Slashdot Mirror
2 Million IoT Devices Enslaved By Fast-Growing BotNet (bleepingcomputer.com)
An anonymous reader writes: Since mid-September, a new IoT botnet has grown to massive proportions. Codenamed IoT_reaper, researchers estimate its current size at nearly two million infected devices. According to researchers, the botnet is mainly made up of IP-based security cameras, routers, network-attached storage (NAS) devices, network video recorders (NVRs), and digital video recorders (DVRs), primarily from vendors such as Netgear, D-Link, Linksys, GoAhead, JAWS, Vacron, AVTECH, MicroTik, TP-Link, and Synology.
The botnet reuses some Mirai source code, but it's unique in its own right. Unlike Mirai, which relied on scanning for devices with weak or default passwords, this botnet was put together using exploits for unpatched vulnerabilities. The botnet's author is still struggling to control his botnet, as researchers spotted over two million infected devices sitting in the botnet's C&C servers' queue, waiting to be processed. As of now, the botnet has not been used in live DDoS attacks, but the capability is in there.
Today is the one-year anniversary of the Dyn DDoS attack, the article points out, adding that "This week both the FBI and Europol warned about the dangers of leaving Internet of Things devices exposed online."
The botnet reuses some Mirai source code, but it's unique in its own right. Unlike Mirai, which relied on scanning for devices with weak or default passwords, this botnet was put together using exploits for unpatched vulnerabilities. The botnet's author is still struggling to control his botnet, as researchers spotted over two million infected devices sitting in the botnet's C&C servers' queue, waiting to be processed. As of now, the botnet has not been used in live DDoS attacks, but the capability is in there.
Today is the one-year anniversary of the Dyn DDoS attack, the article points out, adding that "This week both the FBI and Europol warned about the dangers of leaving Internet of Things devices exposed online."
Using botnets to do DDoS attacks is so passé. It may be satisfying for the perpetrators (Ha ha! Site [my enemy] is down!), but no different from the 1980s "my virus will delete all your files"
With most IoT devices having more processing power than they actually need, I wonder how many have been hijacked to become cryptocurrency mining operations, which will quietly run away, building up, with no-one really keeping an eye on them
"She's furniture with a pulse"
Few things have irritated me as much as the mere concept of IoT. The sooner it dies the less spyware we will have.
I think the worst part of the internet is that any moron can post his opinion online.
#DeleteFacebook
...the Internet, Hell I don't even know where to find it!
These IoT thingies have more power than the PC I had 15 years ago. And many of them do hardly anything with it. That is just... strange.
-- Cheers!
Comment removed based on user account deletion
The Cloud is My Master.
So does this mean I need a firewall in front of my cable modem?
I noticed the summary conveniently left of the very last item in the list of the article of affected devices "and Linux servers".
Sheesh, what an elitist fuckwit.
So come on then brains, tell all of us ignorant consumers how we're supposed to check with 100% certainty that a network enabled device is secure ?
And what do you define as a 'device' ?
Does that go as far as regular desktop/laptop computers? If not, why do they get a special exemption from being allowed to be part of a botnet ?
This explains why my thermostat is now mining Bitcoin.
You are welcome on my lawn.
Why exactly should they learn anything?
Did the customer buy it? Check.
Did he return it? Nope.
What exactly is the problem the manufacturer could possible have?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Opinions don't hurt. Opinions are great, I needn't share it, and instead I can point out to some idiot why his opinion is crap.
The worst part is that anyone can hook his insecure, unpatched garbage onto the net and people are no longer connected via dialup with those infrastructural systems that "count" having multiple gigabits of bandwidth available to them, making the impact an idiot with a botnet sheep running 24/7 at his home ("because those torrents take forever, broadband MY ASS!!!!111!1!") insignificant.
These idiots that now have 20, 50, 100 and more mbit available to them CAN and DO pose a threat to key infrastructure.
That is the worst part of the internet right now.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
krack doesn't "enslave" wifi devices. It allows the encryption to be broken.
I would take a guess and say it hasn't, at all.
The device made it beyond the 15 day return period before being exploited. And who is going to notice this problem before the 1-year warranty runs out that would buy such a device and run it on an unsecured network anyway.
No its not all IoT. IoT devices just are less likely to be maintained by the manufacturer.
With a NAS or router, the response has been to blame the user. They should either patch the firmware, or switch to a manufacturer which supports the product after the sale.
With IoT devices, there is little to do but pine for the good old days when nerds wrote their own firmware, and the commoners new nothing of technology. And wait for the IoT zombie botnets to attack a high enough value target so as to get something done about the issue.
Either we charge fines for devices connected to the internet with outdated firmware, operating systems, or security software, or we fine manufacturers who fail to deploy fixes in a specified amount of time regardless of lost functionality to the device.
Tomaeto, Tomahtoe.
Make Raspberry Pi's easy to deploy with Windows 10, and you might just solve your IoT problem. Depending on the W10 implementation. Maybe go with Azure AD?
I pay the device manufacturer, Maytag for instance, to not be ignorant for me. Its called delegation.
Time is money. If I'm buying an IoT device, I'm buying it to reduce the amount of time I'm having to spend micromanaging it.
Insecurely Designed Internet Of Things
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Same here, not affected. All my IoT thingymajingies still work fine, including the house alarm and door locks.
CLI paste? paste.pr0.tips!
The device manufacturers know they get away with it, so at the end of the day, you're still SOL.
CLI paste? paste.pr0.tips!
Uhh, let's see here...Botnets are as common as grass, and nothing to freak out about. If you've been even glancing at IT trade mags for the past several years, you already know how to deal with the ensuing DDOS attacks. There are even services, mentioned right here on /., that proudly advertise that they won't boot you if you are the target of the DDOS attack, because they know now how to handle them, with ease.
So at best, this is more of a last mile problem: the owners of said devices are likely to have important identity information stolen from them, and, God forbid, a company using such insecure devices on their network (and not staying on top of updates / security notices)...well, we have a phrase for people like that -> "trusting in the wind."
But if we look at this post more intelligently, as a likely plant to generate some FUD, or to make some tech stocks sink, well, that makes more sense, doesn't it?
There are many what if's. But instead of sitting there throwing criticisms, what do you think needs to be done to resolve the lack of secuirty of IoT devices?