Vulnerabilities / Threats
3/25/2009
04:33 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

DSL Modems Becoming Botnet Zombies

Cybercriminals are using the PSYB0T botnet to take advantage of vulnerabilities in the NetComm NB5 modem-router.

Botnets -- groups of computers that have been compromised, hijacked, and coordinated for malicious purposes -- remain a significant source of online security problems. Now some of the zombie machines that constitute botnets have taken on a new form.

For the past few months, security researchers have watched a botnet being built out of embedded devices, specifically DSL modem-routers.

In a paper published in January, security researcher Terry Baume observed that vulnerabilities in the NetComm NB5, an ADSL/ADSL2+ modem-router, have become widely known and that cybercriminals have been taking advantage of these flaws to compromise the devices and, possibly, other modem-routers. He calls the botnet PSYB0T.

"This is the first botnet I've heard of that infects embedded devices," his paper says, noting that a compromised router can be used to alter DNS routing and redirect network traffic to phishing sites.

Baume says that end users aren't likely to be aware that their modem-routers have been compromised and that they could easily become confused if notified by their Internet service provider about possible malware on their computers, which might appear clean to antivirus software.

He also observes that most users leave their DSL modems on all the time. Compromised devices thus would remain active all the time, unlike compromised computers, which tend to get turned off periodically.

DroneBL, a site that monitors IP addresses for abuse, was hit by a distributed denial-of-service (DDoS) attack from a PSYB0T botnet for several weeks.

A blog post on the site explains that in order to be vulnerable, the device in question must be a Linux mipsel device; must have telnet, SSH, or a Web-based interface available over a WAN; and must have weak user name/password combinations or must have firmware that relies on daemons that are exploitable.

"The malware can spread itself through telnet admin interfaces of the DSL modems," a post on the Team Furry blog explains. "It also has the capability to scan for PHPMyAdmin installations and Windows SMB shares."

Devices not running MIPS, such the x86-based computers run by most consumers, are not themselves at risk, but could be affected if connected to vulnerable DSL modems.

Owners of potentially vulnerable DSL modem-routers are advised to make sure the devices have updated firmware and to verify that they're using a user name and password for the device that can't be easily guessed by a dictionary attack.


Find out how to balance technology, business intelligence, and process to reduce exposure to vulnerabilities (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: nice one good
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas in a thought-provoking discussion about the evolving role of the CISO.