Internet of Things botnets: You ain’t seen nothing yet

SSSh*t just got real

Internet of Things (IoT) botnet "Mirai" is the shape of things to come and future assaults could be even more severe, a leading security research firm warns.

Mirai powered the largest ever DDoS attack ever, spawning a 620Gbps DDoS against KrebsOnSecurity. Source code for the malware was released on hacker forums last week.

The malware relied on factory default or hard-coded usernames and passwords to compromise vulnerable IoT devices such as insecure routers, IP cameras, digital video recorders and the like.

PenTestPartners, the UK security consultancy behind numerous hack on Iot devices ranging from Wi-Fi enabled kettles to cars, said that the botnet finally illustrates the consequences of IoT vendors cutting the corners on security.

“We’ve said many times previously that IoT would make for the perfect botnet: Easy to compromise, hard to patch and the owner likely won’t ever have a clue that they’re part of the botnet,” PenTestPartners notes.

PenTestPartners warns that tweaks in the techniques used by black hats could be used to develop an even more potent threat. “This piece could be misconstrued as educating the DDoSser,” the firm explains in a disclaimer. “It isn’t – they will already have worked this improved attack out for themselves. This article is about ensuring that everyone knows what to expect in future and to help mitigate the effects.”

Future IoT bots could use the web rather than Telnet (as used by Mirai), making it far harder for ISPs to block attack traffic. Using the web also offers increased stealth.

PenTestPartners - which doesn’t sell DDoS mitigation services itself - is making its warning in order to encourage more diligence in applying available firmware updates to IP CCTV cameras and other IoT devices as advocating greater use of network segmentation as a defensive strategy.

Independent infosec consultant Brian Honan, the founder and head of Ireland’s CERT, welcomed PenTestParners’ take on the implications of IoT insecurity for wider internet hygiene.

“For much of IoT security the focus of attention and research is on better securing the devices themselves and on protecting the privacy of the device owners,” Honan said. “However, we overlook that insecure devices can have bigger implications, as these devices can be, and indeed have been, used to undermine the security of other systems. The recent DDoS attack, one of the biggest yet seen, on Brian Kreb's website is a shining example of how insecure devices can be leveraged to attack others.”

Ryan Lester, director of IoT strategy at Xively by LogMeIn, commented: "Many companies use security shortcuts such as embedded private keys or weak authentication to speed up the development phase of IoT but this approach is quite risky. A rigorous assessment of the security implications may increase the cost of development, but it will save time and the cost of flaws discovered down the road."®

Broader topics

Other stories you might like

  • EnemyBot malware adds enterprise flaws to exploit arsenal
    Fast-evolving botnet targets critical VMware, F5 BIG-IP bugs, we're told

    The botnet malware EnemyBot has added exploits to its arsenal, allowing it to infect and spread from enterprise-grade gear.

    What's worse, EnemyBot's core source code, minus its exploits, can be found on GitHub, so any miscreant can use the malware to start crafting their own outbreaks of this software nasty.

    The group behind EnemyBot is Keksec, a collection of experienced developers, also known as Nero and Freakout, that have been around since 2016 and have launched a number of Linux- and Windows-based bots capable of launching distributed denial-of-service (DDoS) attacks and possibly mining cryptocurrency. Securonix first wrote about EnemyBot in March.

    Continue reading
  • International operation takes down Russian RSOCKS botnet
    $200 a day buys you 90,000 victims

    A Russian operated botnet known as RSOCKS has been shut down by the US Department of Justice acting with law enforcement partners in Germany, the Netherlands and the UK. It is believed to have compromised millions of computers and other devices around the globe.

    The RSOCKS botnet functioned as an IP proxy service, but instead of offering legitimate IP addresses leased from internet service providers, it was providing criminals with access to the IP addresses of devices that had been compromised by malware, according to a statement from the US Attorney’s Office in the Southern District of California.

    It seems that RSOCKS initially targeted a variety of Internet of Things (IoT) devices, such as industrial control systems, routers, audio/video streaming devices and various internet connected appliances, before expanding into other endpoints such as Android devices and computer systems.

    Continue reading
  • Emotet malware gang re-emerges with Chrome-based credit card heistware
    Crimeware groups are re-inventing themselves

    The criminals behind the Emotet botnet – which rose to fame as a banking trojan before evolving into spamming and malware delivery – are now using it to target credit card information stored in the Chrome web browser.

    Once the data – including the user's name, the card's numbers and expiration information – is exfiltrated, the malware will send it to command-and-control (C2) servers that are different than the one that the card stealer module uses, according to researchers with cybersecurity vendor Proofpoint's Threat Insight team.

    The new card information module is the latest illustration of Emotet's Lazarus-like return. It's been more than a year since Europol and law enforcement from countries including the United States, the UK and Ukraine tore down the Emotet actors' infrastructure in January 2021 and – they hoped – put the malware threat to rest.

    Continue reading

Biting the hand that feeds IT © 1998–2022