If the security researchers are following up the information they found by spending their time chasing red herrings, or someone who's been framed ....

BTW, nice username!

[Doctor Syntax]

Even when the errors are as basic as this it really isn't a good idea to publish them. Just let them make the same mistake elsewhere.

[Waseem Alkurdi]

They would: root / toor this time.

And root / r00t for the next.

[handleoclast]

They would: root / toor this time.

Nope, password / username is a lot better. Nobody is expecting password for the username and username for the password. Guaranteed secure.

[Joe Montana]

Hacked box

Chances are they deployed the C&C on a compromised box, and root/root is probably how they themselves got access to it in the first place.

[Claptrap314]

I blame MySQL

For having a default password & admin account name in the first place.