Episode
15 February 2018 Official episode · Official transcript
botnet research
The episode describes the creation of the Carna Botnet to scan the internet, the resulting Internet Census of 2012, the prevalence of Telnet devices using default credentials, and subsequent efforts to notify CERTs and manufacturers.
Topics: Default credentials and weak password security, Telnet exposure and cleartext authentication, SSH as an encrypted remote-login alternative, Internet-wide IP and port scanning, Botnet propagation and unauthorized resource use, Scanning and mapping internet-connected devices, GeoIP-based visualization, CERT coordination and vulnerability disclosure, MAC-address manufacturer identification, Security implications of embedded and industrial control systems, Large-scale data storage and compression
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Carna Botnet USES Telnet
The Carna Botnet scanned internet-connected systems running Telnet and used Telnet access during its propagation.
Explicit Confidence 98% · Jack Rhysider EP 13 Details
“The researcher created a program that would scan and find unprotected systems and then upload that same program to the systems it found”
“The first mission was just to see how many devices were running Telnet with default passwords.”
Carna Botnet EXPLOITS weak default passwords
The Carna Botnet gained access to systems using weak default username/password combinations, including admin/admin and root/root.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“They used the following four username/password combinations: admin/admin, admin with no password, root/root, and root with no password.”
Carna Botnet USES internet-wide scanning
The Carna Botnet was used to scan the entire internet, including IP addresses and the top 100 ports.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“This new mission was to use those vulnerable devices to do a full scan of the internet; not just checking for Telnet but pinging every IP and checking the top 100 ports.”
Carna Botnet USES lateral movement
The Carna Botnet propagated by uploading itself to systems it found and using those systems to scan for additional systems.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“then upload that same program to the systems it found, and then put that system to work scanning for more systems.”
Carna Botnet ASSOCIATED_WITH botnet
The researcher’s program was described as a botnet: software running on many unauthorized computers to perform a common task.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“They were creating a botnet. A botnet is a program running on many computers that are all working together to do the same task”
Carna Botnet RELATED_TO Aidra Botnet
Aidra was found on some of the same computers as Carna and used the same vulnerabilities, creating an operational relationship between the two botnets.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“They were finding this other botnet on the same computers that the Carna Botnet was installed on. It was known as the Aidra Botnet.”
“Aidra had infected over 30,000 of the same computers as the Carna Botnet.”
Aidra Botnet EXPLOITS weak default passwords
Aidra used the same weak default-password vulnerability as the Carna Botnet.
Explicit Confidence 97% · Jack Rhysider EP 13 Details
“someone else was also building a botnet and using the exact same vulnerabilities”
Aidra Botnet USES denial-of-service attack
Aidra was used to take down computers and was characterized as having malicious intent.
Explicit Confidence 90% · Jack Rhysider EP 13 Details
“It was being used to take down computers and did bad things.”
Lightaidra EXPLOITS weak default passwords
Parth said Lightaidra exploited the exact same vulnerability as the earlier botnets.
Explicit Confidence 99% · Parth Shukla EP 13 Details
“The tool called Lightaidra exploited the exact same vulnerability.”
Carna Botnet LEADS_TO Internet Census of 2012
After collecting billions of probes and data points with Carna, the researcher created the Internet Census of 2012 project.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“With all these billions of probes and data points collected from the Carna Botnet, it was now time for the researcher to pour through all this data”
“The researcher called this project the Internet Census of 2012.”
Internet Census of 2012 USES GeoIP lookup
The Internet Census data was enriched with geographic locations using GeoIP lookups on IP addresses.
Explicit Confidence 99% · Jack Rhysider EP 13 Details
“GeoIP lookups were done on every IP address to determine where that computer was in the world.”
Parth Shukla MEMBER_OF Google
Parth identified himself as currently working as a security engineer at Google in Switzerland.
Explicit Confidence 99% · Parth Shukla EP 13 Details
“I’m currently a security engineer at Google here in Switzerland.”
Parth Shukla MEMBER_OF AusCERT
Parth said he previously worked for AusCERT.
Explicit Confidence 99% · Parth Shukla EP 13 Details
“Previously before Google I used to work for AusCERT, the Australian Computer Emergency Response Team”
Internet Census of 2012 ASSOCIATED_WITH AusCERT
Parth worked on analyzing the Internet Census data while employed by AusCERT, although the project was not directly related to Australia.
Explicit Confidence 98% · Parth Shukla EP 13 Details
“I worked for AusCERT for about a year and a half and out of that, for a whole year, I was working on just this.”
Internet Census of 2012 MENTIONS MAC address
The Internet Census data included MAC addresses for the identified devices.
Explicit Confidence 99% · Parth Shukla EP 13 Details
“it just basically contained MAC addresses, manufacturers, RAM, hostname, CPU info, IPs, country codes of all the devices.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T03:40:11.876539+00:00