This article is more than 1 year old
A successor to Mirai? Newly discovered malware aims to create fresh IoT botnet
Dubbed Linux/IRCTelnet, nasty's source code based on Aidra
Miscreants have put together a new strain of malware designed to turn insecure IoT devices into a DDoS attack platform.
The new nasty, Linux/IRCTelnet discovered by security researchers at MalwareMustDie.org, like the infamous Mirai botnet before it relies on default hard-coded credentials to spread across vulnerable devices. The malware is primed for DDoS and IPv6 ready, according to a write-up on MalwareMustDie.org.
"The malware (the bot client) is designed to aim IoT device via telnet protocol, by using its originally coded telnet scanner function, which is brute-forcing the known vulnerable credential of the Linux IoT boxes, via command sent from a CNC malicious IRC server,” the researchers note.
"The botnet is having DoS attack mechanism like UDP flood, TCP flood, along with other attack methods, in both IPv4 and IPv6 protocol, with extra IP spoof option in IPv4 or IPv6 too."
The source code used to build this botnet malware is based on the earlier Aidra botnet, according to MalwareMustDie.org. Hard-coded Italian language messages in the user's communication interface suggest that the author of the retro-fitted malware is an Italian speaker.
Whether Linux/IRCTelnet is effective at spreading much less attacking systems is so far unclear. Even so it's mere arrival is a concern because it points to further trouble ahead.
Security experts are unsurprised that hackers are seeking to emulate the "success" of the Mirai botnet, the malware linked to the attack on DNS provider Dyn that shut down numerous websites on 21 October.
Mike Ahmadi, global director of critical systems security at Synopsys, commented: "It is not at all surprising that a new exploit targeting these devices has been discovered, since many of these devices are built using open source third-party libraries. When we apply software composition analysis tools to many of the most popular third-party software distributions, we often find known vulnerabilities that number in the hundreds, and sometimes in the thousands when looking at the total software build found on IoT devices.
"Unless builders of IoT devices incorporate more rigorous vulnerability detection and management practices into their development process, we can expect more of this malware botnet free for all to occur." ®