Perimeter
11/8/2016
09:40 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

New Free Mirai Scanner Tools Spot Infected, Vulnerable IoT Devices

Imperva and Rapid7 have built scanners to discover IoT devices vulnerable or infected with Mirai malware.

Imperva is the latest security company to offer a free scanner to detect Internet of Things devices infected with or vulnerable to Mirai malware, the malicious code behind the massive distributed denial-of-service (DDoS) attacks on DNS provider Dyn.

The Mirai botnet army of IoT devices quickly gained notoriety earlier this year following major DDoS attacks on KrebsOnSecurity in September. The perpetrator released the Mira code publicly, and the malware was later used in the assault on Dyn, which led to the shutdown of prominent websites including Okta, CNN, Twitter, and Pinterest.

Mirai searches networks for Internet-connected consumer devices. It scans IP addresses across the Web to discover unsecured devices, and then guesses their login credentials. Once infected, the devices become part of the Mirai botnet that wages DDoS attacks. The Dyn attack, for example, used about 100,000 infected devices but still shut down prominent websites for much of the United States.

Rapid7 earlier this month released a scanner called IoTSeeker, which is designed to search users' networks and find common IoT devices with default usernames and passwords.

Mirai is also predatory, as explained in a blog post published by Imperva. Mirai can remove and replace malware previously installed on a device. Routers, IP cameras, and DVRs are especially vulnerable.

To mitigate the threat, security researchers are exploring new ways to detect vulnerable network devices before attackers can target them, with Imperva and Rapid7's scanning tools as one such method.

"The Mirai botnet scanner was developed to help home users, with IoT devices on their home network, learn if they are vulnerable to Mirai malware," says Robert Hamilton, director of product marketing manager at Imperva for its Incapsula product line.

Imperva's scanner checks whether one or more network devices is infected by, or vulnerable to, Mirai malware. When users instruct the tool to scan a network, it discovers the network's public IP address and checks the gateway from outside to see if any remote access ports are vulnerable to Mirai attack.

If the Mirai scanner finds a vulnerability, users will see a message indicating the IP address is hosting an IoT device vulnerable to Mirai injection attacks. In this case, Imperva recommends logging into each IoT device on the network and strengthening the password; however, it's worth noting that this step may not necessarily prevent attacks.

Hamilton noted Imperva's tool is also useful for the enterprise. Businesses can still be exposed to DDoS attacks from the Mirai botnet, whether or not they have IoT devices at risk.

"A business could use the tool to understand if they had any IoT devices on their network that might be vulnerable," Hamilton says. "However, the biggest risk to a business is that they become a target of the botnet by way of a DDoS attack. They don't need to have any vulnerable IoT devices to have that happen."

The scanner is designed so that it cannot be abused by bad actors, he says. "It will only test the IP address of the network the user is connected to," he says. "The tool cannot be used to probe other IP addresses or other remote networks."

Dark Reading's all-day virtual event Nov. 15 offers an in-depth look at myths surrounding data defense and how to put business on a more effective security path. 

According to notes on the GitHub for Rapid7's IoTSeeker, the scanner is designed to search for specific types of IoT devices to see if they are using factory-set credentials.

"The recent Internet outage has been attributed to use [of] the IoT devices (CCTV Cameras, DVRs, and others) with default credentials," the notes state. "It's the intention of this tool to help organizations scan their networks to detect these types of IoT devices and to identify whether credentials have been changed."

IoTSeeker was built to scan thousands of IoTs at the same time, and only runs on Linux or MacOS.

Related Content:

Kelly is an associate editor for InformationWeek. She most recently reported on financial tech for Insurance & Technology, before which she was a staff writer for InformationWeek and InformationWeek Education. When she's not catching up on the latest in tech, Kelly enjoys ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.