Cybercriminals are using the PSYB0T botnet to take advantage of vulnerabilities in the NetComm NB5 modem-router.
Botnets -- groups of computers that have been compromised, hijacked, and coordinated for malicious purposes -- remain a significant source of online security problems. Now some of the zombie machines that constitute botnets have taken on a new form.
For the past few months, security researchers have watched a botnet being built out of embedded devices, specifically DSL modem-routers.
In a paper published in January, security researcher Terry Baume observed that vulnerabilities in the NetComm NB5, an ADSL/ADSL2+ modem-router, have become widely known and that cybercriminals have been taking advantage of these flaws to compromise the devices and, possibly, other modem-routers. He calls the botnet PSYB0T.
"This is the first botnet I've heard of that infects embedded devices," his paper says, noting that a compromised router can be used to alter DNS routing and redirect network traffic to phishing sites.
Baume says that end users aren't likely to be aware that their modem-routers have been compromised and that they could easily become confused if notified by their Internet service provider about possible malware on their computers, which might appear clean to antivirus software.
He also observes that most users leave their DSL modems on all the time. Compromised devices thus would remain active all the time, unlike compromised computers, which tend to get turned off periodically.
DroneBL, a site that monitors IP addresses for abuse, was hit by a distributed denial-of-service (DDoS) attack from a PSYB0T botnet for several weeks.
A blog post on the site explains that in order to be vulnerable, the device in question must be a Linux mipsel device; must have telnet, SSH, or a Web-based interface available over a WAN; and must have weak user name/password combinations or must have firmware that relies on daemons that are exploitable.
"The malware can spread itself through telnet admin interfaces of the DSL modems," a post on the Team Furry blog explains. "It also has the capability to scan for PHPMyAdmin installations and Windows SMB shares."
Devices not running MIPS, such the x86-based computers run by most consumers, are not themselves at risk, but could be affected if connected to vulnerable DSL modems.
Owners of potentially vulnerable DSL modem-routers are advised to make sure the devices have updated firmware and to verify that they're using a user name and password for the device that can't be easily guessed by a dictionary attack.
Find out how to balance technology, business intelligence, and process to reduce exposure to vulnerabilities (registration required).
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024