Endpoint

8/30/2016
04:45 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Another IoT-Dominated Botnet Rises With Almost 1M Infected Devices

BASHLITE malware fuels another DDoS botnet made up primarily of flaw-ridden internet of things devices

Researchers shed light this week on a new million-endpoint botnet consisting almost exclusively of internet of things (IoT) devices. The discovery uncovers one more sign -- among several in the last few months --  showing that the threat of IoT botnets is quickly moving from proof-of-concept to common strategy.

This week's find was made by the team at Level 3 Threat Research Labs, which put out a report on the BASHLITE malware family responsible for this particular botnet. Also known as Lizkebab, Torlus or gafgyt, the malware family has focused primarily on building out botnets for carrying out distributed denial of service (DDoS) attacks. 

According to the research, the source code for the malware was initially spotted in 2015 and has now spun off into more than a dozen variants. At its root, it is designed to  be easily cross-compiled for multiple architectures running Linux, making it ideal for building out attacks that leverage the fragmented field of embedded systems in the IoT environment. As things stand, the botnet tracked by Level 3 is nearing one million infected devices, 96% of which are IoT-related.

"The use of IoT devices in botnets is not new, but as they become more common, we expect these types of botnets to increase in number and power," Level 3 researchers wrote in their report. "While compromised hosts and home routers continue to be targeted, bot herders will follow the path of least resistance. Before spending more energy on traditional bot hosts, they’ll take advantage of the abundance of insecure IoT devices." 

According to a survey out from Tripwire last week conducted among 220 attendees of Black Hat USA 2016, less than one-third of security practitioners feel their organizations are prepared for the security risks associated with IoT. Approximately 78% of respondents said they're concerned about the weaponization of IoT devices in the use of DDoS attacks.

"It wasn't so long ago that home computer ‘zombie armies’ were the weapon of choice for a lot of cyber attacks and denial of service attacks," says Dwayne Melancon, chief technology officer and vice president of research and development for Tripwire. “It seems that security professionals see IoT devices as a sort of ‘zombie appliance army’ that’s worthy of great concern. That makes sense, since many of the current crop of IoT devices were created with low cost as a priority over security, making them easy targets." 

Earlier this summer researchers with Arbor Networks brought attention to the rise of an IoT-dominated DDoS botnet called LizardStresser that's been making waves with its capability of carrying out large-scale DDoS attacks. Some of these attacks have been as large as 400 Gbps without the use of reflection or amplification techniques, with targets that include gaming sites, financial institutions, ISPs and government institutions. Meanwhile, another piece of research from Sucuri showed how attackers are taking advantage of weaknesses in closed circuit TV (CCTV) devices to run DDoS botnets completely consisting of these rarely monitored devices.

Related Content:

 

 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
More Than Half of Users Reuse Passwords
Curtis Franklin Jr., Senior Editor at Dark Reading,  5/24/2018
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11471
PUBLISHED: 2018-05-25
Cockpit 0.5.5 has XSS via a collection, form, or region.
CVE-2018-11472
PUBLISHED: 2018-05-25
Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php).
CVE-2018-11473
PUBLISHED: 2018-05-25
Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
CVE-2018-11474
PUBLISHED: 2018-05-25
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&user_id=1 does not invalidate a session that is open in a different browser.
CVE-2018-11475
PUBLISHED: 2018-05-25
Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser.