Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/29/2019
11:45 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Botnet Targets Android Set-Top Boxes

ARES has already infected thousands of devices and is growing, IoT security firm says.

Thousands of Android set-top boxes of the sort used by people to stream media from Hulu, Netflix, and other services have been infected with malware and become part of a growing botnet of similarly compromised devices.

Internet of Things (IoT) security vendor WootCloud, which discovered the threat, has dubbed it the ARES ADB botnet. The botnet is being used as a launchpad to trigger multiple attacks such as brute-force password cracking, denial-of-service attacks, and cryptomining.

In a report this week, WootCloud described the botnet as targeting Android Debug Bridge (ADB), a management component on Android devices that enables debugging and remote management operations.

The ADB service is often left open and unauthenticated on many Internet-connected Android devices, giving attackers a way to access them and take full administrative control. "Accessing the device through TCP port 5555 results in obtaining shell which allows remote command execution, uploading/downloading of custom applications, data access," and other activity, WootCloud warns.

The ARES botnet is the latest sign of attackers targeting vulnerable non-computer IoT devices to build botnets for a variety of malicious purposes. Following the Mirai botnet attacks of 2016, attackers have been actively targeting home routers, security cameras, DVRs, smart TVs, and other Internet-connected devices, which often have weak to no security protections. Many of these devices often provide unauthenticated remote access or are protected only with default passwords and cannot be easily patched or updated. Though many of the devices individually have little computing power, attackers are often able to infect tens of thousands of them at the same time to build botnets capable of doing considerable damage.

With the latest threat, attackers are actively exploiting the ADB configuration issue to install the ARES bot on Android-based set-top boxes from several vendors, including HiSilicon and Cubetek. Once the bot gets installed on a device, it starts scanning for other set-top boxes with similarly misconfigured ADB interfaces and then installs payloads for triggering additional attacks.

Most infections so far have been in South Asia and the broader Asia-Pacific region. The command-and-control servers with which infected devices have been communicating have been observed at multiple locations, including North America.

Potentially Major Impact
Srinivas Akella, founder and chief technology officer at WootCloud, says the ARES botnet poses a potentially major threat to the growing number of other Android-based set-top boxes that consumers and enterprises are using. "This botnet has the potential to affect smart TVs and other IoT devices that have a misconfigured ADB," he says.

With standard Android images, the ADB is not enabled by default. However, several set-top boxes that are available today are running customized versions of the Android OS, which have been rooted and have ADB enabled by default, he says.

To protect against the ADB being misused in cases where it is left enabled, routers can be configured to block the ingress and egress network traffic to TCP port 5555, which is the port that ADB uses.

Enterprises should also configure their network policies to restrict ingress and egress network traffic to IoT devices. "Restrict the ADB interface on the IoT devices to authorized IP address space," he says. "Monitor the ADB interface traffic originating from unknown resources, including the network traffic originating from these devices."

Organizations should also ensure that interfaces on IoT devices such as telnet and SNMP are properly protected with strong passwords to prevent unauthorized access, Akella says.

Home users of vulnerable set-top boxes may have a slightly harder time mitigating the risk. A lot depends on the design of the set-top box and whether the vendor provides an option to disable ADB functionality. When the option is not available, "home users will need to have technical acumen to disable the ADB functionality either by setting up their routers to block traffic," Akella says, "or by logging in to the device and disabling ADB services on the command prompt."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Fuzzing 101: Why Bug-Finders Still Love It After All These Years."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5230
PUBLISHED: 2019-11-13
P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than Emily-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than NEO-AL00D NEO-AL00 9.1.0.321(C786E320R1P1T8) have an improper validation vulnerability. The system does not perform...
CVE-2019-5231
PUBLISHED: 2019-11-13
P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. The software incorrectly performs an authorization check when a user attempts to perform certain action. Successful exploit could allow the attacker to update a crafted package.
CVE-2019-5233
PUBLISHED: 2019-11-13
Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability. Successful exploitation may cause the attacker to access specific components.
CVE-2019-5246
PUBLISHED: 2019-11-13
Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1) have an insufficient verification vulnerability. The system does not verify certain par...
CVE-2010-4177
PUBLISHED: 2019-11-12
mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.