Vulnerabilities / Threats
3/25/2009
04:33 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

DSL Modems Becoming Botnet Zombies

Cybercriminals are using the PSYB0T botnet to take advantage of vulnerabilities in the NetComm NB5 modem-router.

Botnets -- groups of computers that have been compromised, hijacked, and coordinated for malicious purposes -- remain a significant source of online security problems. Now some of the zombie machines that constitute botnets have taken on a new form.

For the past few months, security researchers have watched a botnet being built out of embedded devices, specifically DSL modem-routers.

In a paper published in January, security researcher Terry Baume observed that vulnerabilities in the NetComm NB5, an ADSL/ADSL2+ modem-router, have become widely known and that cybercriminals have been taking advantage of these flaws to compromise the devices and, possibly, other modem-routers. He calls the botnet PSYB0T.

"This is the first botnet I've heard of that infects embedded devices," his paper says, noting that a compromised router can be used to alter DNS routing and redirect network traffic to phishing sites.

Baume says that end users aren't likely to be aware that their modem-routers have been compromised and that they could easily become confused if notified by their Internet service provider about possible malware on their computers, which might appear clean to antivirus software.

He also observes that most users leave their DSL modems on all the time. Compromised devices thus would remain active all the time, unlike compromised computers, which tend to get turned off periodically.

DroneBL, a site that monitors IP addresses for abuse, was hit by a distributed denial-of-service (DDoS) attack from a PSYB0T botnet for several weeks.

A blog post on the site explains that in order to be vulnerable, the device in question must be a Linux mipsel device; must have telnet, SSH, or a Web-based interface available over a WAN; and must have weak user name/password combinations or must have firmware that relies on daemons that are exploitable.

"The malware can spread itself through telnet admin interfaces of the DSL modems," a post on the Team Furry blog explains. "It also has the capability to scan for PHPMyAdmin installations and Windows SMB shares."

Devices not running MIPS, such the x86-based computers run by most consumers, are not themselves at risk, but could be affected if connected to vulnerable DSL modems.

Owners of potentially vulnerable DSL modem-routers are advised to make sure the devices have updated firmware and to verify that they're using a user name and password for the device that can't be easily guessed by a dictionary attack.


Find out how to balance technology, business intelligence, and process to reduce exposure to vulnerabilities (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0196
Published: 2015-06-29
CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 before 7.0.0.8 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

CVE-2015-0545
Published: 2015-06-29
EMC Unisphere for VMAX 8.x before 8.0.3.4 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.

CVE-2015-1900
Published: 2015-06-29
IBM InfoSphere DataStage 8.1, 8.5, 8.7, 9.1, and 11.3 through 11.3.1.2 on UNIX allows local users to write to executable files, and consequently obtain root privileges, via unspecified vectors.

CVE-2014-4768
Published: 2015-06-28
IBM Unified Extensible Firmware Interface (UEFI) on Flex System x880 X6, System x3850 X6, and System x3950 X6 devices allows remote authenticated users to cause an unspecified temporary denial of service by using privileged access to enable a legacy boot mode.

CVE-2014-6198
Published: 2015-06-28
Cross-site request forgery (CSRF) vulnerability in IBM Security Network Protection 5.3 before 5.3.1 allows remote attackers to hijack the authentication of arbitrary users.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report