The Carna botnet is quite some story: by accident, a self-confessed researcher discovers hundreds of thousands of open and unprotected devices - residential broadband routers - and proceeds to use them to survey the entire Internet.
For the technically minded, he did this by planting a small 250kbyte program on the open devices and remotely controlled it to scan as many addresses as possible and collected the responses (if any). The reason that was possible is because your broadband router is in fact a low-power computer, often running the Linux operating system. These devices usually come with a simple username and password combination that gives full access to the router. Enter it remotely and you control that box which has now become a bot in IT security jargon.
Here's the thing though: the researcher found 420,000 open devices to use for his distributed scanning botnet. In other words, open devices are incredibly common. Luckily for those whose devices were used for the Internet survey, the researcher didn't have any malicious intent per se. What he did was most likely illegal in many countries, but it's also really hard to detect.
Not many people log onto their routers to check what's going on because why would you? You configure them once or twice and that's really it. They just sit there, perhaps open, perhaps secured. It's not users' fault that the routers are wide-open because they were designed that way by manufacturers who should have known better. This is a huge scandal that consumer protection agencies should look into, in fact.
Techie people have known about open routers for ages. A source who used to work in the Internet field here told me that it was common at a provider - that shall remain unnamed - for people to use the same technique when they had hit the data caps on their own accounts. In other words, they were using bandwidth other people were paying for, unnoticed.
