Malware Hunts And Kills Poorly Secured Internet Of Things Devices Before They Can Be Integrated Into Botnets

(Mis)Uses of Technology

from the battle-of-the-brick dept

Researchers say they’ve discovered a new wave of malware with one purpose: to disable poorly secured routers and internet of things devices before they can be compromised and integrated into botnets. We’ve often noted how internet-of-broken-things devices (“smart” doorbells, fridges, video cameras, etc.) have such flimsy security that they’re often hacked and integrated into botnets in just a matter of seconds after being connected to the internet. These devices are then quickly integrated into botnets that have been responsible for some of the worst DDoS attacks we’ve ever seen (including last October’s attack on DYN).

And most security researchers firmly believe we haven’t seen anything yet.

Enter PDoS (permanent denial of service) attack bots, which scan the internet for routers with default, unchanged passwords, or “smart” doorbells, dolls or other devices with paper-mache grade security. From there, PDoS attack bots issue a series of commands that wipe device media, corrupt all storage, and disconnect the device from the internet. Last month, researchers from security firm Radware set up an intentionally poorly-secured honeypot that they say saw roughly 2,250 PDoS attempts during just a four-day span.

The lion’s share of these attacks came from two botnets dubbed BrickerBot.1 and BrickerBot.2 — with nodes busily bricking poorly-secured devices around the world. Initially researchers say they thought that somebody crafted malware specifically to tackle the IOT threat. But given the broad targeting of the botnets (including server-attached storage devices), they also think it’s possible that the goal may just be good, old, vanilla mayhem:

“When I discovered the first BrickerBot, I thought it was a drastic attempt to stop the IoT Botnet DDoS threat,” Radware researcher Pascal Geenens told Ars. “I thought this was a competitor hacker who wanted to take out his competition and get access to the list of IP [addresses] of bots that were in the competitor’s botnet. But upon discovery of the second BrickerBot this theory changed, as the second one is targeting any Linux-based system?not only embedded, BusyBox-based Linux with flash storage. What motivates people to randomly destroy things? Anger, maybe? A troll, maybe?”

As it stands, BrickerBot.2 can only access machines that feature default administrative passwords and have the telnet protocol enabled, limiting the overall potential impact. Regardless, the end result still isn’t pleasant for those on the receiving end of a BrickerBot.2 attack:

“…In addition to corrupting the storage device, BrickerBot.2 wipes all stored files, removes the default Internet gateway, disables TCP timestamps, and limits the maximum number of kernel threads to just one. That all but ensures that most damaged devices won’t be restored without a major undertaking. Radware has more details about the attacks here.”

It’s still entirely possible the goal here is to actually help the internet by killing poorly-secured hardware before they can be conscripted into the shitshow that is the internet of things. After all, BrickerBot.2 appears to be an evolution of the Linux.Wifatch malware, which first appeared in October 2015. It seems more than likely that additional malware strains taking cues from the Mirai malware will inevitably appear in the wild, the goal potentially being not necessarily mayhem — but preventing the massive, crippling DDoS attacks most security experts feel are inevitable in the next year or two.

The problem (aside from this being illegal and destructive) is that the type of person that’s likely to go out and purchase a poorly-secured “gee whiz” IOT device or router without considering security — is the same type of person that’s not going to understand why that device just stopped working for no coherent reason. As a result, they’re likely to rush out and buy another, poorly-secured device, bringing the incompetence full circle with a zero net gain. As such, Security expert Victor Gevers is urging malware authors like this to consider a more constructive path toward the same end goal:

“These attacks are very easy to execute, and I think this just the beginning,” (Gevers) told Bleeping Computer. “I don’t want to label this work as dark, but I think there are less destructive ways to achieve the same goal.” “Instead of bricking you could also allow the devices to still work and just patch the vulnerability. This requires a bit more finesse.”

Granted an even better solution? Stop selling (and buying) hardware with paper-mache grade security in the first place.

Filed Under: botnets, iot, malware, patching, security