botnet

Auto Added by WPeMatico

Attackers DDoS WannaCry Kill Switch

Attackers DDoS WannaCry Kill Switch

An anonymous reader quotes VentureBeat:
As of late Friday, after many of the deadlines threatening data deletion had passed, few victims had paid ransoms. According to Elliptic Enterprises, only about $94,000 worth of ransoms had been paid via Bitcoin, which works out to less than one in a thousand of the 300,000 victims who were reportedly affected by WannaCry… While not as bad as feared, ransomware (not to mention cybersecurity threats in general) isn’t going away. Wired reported that the domain registered by Hutchins has been under intense denial-of-service attacks delivered by an army of IoT devices marshalled, zombie-like, by Mirai.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, botnet
Groups War Over Resources For DDoS Attacks

Groups War Over Resources For DDoS Attacks

An anonymous reader quotes CSO:

As more groups get into the denial-of-service attack business they’re starting to get in each other’s way, according to a report released Thursday… There are only so many devices around that have the kind of vulnerabilities that make them potential targets for a botnet. That translates into a smaller average attack size, said Martin McKeay, senior security advocate at Cambridge, Mass.-based Akamai Technologies Inc. There are only so many devices around that have the kind of vulnerabilities that make them potential targets for a botnet. “And other people can come in and take over the device, and take those resources to feed their own botnet,” he said. “I’m seeing that over and over.”

The article reports a median size for DDoS attacks of 4 gigabits per second at the start of 2015 — which droped in the first quarter of 2017 down to 500 megabits per second.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, botnet
New IoT Malware Targets 100,000 IP Cameras Via Known Flaw

New IoT Malware Targets 100,000 IP Cameras Via Known Flaw

Researcher Pierre Kim has found a new malware, called Persirai, that has been infecting over 100,000 Chinese-made, internet-connected cameras. According to Trend Micro, the malware has been active since last month and works by exploiting flaws in the cameras that Kim reported back in March. CSO Online reports: At least 1,250 camera models produced by a Chinese manufacturer possess the bugs, the researcher went on to claim. Over a month later in April, Trend Micro noticed a new malware that spreads by exploiting the same products via the recently disclosed flaws. The security firm estimates that about 120,000 cameras are vulnerable to the malware, based on Shodan, a search engine for internet-connected hardware. The Persirai malware is infecting the cameras to form a botnet, or an army of enslaved computers. These botnets can launch DDoS attacks, which can overwhelm websites with internet traffic, forcing them offline. Once Persirai infects, it’ll also block anyone else from exploiting the same vulnerabilities on the device. Security firm Qihoo 360 has also noticed the malware and estimated finding 43,621 devices in China infected with it. Interestingly, Persirai borrows some computer code from a notorious malware known as Mirai, which has also been infecting IoT devices, such as DVRs, internet routers, and CCTV cameras, but by guessing the passwords protecting them.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, botnet
New Shodan Tool Tracks Down Botnet Command-And-Control Servers

New Shodan Tool Tracks Down Botnet Command-And-Control Servers

An anonymous reader quotes The Stack:
Search engine Shodan has announced a tool to help businesses hunt out and block traffic from malware command-and-control servers. The new Malware Hunter service, which has been designed in a collaborative project with threat intelligence company Recorded Future, continuously scans the internet to locate control panels for different remote access Trojans, including Gh0st RAT, Dark Comet, njRAT, XtremeRAT, Net Bus and Poison Ivy. The internet crawler identifies botnet C2 servers by connecting to public IP addresses and sending traffic which mimics that of an infected device. If the receiver computer sends back a response, that server is flagged.

The article reports that Shodan’s Malware Hunter tool has already traced over 5,700 RAT servers — more than 4,000 of them based in the United States.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, botnet
BrickerBot, the Permanent Denial-of-Service Botnet, Is Back With a Vengeance

BrickerBot, the Permanent Denial-of-Service Botnet, Is Back With a Vengeance

An anonymous reader quotes a report from Ars Technica: BrickerBot, the botnet that permanently incapacitates poorly secured Internet of Things devices before they can be conscripted into Internet-crippling denial-of-service armies, is back with a new squadron of foot soldiers armed with a meaner arsenal of weapons. Pascal Geenens, the researcher who first documented what he calls the permanent denial-of-service botnet, has dubbed the fiercest new instance BrickerBot.3. It appeared out of nowhere on April 20, exactly one month after BrickerBot.1 first surfaced. Not only did BrickerBot.3 mount a much quicker number of attacks — with 1,295 attacks coming in just 15 hours — it used a modified attack script that added several commands designed to more completely shock and awe its targets. BrickerBot.1, by comparison, fired 1,895 volleys during the four days it was active, and the still-active BrickerBot.2 has spit out close to 12 attacks per day. Shortly after BrickerBot.3 began attacking, Geenens discovered BrickerBot.4. Together, the two newly discovered instances have attempted to attack devices in the research honeypot close to 1,400 times in less than 24 hours. Like BrickerBot.1, the newcomer botnets are made up of IoT devices running an outdated version of the Dropbear SSH server with public, geographically dispersed IP addresses. Those two characteristics lead Geenens to suspect the attacking devices are poorly secured IoT devices themselves that someone has compromised and used to permanently take out similarly unsecured devices. Geenens, of security firm Radware, has more details here.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, botnet
Developer of BrickerBot Malware Claims He Destroyed Over Two Million Devices

Developer of BrickerBot Malware Claims He Destroyed Over Two Million Devices

An anonymous reader writes: In an interview today, the author of BrickerBot, a malware that bricks IoT and networking devices, claimed he destroyed over 2 million devices, but he never intended to do so in the first place. His intentions were to fight the rising number of IoT botnets that were used to launch DDoS attacks last year, such as Gafgyt and Mirai. He says he created BrickerBot with 84 routines that try to secure devices so they can’t be taken over by Mirai and other malware. Nevertheless, he realized that some devices are so badly designed that he could never protect them. He says that for these, he created a “Plan B,” which meant deleting the device’s storage, effectively bricking the device. His identity was revealed after a reporter received an anonymous tip about a HackForum users claiming he was destroying IoT devices since last November, just after BrickerBot appeared. When contacted, BrickerBot’s author revealed that the malware is a personal project which he calls “Internet Chemotherapy” and he’s “the doctor” who will kill all the cancerous unsecured IoT devices.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, botnet
New Destructive Malware Intentionally Bricks IoT Devices

New Destructive Malware Intentionally Bricks IoT Devices

An anonymous reader writes: “A new malware strain called BrickerBot is intentionally bricking Internet of Things (IoT) devices around the world by corrupting their flash storage capability and reconfiguring kernel parameters. The malware spreads by launching brute-force attacks on IoT (BusyBox-based) devices with open Telnet ports. After BrickerBot attacks, device owners often have to reinstall the device’s firmware, or in some cases, replace the device entirely. Attacks started on March 20, and two versions have been seen. One malware strain launches attacks from hijacked Ubiquiti devices, while the second, more advanced, is hidden behind Tor exit nodes. Several security researchers believe this is the work of an internet vigilante fed up with the amount of insecure IoT devices connected to the internet and used for DDoS attacks. “Wow. That’s pretty nasty,” said Cybereason security researcher Amit Serper after Bleeping Computer showed him Radware’s security alert. “They’re just bricking it for the sake of bricking it. [They’re] deliberately destroying the device.”

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, botnet