Slashdot Mirror
2 Million IoT Devices Enslaved By Fast-Growing BotNet (bleepingcomputer.com)
An anonymous reader writes: Since mid-September, a new IoT botnet has grown to massive proportions. Codenamed IoT_reaper, researchers estimate its current size at nearly two million infected devices. According to researchers, the botnet is mainly made up of IP-based security cameras, routers, network-attached storage (NAS) devices, network video recorders (NVRs), and digital video recorders (DVRs), primarily from vendors such as Netgear, D-Link, Linksys, GoAhead, JAWS, Vacron, AVTECH, MicroTik, TP-Link, and Synology.
The botnet reuses some Mirai source code, but it's unique in its own right. Unlike Mirai, which relied on scanning for devices with weak or default passwords, this botnet was put together using exploits for unpatched vulnerabilities. The botnet's author is still struggling to control his botnet, as researchers spotted over two million infected devices sitting in the botnet's C&C servers' queue, waiting to be processed. As of now, the botnet has not been used in live DDoS attacks, but the capability is in there.
Today is the one-year anniversary of the Dyn DDoS attack, the article points out, adding that "This week both the FBI and Europol warned about the dangers of leaving Internet of Things devices exposed online."
The botnet reuses some Mirai source code, but it's unique in its own right. Unlike Mirai, which relied on scanning for devices with weak or default passwords, this botnet was put together using exploits for unpatched vulnerabilities. The botnet's author is still struggling to control his botnet, as researchers spotted over two million infected devices sitting in the botnet's C&C servers' queue, waiting to be processed. As of now, the botnet has not been used in live DDoS attacks, but the capability is in there.
Today is the one-year anniversary of the Dyn DDoS attack, the article points out, adding that "This week both the FBI and Europol warned about the dangers of leaving Internet of Things devices exposed online."
Using botnets to do DDoS attacks is so passé. It may be satisfying for the perpetrators (Ha ha! Site [my enemy] is down!), but no different from the 1980s "my virus will delete all your files"
With most IoT devices having more processing power than they actually need, I wonder how many have been hijacked to become cryptocurrency mining operations, which will quietly run away, building up, with no-one really keeping an eye on them
"She's furniture with a pulse"
The internet isn't bad, the IoT is bad. The distinction being that the IoT consists of many thousands of distinct devices made mostly by hacks who don't know how to program which all independently try to call home for various purposes (usually spying on your with whatever sensors they have available for marketing and similar purposes) while simultaneously opening backdoors into your network by registering as a client to your firewall while making outbound HTTP requests to get data out and commands in. The overwhelming majority or IoT devices are parts of botnets because of the shit security which went into them in addition to their inherent spyware intention, which the unhacked ones also play a part in. The IoT is interesting as a concept but when implemented by a bunch of companies being paid for instance to develop a CCTV camera or smoke alarm or thermostat and not highly skilled in digital security is just an increased attack surface, but again even the ones highly skilled in security just use it for spyware (think to yourself: do your NEST thermostat and smoke alarm really need fucking cameras to register hand gestures - do they really need hand gestures, or is that just Google's way of tricking morons into sticking a camera in their living room?
I noticed the summary conveniently left of the very last item in the list of the article of affected devices "and Linux servers".
Why exactly should they learn anything?
Did the customer buy it? Check.
Did he return it? Nope.
What exactly is the problem the manufacturer could possible have?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why exactly would it die?
Manufacturers can sell it and are not legally responsible for their crapware.
People are dumb and buy it, not understanding what's going on.
Damage is done to someone who cannot influence buying/selling of those things.
So what reason would you see for this to cease?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Not strange at all, the chips are just cheaper.
I kid you not. You can currently get chips with more features and faster processing speed cheaper than "older" chips with less. Mostly because the price of chips is mostly fixed costs and it costs about the same to make either of them, so making the more powerful one that outdoes or at least is on par with the competition's chip makes sense, else people will buy theirs and not ours.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Lucky you. Mine just went to 100F and demands 2 Bitcoins to set it back to normal levels.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You can thank smartphones for that, which have driven down the cost of embedded processors significantly.
When I started, a 200MHz StrongARM processor was considered high end, and 400MHz processors were on the way. If you're lucky, they had 32MB of RAM. At the time, the average desktop was 500-800MHz with 128-512MB of RAM. You wouldn't dare run desktop applications on the embedded processor (even though they ran Linux and could) - it was just too painful.
Even when the iPhone came out, it ran a 400MHz processor with 128MB of RAM. But just 10 years later, we've got 2.5GHz processors with 4+GB of RAM on our phones. And we're pushing processing power that is starting to meet or exceed what low-end PCs are capable of.
Likewise, the embedded market has followed the same trend - if you want, those 200MHz processors are still available. But you can get a multi-core multi-GHz processor for basically the same price.
T_SET 68F T_MEAS 67.5F ALL SYSTEMS NOMINAL PLEASE MOVE ALONG NOTHING TO SEE HERE FELLOW HUMANS
o o o o o o o o o o o o o o o o o o o o o o o o o o o
CLI paste? paste.pr0.tips!