Endpoint

8/30/2016
04:45 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Another IoT-Dominated Botnet Rises With Almost 1M Infected Devices

BASHLITE malware fuels another DDoS botnet made up primarily of flaw-ridden internet of things devices

Researchers shed light this week on a new million-endpoint botnet consisting almost exclusively of internet of things (IoT) devices. The discovery uncovers one more sign -- among several in the last few months --  showing that the threat of IoT botnets is quickly moving from proof-of-concept to common strategy.

This week's find was made by the team at Level 3 Threat Research Labs, which put out a report on the BASHLITE malware family responsible for this particular botnet. Also known as Lizkebab, Torlus or gafgyt, the malware family has focused primarily on building out botnets for carrying out distributed denial of service (DDoS) attacks. 

According to the research, the source code for the malware was initially spotted in 2015 and has now spun off into more than a dozen variants. At its root, it is designed to  be easily cross-compiled for multiple architectures running Linux, making it ideal for building out attacks that leverage the fragmented field of embedded systems in the IoT environment. As things stand, the botnet tracked by Level 3 is nearing one million infected devices, 96% of which are IoT-related.

"The use of IoT devices in botnets is not new, but as they become more common, we expect these types of botnets to increase in number and power," Level 3 researchers wrote in their report. "While compromised hosts and home routers continue to be targeted, bot herders will follow the path of least resistance. Before spending more energy on traditional bot hosts, they’ll take advantage of the abundance of insecure IoT devices." 

According to a survey out from Tripwire last week conducted among 220 attendees of Black Hat USA 2016, less than one-third of security practitioners feel their organizations are prepared for the security risks associated with IoT. Approximately 78% of respondents said they're concerned about the weaponization of IoT devices in the use of DDoS attacks.

"It wasn't so long ago that home computer ‘zombie armies’ were the weapon of choice for a lot of cyber attacks and denial of service attacks," says Dwayne Melancon, chief technology officer and vice president of research and development for Tripwire. “It seems that security professionals see IoT devices as a sort of ‘zombie appliance army’ that’s worthy of great concern. That makes sense, since many of the current crop of IoT devices were created with low cost as a priority over security, making them easy targets." 

Earlier this summer researchers with Arbor Networks brought attention to the rise of an IoT-dominated DDoS botnet called LizardStresser that's been making waves with its capability of carrying out large-scale DDoS attacks. Some of these attacks have been as large as 400 Gbps without the use of reflection or amplification techniques, with targets that include gaming sites, financial institutions, ISPs and government institutions. Meanwhile, another piece of research from Sucuri showed how attackers are taking advantage of weaknesses in closed circuit TV (CCTV) devices to run DDoS botnets completely consisting of these rarely monitored devices.

Related Content:

 

 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.