New SOAP Attack Hits South African Home Routers

A new malware campaign is attempting to build a bigger botnet, and it's raising warning flags for its attack vector — and the location of the victims.

According to NetScout, IoT honeypots run by its ATLAS Security Engineering & Response Team (ASERT) saw, from April 22 to May 10, a 5,043% increase of exploit attempts that originated in Egypt and targeted consumer routers in South Africa. The attacks, with a payload that attempted to recruit the routers into a botnet using a Hakai DDoS bot variant, exploit (CVE-2014-8361) a remote command execution exploit in the Realtek SDK managed SOAP service.

According to Rich Hummel, threat research manager for NetScout ASERT, these consumer routers are almost never patched or updated, with many consumers having no idea that a management interface exists, or how to use it. And unfortunately, "There are a lot of different factors here, and there are different layers, but it's really on the consumer or owner of the devices to protect themselves against the threats," Hummel says.

Asked about a possible motivation for this attack, at this time, Hummel says that ASERT can only speculate about any "deep" motivation. The most logical answer, though, is that someone simply decided to spin up a new botnet.

"This is a target of opportunity," Hummel says. "These attacks are automated, so it could be that something was seen and an automated attack was launched." As for what was seen, Hummel says that it could have been something as simple as a Shodan script looking for exposed devices with an automated attack script aimed at the results file.

Attack automation and malware as a service make botnet creation something that's available to just about anyone, Hummel says. "It can be done on a Raspberry Pi."

For more, read here.