IoT
10/23/2018
10:45 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

IoT Bot Landscape Expands, Attacks Vary by Country

New report finds 1,005 new user names and passwords beyond Mirai's original default list two years ago.

Roughly two years after the Mirai Internet of Things (IoT) bot took down the Internet for much of the eastern United States and parts of Europe, Netscout security researchers have found that the bot landscape has expanded considerably.

By setting honeypots across North America, South America, Europe, and Asia, researchers observed nearly 200,000 brute-force attacks from Sept. 1 through Sept. 30, according to Matt Bing, a security research analyst at Netscout. The team found 1,005 additional user name and password combinations beyond Mirai's original default list of 60.

"A lot of what we were trying to do is find out what has changed from the original Mirai source code from the fall of 2016 and how it has expanded," Bing explained in a blog post today. "We found they were looking to attack new and different types of IoT devices, such as webcams and travel routers. The first Mirai attacks focused on DVRs."

Bing said the researchers also found trends specific to certain regions. For example, "root/20080826" was found in Russia on a travel router widely used there, while "telecomadmin/admintelecom" was prevalent in China, where that user name and password combo is found on widely used Huawei routers.

"We also found that when bots using specific manufacturer default passwords would infect devices, they would launch attacks from those compromised devices," Bing said.

Given this new information, Bing advised security pros to keep their IoT devices up to date and behind a firewall. Home users should place their IoT devices behind a home router.

"We'd also suggest companies use honeypots to understand the landscape and gain insights into where these IoT attacks are headed," Bing said.

Related Content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
CameronRobertson
50%
50%
CameronRobertson,
User Rank: Apprentice
10/31/2018 | 9:23:37 PM
Well
Well, it is always the pattern that we have been seeing which coincides with most norms. The bigger the surface area is, the bigger the content will be. Apparently, the issue with increasing risks just so happen to be caused by the increasing digital platfrom which allows more content to be developed, hence increase the risks as well.
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19349
PUBLISHED: 2018-11-17
In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.
CVE-2018-19350
PUBLISHED: 2018-11-17
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
CVE-2018-19341
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader...
CVE-2018-19342
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation starting at U3DBrowser+0x00000000...
CVE-2018-19343
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a "Data from Faul...