Malware
malware:carna_botnet
Also: Carna
Botnet program that propagated through internet-connected systems using default Telnet credentials and was used to scan the internet.
Botnet program that propagated through internet-connected systems using default Telnet credentials and was used to scan the internet.
“Researcher looked at this creation and decided to call it the Carna Botnet.”
“The researcher created a program that would scan and find unprotected systems and then upload that same program to the systems it found”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Telnet | Explicit | 13 |
| outgoing | EXPLOITS | weak default passwords | Explicit | 13 |
| outgoing | USES | internet-wide scanning | Explicit | 13 |
| outgoing | USES | lateral movement | Explicit | 13 |
| outgoing | ASSOCIATED_WITH | botnet | Explicit | 13 |
| outgoing | RELATED_TO | Aidra Botnet | Explicit | 13 |
| outgoing | LEADS_TO | Internet Census of 2012 | Explicit | 13 |
Carna Botnet USES Telnet
The Carna Botnet scanned internet-connected systems running Telnet and used Telnet access during its propagation.
Explicit Confidence 98% · Jack Rhysider EP 13 Details
“The researcher created a program that would scan and find unprotected systems and then upload that same program to the systems it found”
“The first mission was just to see how many devices were running Telnet with default passwords.”
Carna Botnet EXPLOITS weak default passwords
The Carna Botnet gained access to systems using weak default username/password combinations, including admin/admin and root/root.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“They used the following four username/password combinations: admin/admin, admin with no password, root/root, and root with no password.”
Carna Botnet USES internet-wide scanning
The Carna Botnet was used to scan the entire internet, including IP addresses and the top 100 ports.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“This new mission was to use those vulnerable devices to do a full scan of the internet; not just checking for Telnet but pinging every IP and checking the top 100 ports.”
Carna Botnet USES lateral movement
The Carna Botnet propagated by uploading itself to systems it found and using those systems to scan for additional systems.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“then upload that same program to the systems it found, and then put that system to work scanning for more systems.”
Carna Botnet ASSOCIATED_WITH botnet
The researcher’s program was described as a botnet: software running on many unauthorized computers to perform a common task.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“They were creating a botnet. A botnet is a program running on many computers that are all working together to do the same task”
Carna Botnet RELATED_TO Aidra Botnet
Aidra was found on some of the same computers as Carna and used the same vulnerabilities, creating an operational relationship between the two botnets.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“They were finding this other botnet on the same computers that the Carna Botnet was installed on. It was known as the Aidra Botnet.”
“Aidra had infected over 30,000 of the same computers as the Carna Botnet.”
Carna Botnet LEADS_TO Internet Census of 2012
After collecting billions of probes and data points with Carna, the researcher created the Internet Census of 2012 project.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“With all these billions of probes and data points collected from the Carna Botnet, it was now time for the researcher to pour through all this data”
“The researcher called this project the Internet Census of 2012.”