Be Afraid of the Chuck Norris Botnet

Posted on 22 February 2010 by jjkomplett in News, Security

As most of you will already know, human cloning is outlawed because if Chuck Norris were cloned, then it would be possible for a Chuck Norris roundhouse kick to meet another Chuck Norris roundhouse kick and in turn, physicists theorise that this contact would end the universe. While that thankfully hasn’t happed as yet, the Chuck Norris botnet may well cause a good deal of panic worldwide this week as it karate chops its way into routers.

There is no theory of evolution. Just a list of animals Chuck Norris allows to live.

ComputerWorld reports this morning that the botnet – discovered by Czech researchers – has been spreading by taking advantage of poorly configured routers and DSL modems. Jan Vykopal, the head of the network security department with Masaryk University’s Institute of Computer Science in Brno, Czech Republic said that the Chuck Norris malware – with got its name due to a programmer’s Italian comment in its source code: “in nome di Chuck Norris” which means “in the name of Chuck Norris – is unusual in that it infects DSL modems and routers rather than PCs.


It installs itself on routers and modems by guessing default administrative passwords and taking advantage of the fact that many devices are configured to allow remote access. It also exploits a known vulnerability in D-Link Systems devices, Vykopal said in an e-mail interview. A D-Link spokesman said he was not aware of the botnet, and the company did not immediately have any comment on the issue.

Adds the report, “Right now Chuck Norris-infected machines can be used to attack other systems on the Internet, in what are known as distributed denial of service attacks. The botnet can launch a password-guessing dictionary attack on another computer, and it can also change the DNS (Domain Name System) settings in the router. With this attack, victims on the router’s network who think they are connecting to Facebook or Google end up redirected to a malicious Web page that then tries to install a virus on their computers.

“Once installed in the router’s memory, the bot blocks remote communication ports and begins to scan the network for other vulnerable machines. It is controlled via IRC.”

Don’t be too scared though as, because the Chuck Norris botnet lives in the router’s RAM, it can be removed with a restart. Users who don’t want to be infected can mitigate the risk and the simplest way of doing this is by using a strong password on the router or modem. Users can also address the problem by keeping their firmware up-to-date and by disabling remote-access services.

Comments are closed.