A mysterious Internet of Things bot first identified in October is now believed to be the work of a vigilante hacker who is attempting to block infections from nefarious bots such as the notorious Mirai.

According to Waylon Grange at Symantec Corp., the Hajime bot, which was first believed to be an undeveloped bot that might be later used for distributed denial of services attacks, instead blocks access to ports exploited by other forms of IoT malware.

The strangeness of Hajime doesn’t stop there. The bot seemingly was created to avoid takedowns by using peer-to-peer networking to push command modules versus a typical centralized command-and-control server address. Hijame contacts its P2P C&C every 10 minutes for an update, and if an update is sent, the signature includes the following message:

Just a white hat, securing some systems.
Important messages will be signed like this!
Hajime Author.
Contact CLOSED
Stay sharp!

Along with a number of other methods employed to avoid detection, the only major update to the bot since it was launched was to make adjustments to its code after a Rapidity Networks report on it noted flaws in the code. To put that more simply, despite having ample opportunity to weaponize the bot, the creator has, over the period of six months, only improved the code based on a third-party report versus changing it to do something bad.

Grange isn’t able to put a hard figure on how many IoT devices Hijame has infected but he notes that it has spread rapidly and infection rates would be at least in the tens of thousands. Interestingly, Hijame is also not the first case of a vigilante attempting to secure vulnerable IoT devices with malware called Linux.Wifatch in 2014 said to have attempted to secure devices in a similar way, though less successfully than Hijame.

Hijame presents an interesting quandary. On one hand, it would be far preferable if outside code never infected IoT devices, not only because the act itself is illegal but because no one likes to see devices infected with anything. On the other hand, the white-hat hacker behind the bot is seemingly doing IoT device holders a massive favor by securing devices against malicious bot attack.

Perhaps the answer to the quandary is that lazy manufacturers with their appallingly vulnerable IoT devices should simply follow Hijame’s lead and block the ports used by Mirai and the like from the very beginning.

Photo: US Airforce/Public Domain