IoT
10/23/2018
10:45 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

IoT Bot Landscape Expands, Attacks Vary by Country

New report finds 1,005 new user names and passwords beyond Mirai's original default list two years ago.

Roughly two years after the Mirai Internet of Things (IoT) bot took down the Internet for much of the eastern United States and parts of Europe, Netscout security researchers have found that the bot landscape has expanded considerably.

By setting honeypots across North America, South America, Europe, and Asia, researchers observed nearly 200,000 brute-force attacks from Sept. 1 through Sept. 30, according to Matt Bing, a security research analyst at Netscout. The team found 1,005 additional user name and password combinations beyond Mirai's original default list of 60.

"A lot of what we were trying to do is find out what has changed from the original Mirai source code from the fall of 2016 and how it has expanded," Bing explained in a blog post today. "We found they were looking to attack new and different types of IoT devices, such as webcams and travel routers. The first Mirai attacks focused on DVRs."

Bing said the researchers also found trends specific to certain regions. For example, "root/20080826" was found in Russia on a travel router widely used there, while "telecomadmin/admintelecom" was prevalent in China, where that user name and password combo is found on widely used Huawei routers.

"We also found that when bots using specific manufacturer default passwords would infect devices, they would launch attacks from those compromised devices," Bing said.

Given this new information, Bing advised security pros to keep their IoT devices up to date and behind a firewall. Home users should place their IoT devices behind a home router.

"We'd also suggest companies use honeypots to understand the landscape and gain insights into where these IoT attacks are headed," Bing said.

Related Content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
CameronRobertson
50%
50%
CameronRobertson,
User Rank: Moderator
10/31/2018 | 9:23:37 PM
Well
Well, it is always the pattern that we have been seeing which coincides with most norms. The bigger the surface area is, the bigger the content will be. Apparently, the issue with increasing risks just so happen to be caused by the increasing digital platfrom which allows more content to be developed, hence increase the risks as well.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6487
PUBLISHED: 2019-01-18
TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.
CVE-2018-20735
PUBLISHED: 2019-01-17
** DISPUTED ** An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...
CVE-2019-0624
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.