Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/30/2016
04:45 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Another IoT-Dominated Botnet Rises With Almost 1M Infected Devices

BASHLITE malware fuels another DDoS botnet made up primarily of flaw-ridden internet of things devices

Researchers shed light this week on a new million-endpoint botnet consisting almost exclusively of internet of things (IoT) devices. The discovery uncovers one more sign -- among several in the last few months --  showing that the threat of IoT botnets is quickly moving from proof-of-concept to common strategy.

This week's find was made by the team at Level 3 Threat Research Labs, which put out a report on the BASHLITE malware family responsible for this particular botnet. Also known as Lizkebab, Torlus or gafgyt, the malware family has focused primarily on building out botnets for carrying out distributed denial of service (DDoS) attacks. 

According to the research, the source code for the malware was initially spotted in 2015 and has now spun off into more than a dozen variants. At its root, it is designed to  be easily cross-compiled for multiple architectures running Linux, making it ideal for building out attacks that leverage the fragmented field of embedded systems in the IoT environment. As things stand, the botnet tracked by Level 3 is nearing one million infected devices, 96% of which are IoT-related.

"The use of IoT devices in botnets is not new, but as they become more common, we expect these types of botnets to increase in number and power," Level 3 researchers wrote in their report. "While compromised hosts and home routers continue to be targeted, bot herders will follow the path of least resistance. Before spending more energy on traditional bot hosts, they’ll take advantage of the abundance of insecure IoT devices." 

According to a survey out from Tripwire last week conducted among 220 attendees of Black Hat USA 2016, less than one-third of security practitioners feel their organizations are prepared for the security risks associated with IoT. Approximately 78% of respondents said they're concerned about the weaponization of IoT devices in the use of DDoS attacks.

"It wasn't so long ago that home computer ‘zombie armies’ were the weapon of choice for a lot of cyber attacks and denial of service attacks," says Dwayne Melancon, chief technology officer and vice president of research and development for Tripwire. “It seems that security professionals see IoT devices as a sort of ‘zombie appliance army’ that’s worthy of great concern. That makes sense, since many of the current crop of IoT devices were created with low cost as a priority over security, making them easy targets." 

Earlier this summer researchers with Arbor Networks brought attention to the rise of an IoT-dominated DDoS botnet called LizardStresser that's been making waves with its capability of carrying out large-scale DDoS attacks. Some of these attacks have been as large as 400 Gbps without the use of reflection or amplification techniques, with targets that include gaming sites, financial institutions, ISPs and government institutions. Meanwhile, another piece of research from Sucuri showed how attackers are taking advantage of weaknesses in closed circuit TV (CCTV) devices to run DDoS botnets completely consisting of these rarely monitored devices.

Related Content:

 

 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Pledges to Not Pay Ransomware Hit Reality
Robert Lemos, Contributing Writer,  6/21/2019
AWS CISO Talks Risk Reduction, Development, Recruitment
Kelly Sheridan, Staff Editor, Dark Reading,  6/25/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10133
PUBLISHED: 2019-06-26
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
CVE-2019-10134
PUBLISHED: 2019-06-26
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.
CVE-2019-10154
PUBLISHED: 2019-06-26
A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations.
CVE-2019-9039
PUBLISHED: 2019-06-26
The Couchbase Sync Gateway 2.1.2 in combination with a Couchbase Server is affected by a previously undisclosed N1QL-injection vulnerability in the REST API. An attacker with access to the public REST API can insert additional N1QL statements through the parameters ?startkey? and ?endkey? of the ?_a...
CVE-2018-20846
PUBLISHED: 2019-06-26
Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).