Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

10/3/2016
06:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

IoT DDoS Attack Code Released

Mirai malware could signal the beginning of new trend in using Internet of Things devices as bots for DDoS attacks.

The perpetrator of a massive distributed denial-of-service (DDoS) attack on the KrebsOnSecurity website last month has publicly released the code used in the assault in a move that security analysts fear could make it much easier for others to launch similar salvos.

Called Mirai, the malware is designed to search for and attack Internet-connected consumer devices that are protected only with default passwords and usernames, according to a KrebsOnSecurity blog post on Saturday.

A Hackforums user with the nickname "Anna-senpai" released the code apparently in response to the increased scrutiny of vulnerable IoT devices by ISPs following the recent DDoS attack on the site run by security blogger and researcher Brian Krebs.

Mirai is one of two malware families to have surfaced recently that is designed explicitly to create botnets from vulnerable IoT devices. The other is Bashlight, a malware that is thought to have infected over a million IoT devices and co-opted them into a botnet, according to KrebsOnSecurity, pointing to research from Level 3 Communications.

Mirai is designed to attack IoT systems running BusyBox, which is an executable file that combines multiple small versions of Unix utilities, MalwareTech said in an analysis of the malware. The malware was used to create a botnet comprised mostly of home routers and network-enabled cameras, digital video recorders and other IoT devices.

The botnet was used to launch a 620 Gbps DDoS attack on KrebsOnSecurity's website and another one last week that exceeded 1 Tbps in size against French Internet service provider OVH. Both were easily the largest-ever DDoS attacks in terms of bandwidth size seen so far.

According to MalwareTech, Mirai works by brute-forcing BusyBox systems with a list of over 60 passwords that are commonly used as default. Once on a system, the malware attempts to block others from trying to infect the same machine.

"Mirai appears to be simple and intuitive, which makes it easy to [administer]," says Thomas Pore, director of IT and services at security vendor Plixer International. Once Mirai infects a system, the malware is designed to clean up any trace of its presence in order to avoid detection and to maintain a persistent foothold on the bot, he says.

No Phishing Necessary

What makes Mirai particularly interesting is the use of IoT devices to create a botnet, he says. "The concept of running an IoT botnet is genius because there is no overhead of hiring a spam service to phish users in an attempt to compromise a PC to act as a bot," More says.

For attackers, it is easy and costs next to nothing to scan the Internet for vulnerable IoT devices to attack, he said. And with Mirai source code now publicly available, it is likely that others will begin to use the malware to create their own botnets.

The increased competition for the vulnerable devices, though, could actually result in the scale of Mirai-enabled DDoS attacks becoming smaller, Pore says.

"Perhaps the scale of the attack will lessen if the compromised devices are spread across multiple botnets serving service denials for different targets," he says.

Reiner Kappenberger, global product manager at HPE Security-Data Security, says the release of the Mirai code highlights the problems surfacing from the lack of adequate security practices in the IoT space.

"As shown by this latest development, this is a broad problem that can manifest itself on many IoT devices with extremely damaging results," he says.

Consumers buying IoT devices should make the effort to identify the security controls present in them, he says. A breach in the IoT device can easily move to other systems such as a home computer, thus allowing attackers to steal valuable personal information such as bank account information and credentials.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jason Lebrecht
50%
50%
Jason Lebrecht,
User Rank: Apprentice
2/10/2020 | 9:38:07 PM
Re: Not Good
Well, it's been 4 years. Are DDoS attacks still the main concern are for cyber attacks? Jason Lebrecht
Jason Lebrecht
50%
50%
Jason Lebrecht,
User Rank: Apprentice
10/4/2016 | 11:13:48 PM
Not Good
Good reminder to ensure simple protections. Thanks for the article.

 

Jason Lebrecht
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20477
PUBLISHED: 2020-02-19
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
CVE-2019-20478
PUBLISHED: 2020-02-19
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
CVE-2011-2054
PUBLISHED: 2020-02-19
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper in...
CVE-2015-0749
PUBLISHED: 2020-02-19
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker ...
CVE-2015-9543
PUBLISHED: 2020-02-19
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is rel...