Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

10/3/2016
06:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

IoT DDoS Attack Code Released

Mirai malware could signal the beginning of new trend in using Internet of Things devices as bots for DDoS attacks.

The perpetrator of a massive distributed denial-of-service (DDoS) attack on the KrebsOnSecurity website last month has publicly released the code used in the assault in a move that security analysts fear could make it much easier for others to launch similar salvos.

Called Mirai, the malware is designed to search for and attack Internet-connected consumer devices that are protected only with default passwords and usernames, according to a KrebsOnSecurity blog post on Saturday.

A Hackforums user with the nickname "Anna-senpai" released the code apparently in response to the increased scrutiny of vulnerable IoT devices by ISPs following the recent DDoS attack on the site run by security blogger and researcher Brian Krebs.

Mirai is one of two malware families to have surfaced recently that is designed explicitly to create botnets from vulnerable IoT devices. The other is Bashlight, a malware that is thought to have infected over a million IoT devices and co-opted them into a botnet, according to KrebsOnSecurity, pointing to research from Level 3 Communications.

Mirai is designed to attack IoT systems running BusyBox, which is an executable file that combines multiple small versions of Unix utilities, MalwareTech said in an analysis of the malware. The malware was used to create a botnet comprised mostly of home routers and network-enabled cameras, digital video recorders and other IoT devices.

The botnet was used to launch a 620 Gbps DDoS attack on KrebsOnSecurity's website and another one last week that exceeded 1 Tbps in size against French Internet service provider OVH. Both were easily the largest-ever DDoS attacks in terms of bandwidth size seen so far.

According to MalwareTech, Mirai works by brute-forcing BusyBox systems with a list of over 60 passwords that are commonly used as default. Once on a system, the malware attempts to block others from trying to infect the same machine.

"Mirai appears to be simple and intuitive, which makes it easy to [administer]," says Thomas Pore, director of IT and services at security vendor Plixer International. Once Mirai infects a system, the malware is designed to clean up any trace of its presence in order to avoid detection and to maintain a persistent foothold on the bot, he says.

No Phishing Necessary

What makes Mirai particularly interesting is the use of IoT devices to create a botnet, he says. "The concept of running an IoT botnet is genius because there is no overhead of hiring a spam service to phish users in an attempt to compromise a PC to act as a bot," More says.

For attackers, it is easy and costs next to nothing to scan the Internet for vulnerable IoT devices to attack, he said. And with Mirai source code now publicly available, it is likely that others will begin to use the malware to create their own botnets.

The increased competition for the vulnerable devices, though, could actually result in the scale of Mirai-enabled DDoS attacks becoming smaller, Pore says.

"Perhaps the scale of the attack will lessen if the compromised devices are spread across multiple botnets serving service denials for different targets," he says.

Reiner Kappenberger, global product manager at HPE Security-Data Security, says the release of the Mirai code highlights the problems surfacing from the lack of adequate security practices in the IoT space.

"As shown by this latest development, this is a broad problem that can manifest itself on many IoT devices with extremely damaging results," he says.

Consumers buying IoT devices should make the effort to identify the security controls present in them, he says. A breach in the IoT device can easily move to other systems such as a home computer, thus allowing attackers to steal valuable personal information such as bank account information and credentials.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jason Lebrecht
50%
50%
Jason Lebrecht,
User Rank: Apprentice
2/10/2020 | 9:38:07 PM
Re: Not Good
Well, it's been 4 years. Are DDoS attacks still the main concern are for cyber attacks? Jason Lebrecht
Jason Lebrecht
50%
50%
Jason Lebrecht,
User Rank: Apprentice
10/4/2016 | 11:13:48 PM
Not Good
Good reminder to ensure simple protections. Thanks for the article.

 

Jason Lebrecht
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/1/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: It's the latest version of antivirus.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13759
PUBLISHED: 2020-06-02
rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obj and write_obj do not properly access memory. This affects aarch64 (with musl or glibc) and x86_64 (with musl).
CVE-2020-7662
PUBLISHED: 2020-06-02
websocket-extensions npm module prior to 1.0.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other characte...
CVE-2020-7663
PUBLISHED: 2020-06-02
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other charact...
CVE-2020-12017
PUBLISHED: 2020-06-02
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacke...
CVE-2018-18623
PUBLISHED: 2020-06-02
Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.