Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

10/3/2016
06:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

IoT DDoS Attack Code Released

Mirai malware could signal the beginning of new trend in using Internet of Things devices as bots for DDoS attacks.

The perpetrator of a massive distributed denial-of-service (DDoS) attack on the KrebsOnSecurity website last month has publicly released the code used in the assault in a move that security analysts fear could make it much easier for others to launch similar salvos.

Called Mirai, the malware is designed to search for and attack Internet-connected consumer devices that are protected only with default passwords and usernames, according to a KrebsOnSecurity blog post on Saturday.

A Hackforums user with the nickname "Anna-senpai" released the code apparently in response to the increased scrutiny of vulnerable IoT devices by ISPs following the recent DDoS attack on the site run by security blogger and researcher Brian Krebs.

Mirai is one of two malware families to have surfaced recently that is designed explicitly to create botnets from vulnerable IoT devices. The other is Bashlight, a malware that is thought to have infected over a million IoT devices and co-opted them into a botnet, according to KrebsOnSecurity, pointing to research from Level 3 Communications.

Mirai is designed to attack IoT systems running BusyBox, which is an executable file that combines multiple small versions of Unix utilities, MalwareTech said in an analysis of the malware. The malware was used to create a botnet comprised mostly of home routers and network-enabled cameras, digital video recorders and other IoT devices.

The botnet was used to launch a 620 Gbps DDoS attack on KrebsOnSecurity's website and another one last week that exceeded 1 Tbps in size against French Internet service provider OVH. Both were easily the largest-ever DDoS attacks in terms of bandwidth size seen so far.

According to MalwareTech, Mirai works by brute-forcing BusyBox systems with a list of over 60 passwords that are commonly used as default. Once on a system, the malware attempts to block others from trying to infect the same machine.

"Mirai appears to be simple and intuitive, which makes it easy to [administer]," says Thomas Pore, director of IT and services at security vendor Plixer International. Once Mirai infects a system, the malware is designed to clean up any trace of its presence in order to avoid detection and to maintain a persistent foothold on the bot, he says.

No Phishing Necessary

What makes Mirai particularly interesting is the use of IoT devices to create a botnet, he says. "The concept of running an IoT botnet is genius because there is no overhead of hiring a spam service to phish users in an attempt to compromise a PC to act as a bot," More says.

For attackers, it is easy and costs next to nothing to scan the Internet for vulnerable IoT devices to attack, he said. And with Mirai source code now publicly available, it is likely that others will begin to use the malware to create their own botnets.

The increased competition for the vulnerable devices, though, could actually result in the scale of Mirai-enabled DDoS attacks becoming smaller, Pore says.

"Perhaps the scale of the attack will lessen if the compromised devices are spread across multiple botnets serving service denials for different targets," he says.

Reiner Kappenberger, global product manager at HPE Security-Data Security, says the release of the Mirai code highlights the problems surfacing from the lack of adequate security practices in the IoT space.

"As shown by this latest development, this is a broad problem that can manifest itself on many IoT devices with extremely damaging results," he says.

Consumers buying IoT devices should make the effort to identify the security controls present in them, he says. A breach in the IoT device can easily move to other systems such as a home computer, thus allowing attackers to steal valuable personal information such as bank account information and credentials.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jason Lebrecht
50%
50%
Jason Lebrecht,
User Rank: Apprentice
10/4/2016 | 11:13:48 PM
Not Good
Good reminder to ensure simple protections. Thanks for the article.

 

Jason Lebrecht
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.