Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

10/3/2016
06:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

IoT DDoS Attack Code Released

Mirai malware could signal the beginning of new trend in using Internet of Things devices as bots for DDoS attacks.

The perpetrator of a massive distributed denial-of-service (DDoS) attack on the KrebsOnSecurity website last month has publicly released the code used in the assault in a move that security analysts fear could make it much easier for others to launch similar salvos.

Called Mirai, the malware is designed to search for and attack Internet-connected consumer devices that are protected only with default passwords and usernames, according to a KrebsOnSecurity blog post on Saturday.

A Hackforums user with the nickname "Anna-senpai" released the code apparently in response to the increased scrutiny of vulnerable IoT devices by ISPs following the recent DDoS attack on the site run by security blogger and researcher Brian Krebs.

Mirai is one of two malware families to have surfaced recently that is designed explicitly to create botnets from vulnerable IoT devices. The other is Bashlight, a malware that is thought to have infected over a million IoT devices and co-opted them into a botnet, according to KrebsOnSecurity, pointing to research from Level 3 Communications.

Mirai is designed to attack IoT systems running BusyBox, which is an executable file that combines multiple small versions of Unix utilities, MalwareTech said in an analysis of the malware. The malware was used to create a botnet comprised mostly of home routers and network-enabled cameras, digital video recorders and other IoT devices.

The botnet was used to launch a 620 Gbps DDoS attack on KrebsOnSecurity's website and another one last week that exceeded 1 Tbps in size against French Internet service provider OVH. Both were easily the largest-ever DDoS attacks in terms of bandwidth size seen so far.

According to MalwareTech, Mirai works by brute-forcing BusyBox systems with a list of over 60 passwords that are commonly used as default. Once on a system, the malware attempts to block others from trying to infect the same machine.

"Mirai appears to be simple and intuitive, which makes it easy to [administer]," says Thomas Pore, director of IT and services at security vendor Plixer International. Once Mirai infects a system, the malware is designed to clean up any trace of its presence in order to avoid detection and to maintain a persistent foothold on the bot, he says.

No Phishing Necessary

What makes Mirai particularly interesting is the use of IoT devices to create a botnet, he says. "The concept of running an IoT botnet is genius because there is no overhead of hiring a spam service to phish users in an attempt to compromise a PC to act as a bot," More says.

For attackers, it is easy and costs next to nothing to scan the Internet for vulnerable IoT devices to attack, he said. And with Mirai source code now publicly available, it is likely that others will begin to use the malware to create their own botnets.

The increased competition for the vulnerable devices, though, could actually result in the scale of Mirai-enabled DDoS attacks becoming smaller, Pore says.

"Perhaps the scale of the attack will lessen if the compromised devices are spread across multiple botnets serving service denials for different targets," he says.

Reiner Kappenberger, global product manager at HPE Security-Data Security, says the release of the Mirai code highlights the problems surfacing from the lack of adequate security practices in the IoT space.

"As shown by this latest development, this is a broad problem that can manifest itself on many IoT devices with extremely damaging results," he says.

Consumers buying IoT devices should make the effort to identify the security controls present in them, he says. A breach in the IoT device can easily move to other systems such as a home computer, thus allowing attackers to steal valuable personal information such as bank account information and credentials.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jason Lebrecht
50%
50%
Jason Lebrecht,
User Rank: Apprentice
10/4/2016 | 11:13:48 PM
Not Good
Good reminder to ensure simple protections. Thanks for the article.

 

Jason Lebrecht
Where Are the 'Great Exits' in the Data Security Market?
Dave Cole, Cofounder and CEO, Open Raven,  10/13/2020
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7747
PUBLISHED: 2020-10-20
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
CVE-2020-7748
PUBLISHED: 2020-10-20
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
CVE-2020-7749
PUBLISHED: 2020-10-20
This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page wh...
CVE-2020-5640
PUBLISHED: 2020-10-20
Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or obtain sensitive information via unspecified vectors.
CVE-2020-15256
PUBLISHED: 2020-10-19
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and settin...