Jump to content
Fi8sVrs

After quietly infecting a million devices, Reaper botnet set to be worse than Mirai

Recommended Posts

  • Active Members

Reaper is on track to become one of the largest botnets recorded in recent years — and yet nobody seems to know what it will do or when. But researchers say the damage could be bigger than last year's cyberattack.

image-602496.jpg

 

A little over a month ago, a sizable botnet of infected Internet of Things devices began appearing on the radar of security researchers.

Now, just weeks later, it's on track to become one of the largest botnets recorded in recent years.

The botnet, dubbed "Reaper" by researchers at Netlab 360, is said to have ensnared almost two million internet-connected webcams, security cameras, and digital video recorders (DVRs) in the past month, says Check Point, which also published research, putting its growth at a far faster pace than Mirai.

It was Mirai that caused a massive distributed denial-of-service (DDoS) attack last October, knocking popular websites off the internet for millions of users. The collective bandwidth from the huge number of "zombie devices" that were infected and enslaved was directed at Dyn, an internet infrastructure company, which overloaded the company's systems and prevented millions from accessing popular websites.

Mirai was "beautifully simple," said Ken Munro, a consultant at UK-based security firm Pen Test Partners. The malware would scan the internet and infect connected devices with default usernames and passwords, which either weren't or couldn't be changed by the owner.

Reaper, however, "is what Mirai could easily have been," said Munro. It takes a slightly different, more advanced approach by quietly targeting and exploiting known vulnerabilities in devices and injecting its malicious code, effectively hijacking the device for whenever the botnet controller is ready to issue their commands. Each time a device is infected, the device spreads the malware to other vulnerable devices -- like a worm.

Mirai aggressively ran each device against a list of known usernames and passwords, but Reaper is "not very aggressive," said Netlab.

By targeting a known vulnerability, the botnet can swiftly take control of a device without raising any alarms.

 
Quote

"One of the reasons Mirai didn't achieve its full potential is that the compromise didn't persist beyond a reboot," said Munro. "Hence, multiple botnet herders were competing for control of the compromised DVRs that comprised it, so the huge botnet it could have been was never built," he said.

Netlab said at the time of publishing their research that the botnet was infecting nine known vulnerabilities in D-Link, Netgear, and AVTech products, as well as other device makers.

Not only has the botnet gained in size in the past month -- it's growing in capability. New exploits have been added to the botnet's arsenal regularly in recent days, said Netlab. Check Point said 33 devices are vulnerable to attack so far. Researchers have also noted that several known, easy-to-exploit vulnerabilities have not been added to the botnet, raising questions about why some exploits have been added and not others.

But what's thrown researchers is that nobody can figure out what the botnet is for.

While the Mirai botnet was a point-and-shoot botnet that could be used to hose systems with vast amounts of bandwidth, Reaper can be used to run complex attack scripts on infected devices. Reaper's command and control infrastructure is also growing in size, accommodating more infected devices by the day. Netlab said 10,000 bots were under the wing of just one command and control server.

So far, there haven't been any signs of DDoS attacks yet. The botnet creator ("it appears that one group or individual has control of most of it," said Munro), is focusing on building the botnet's size. As it stands, Reaper's size today could be capable of "creating significantly more DDoS traffic than Mirai," said Munro.

It's not the first time botnets of a massive scale have crept up on security researchers.

Earlier this year, a 300,000-strong botnet appeared almost out of nowhere, but researchers couldn't figure out what it did -- if anything.

A breakdown of the Reaper botnet shows that the malware that infects devices allows the botnet owner to remotely execute code on each device, said Alan Woodward, a professor at the University of Surrey. But because each device has such little individual computational power, the code running on each device would have to be harnessed collectively for a larger, coordinated computing task, he said.

That could be anything from a DDoS on an internet target, to a much larger kind of attack.

Quote

"The aggregation of large numbers of the same Internet of Things (IoT) device leads to systemic issues," said Munro. "When it's one device affecting one home, it's irritating for the consumer, but when it's a million devices, deeper problems arise."

Quote

"For example, any IoT device that switches a lot of electrical power gives rise to potential to affect the electricity grid," he said.

Quote

 

"Whether it's a smart kettle, a smart thermostat switching your air conditioning or solar panels -- all switch power," he said. "Trigger a million devices that switch 3kW concurrently and the power grid fails."

 

 

What happens next is anybody's guess.

Quote

"Everyone is expecting it to pounce, but so far nothing," said Woodward.

There isn't much that consumers or device owners can do, except patch any affected devices they may own and carry out a factory reset.

Given that device owners are at the mercy of the manufacturers to release patches -- many of which haven't learned much from the Mirai attack and still don't take security seriously -- many may find that simply pulling the plug on each and every affected device might be the only way to dismantle the botnet.

With enough amassed firepower to be larger and stronger than Mirai, the question isn't necessarily what the botnet will do.

Quote

"The question is whether it gets used in anger," said Munro.

 

Source zdnet.com

  • Upvote 4
Link to comment
Share on other sites

pare a fi cronica unei morti anuntate, ma gindesc la o prezentare din 2013

 

insa, "Reaper: Calm Before the IoT Security Storm?"   , "It’s been just over a year since the world witnessed some of the world’s top online Web sites being taken down for much of the day by “Mirai,” a zombie malware strain that enslaved “Internet of Things” (IoT) devices such as wireless routers, security cameras and digital video recorders for use in large-scale online attacks.

Now, experts are sounding the alarm about the emergence of what appears to be a far more powerful strain of IoT attack malware — variously named “Reaper” and “IoTroop” — that spreads via security holes in IoT software and hardware. And there are indications that over a million organizations may be affected already..." in timp ce se anuta ca "Smart meters can be hacked to cut power bills"  iar perfidul GCHQ  ne asigura plin de emfaza ca va apara revolutionarele izbinzi ale tehnocratiei biruitoare.

si toate se petreceau in timp ce Catalin Cimpanu ne dadea de stire ca DUHK Crypto Attack Recovers Encryption Keys, Exposes VPN Connections, More   ... si e ceva comun in aceste stiri, care-mi scapa pe moment caci :" The agency built in additional security measures for the UK metering system after discovering glaring loopholes in meter designs in use abroad that it believed could pose a national security risk if rolled out in Britain.

The communication channel between each meter and the utilities operating them was designed to be encrypted. But the encryption key — the code used to unscramble the data each meter sends and receives — was the same for all of them." GCHQ intervenes to secure smart meters against hackers

 

posibil sa ma insel...

 

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...