Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/30/2016
04:45 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Another IoT-Dominated Botnet Rises With Almost 1M Infected Devices

BASHLITE malware fuels another DDoS botnet made up primarily of flaw-ridden internet of things devices

Researchers shed light this week on a new million-endpoint botnet consisting almost exclusively of internet of things (IoT) devices. The discovery uncovers one more sign -- among several in the last few months --  showing that the threat of IoT botnets is quickly moving from proof-of-concept to common strategy.

This week's find was made by the team at Level 3 Threat Research Labs, which put out a report on the BASHLITE malware family responsible for this particular botnet. Also known as Lizkebab, Torlus or gafgyt, the malware family has focused primarily on building out botnets for carrying out distributed denial of service (DDoS) attacks. 

According to the research, the source code for the malware was initially spotted in 2015 and has now spun off into more than a dozen variants. At its root, it is designed to  be easily cross-compiled for multiple architectures running Linux, making it ideal for building out attacks that leverage the fragmented field of embedded systems in the IoT environment. As things stand, the botnet tracked by Level 3 is nearing one million infected devices, 96% of which are IoT-related.

"The use of IoT devices in botnets is not new, but as they become more common, we expect these types of botnets to increase in number and power," Level 3 researchers wrote in their report. "While compromised hosts and home routers continue to be targeted, bot herders will follow the path of least resistance. Before spending more energy on traditional bot hosts, they’ll take advantage of the abundance of insecure IoT devices." 

According to a survey out from Tripwire last week conducted among 220 attendees of Black Hat USA 2016, less than one-third of security practitioners feel their organizations are prepared for the security risks associated with IoT. Approximately 78% of respondents said they're concerned about the weaponization of IoT devices in the use of DDoS attacks.

"It wasn't so long ago that home computer ‘zombie armies’ were the weapon of choice for a lot of cyber attacks and denial of service attacks," says Dwayne Melancon, chief technology officer and vice president of research and development for Tripwire. “It seems that security professionals see IoT devices as a sort of ‘zombie appliance army’ that’s worthy of great concern. That makes sense, since many of the current crop of IoT devices were created with low cost as a priority over security, making them easy targets." 

Earlier this summer researchers with Arbor Networks brought attention to the rise of an IoT-dominated DDoS botnet called LizardStresser that's been making waves with its capability of carrying out large-scale DDoS attacks. Some of these attacks have been as large as 400 Gbps without the use of reflection or amplification techniques, with targets that include gaming sites, financial institutions, ISPs and government institutions. Meanwhile, another piece of research from Sucuri showed how attackers are taking advantage of weaknesses in closed circuit TV (CCTV) devices to run DDoS botnets completely consisting of these rarely monitored devices.

Related Content:

 

 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-20001
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
CVE-2020-36317
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
CVE-2020-36318
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVE-2021-28875
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
CVE-2021-28876
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety r...