This vigilante virus protects you against malware attacks, quotes Richard Stallman
Seriously.
Symantec first became aware of the superhero malware—dubbed Linux.Wifatch—in 2014, when an independent researcher noticed weirdness occurring on his router. As it turns out, the router had been transformed into a zombie, thrall to a large, sophisticated peer-to-peer botnet. The P2P network isn’t used to conduct denial of service attacks or distribute malware, however. Instead, it passes malware threat updates between the zombies in the botnet, because Wifatch actually eliminates any other malware on your device, including “well known families of malware targeting embedded devices.”
That’s, well, pretty darn cool but the eradication of other malware isn’t a sign of a benevolent infection in and of itself, as nefarious malware has been known to run virus scans in the past not to protect the host device, but to muscle out the competition. Numerous other signs point to Wifatch’s vigilante nature, however.
Once installed, Wifatch hardens a device against traditional attack channels, including killing its legitimate Telnet daemon—but when it does so, it leaves a useful tip for the device’s owner, imploring him to update the device’s firmware and change its Telnet password, as seen above.
Furthermore, the source code contains the following plea for law enforcement officials, which is a reference to the email signature of GNU guru Richard Stallman:
The Wifatch malware even includes an exploit module for Dahua DVR CCTV systems that forces them to reboot weekly. “One could speculate that because Wifatch may not be able to properly defend this type of device, instead, its strategy may be to reboot it periodically which would kill running malware and set the device back to a clean state,” Symantec’s Mario Ballano writes.
The author of Wifatch didn’t obfuscate its code; in fact, the malware’s source code includes numerous debug messages so that researchers can more easily dig through it, Symantec reports.
The impact on you at home: This all sounds pretty wonderful, but Symantec warns that Wifatch infects without consent and “contains a number of general-purpose back doors that can be used by the author to carry out potentially malicious actions.” The security firm has been monitoring the Wifatch network for months, however, and hasn’t seen a single sign of malicious action—and the back doors are cryptographically signed to ensure commands come from the malware’s genuine author, reducing Wifatch’s risk of being hijacked by a truly malicious third party.
Simply resetting your router will kill Wifatch. To ward off potential infection, Symantec offers the very same advice as the malware itself: Update your device’s firmware and change its passwords.
Via The Verge