Endpoint

8/30/2016
04:45 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Another IoT-Dominated Botnet Rises With Almost 1M Infected Devices

BASHLITE malware fuels another DDoS botnet made up primarily of flaw-ridden internet of things devices

Researchers shed light this week on a new million-endpoint botnet consisting almost exclusively of internet of things (IoT) devices. The discovery uncovers one more sign -- among several in the last few months --  showing that the threat of IoT botnets is quickly moving from proof-of-concept to common strategy.

This week's find was made by the team at Level 3 Threat Research Labs, which put out a report on the BASHLITE malware family responsible for this particular botnet. Also known as Lizkebab, Torlus or gafgyt, the malware family has focused primarily on building out botnets for carrying out distributed denial of service (DDoS) attacks. 

According to the research, the source code for the malware was initially spotted in 2015 and has now spun off into more than a dozen variants. At its root, it is designed to  be easily cross-compiled for multiple architectures running Linux, making it ideal for building out attacks that leverage the fragmented field of embedded systems in the IoT environment. As things stand, the botnet tracked by Level 3 is nearing one million infected devices, 96% of which are IoT-related.

"The use of IoT devices in botnets is not new, but as they become more common, we expect these types of botnets to increase in number and power," Level 3 researchers wrote in their report. "While compromised hosts and home routers continue to be targeted, bot herders will follow the path of least resistance. Before spending more energy on traditional bot hosts, they’ll take advantage of the abundance of insecure IoT devices." 

According to a survey out from Tripwire last week conducted among 220 attendees of Black Hat USA 2016, less than one-third of security practitioners feel their organizations are prepared for the security risks associated with IoT. Approximately 78% of respondents said they're concerned about the weaponization of IoT devices in the use of DDoS attacks.

"It wasn't so long ago that home computer ‘zombie armies’ were the weapon of choice for a lot of cyber attacks and denial of service attacks," says Dwayne Melancon, chief technology officer and vice president of research and development for Tripwire. “It seems that security professionals see IoT devices as a sort of ‘zombie appliance army’ that’s worthy of great concern. That makes sense, since many of the current crop of IoT devices were created with low cost as a priority over security, making them easy targets." 

Earlier this summer researchers with Arbor Networks brought attention to the rise of an IoT-dominated DDoS botnet called LizardStresser that's been making waves with its capability of carrying out large-scale DDoS attacks. Some of these attacks have been as large as 400 Gbps without the use of reflection or amplification techniques, with targets that include gaming sites, financial institutions, ISPs and government institutions. Meanwhile, another piece of research from Sucuri showed how attackers are taking advantage of weaknesses in closed circuit TV (CCTV) devices to run DDoS botnets completely consisting of these rarely monitored devices.

Related Content:

 

 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Jan, check this out! I found an unhackable PC.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.