Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/29/2019
11:45 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Botnet Targets Android Set-Top Boxes

ARES has already infected thousands of devices and is growing, IoT security firm says.

Thousands of Android set-top boxes of the sort used by people to stream media from Hulu, Netflix, and other services have been infected with malware and become part of a growing botnet of similarly compromised devices.

Internet of Things (IoT) security vendor WootCloud, which discovered the threat, has dubbed it the ARES ADB botnet. The botnet is being used as a launchpad to trigger multiple attacks such as brute-force password cracking, denial-of-service attacks, and cryptomining.

In a report this week, WootCloud described the botnet as targeting Android Debug Bridge (ADB), a management component on Android devices that enables debugging and remote management operations.

The ADB service is often left open and unauthenticated on many Internet-connected Android devices, giving attackers a way to access them and take full administrative control. "Accessing the device through TCP port 5555 results in obtaining shell which allows remote command execution, uploading/downloading of custom applications, data access," and other activity, WootCloud warns.

The ARES botnet is the latest sign of attackers targeting vulnerable non-computer IoT devices to build botnets for a variety of malicious purposes. Following the Mirai botnet attacks of 2016, attackers have been actively targeting home routers, security cameras, DVRs, smart TVs, and other Internet-connected devices, which often have weak to no security protections. Many of these devices often provide unauthenticated remote access or are protected only with default passwords and cannot be easily patched or updated. Though many of the devices individually have little computing power, attackers are often able to infect tens of thousands of them at the same time to build botnets capable of doing considerable damage.

With the latest threat, attackers are actively exploiting the ADB configuration issue to install the ARES bot on Android-based set-top boxes from several vendors, including HiSilicon and Cubetek. Once the bot gets installed on a device, it starts scanning for other set-top boxes with similarly misconfigured ADB interfaces and then installs payloads for triggering additional attacks.

Most infections so far have been in South Asia and the broader Asia-Pacific region. The command-and-control servers with which infected devices have been communicating have been observed at multiple locations, including North America.

Potentially Major Impact
Srinivas Akella, founder and chief technology officer at WootCloud, says the ARES botnet poses a potentially major threat to the growing number of other Android-based set-top boxes that consumers and enterprises are using. "This botnet has the potential to affect smart TVs and other IoT devices that have a misconfigured ADB," he says.

With standard Android images, the ADB is not enabled by default. However, several set-top boxes that are available today are running customized versions of the Android OS, which have been rooted and have ADB enabled by default, he says.

To protect against the ADB being misused in cases where it is left enabled, routers can be configured to block the ingress and egress network traffic to TCP port 5555, which is the port that ADB uses.

Enterprises should also configure their network policies to restrict ingress and egress network traffic to IoT devices. "Restrict the ADB interface on the IoT devices to authorized IP address space," he says. "Monitor the ADB interface traffic originating from unknown resources, including the network traffic originating from these devices."

Organizations should also ensure that interfaces on IoT devices such as telnet and SNMP are properly protected with strong passwords to prevent unauthorized access, Akella says.

Home users of vulnerable set-top boxes may have a slightly harder time mitigating the risk. A lot depends on the design of the set-top box and whether the vendor provides an option to disable ADB functionality. When the option is not available, "home users will need to have technical acumen to disable the ADB functionality either by setting up their routers to block traffic," Akella says, "or by logging in to the device and disabling ADB services on the command prompt."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Fuzzing 101: Why Bug-Finders Still Love It After All These Years."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2079
PUBLISHED: 2019-11-22
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2019-11325
PUBLISHED: 2019-11-21
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
CVE-2019-18887
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
CVE-2019-18888
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. T...
CVE-2019-18889
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.