<html>
<p><center><img src="https://i.imgsafe.org/cf136853ca.png" width="650" height="366"/></center></p>
<p>On the heels of severe Distributed Denial of Service (DDoS) attacks, new Internet-of-Things (IoT) powered botnets are emerging. There are already hundreds of such botnets which exist in the underground hacking ecosystem, where services, code, and specific attacks can be purchased or acquired. New botnets are being developed to meet the growing demand and to circumvent anticipated security controls. </p>
<h2><strong>The latest IoT botnet</strong></h2>
<p>Researchers have <a href="http://blog.malwaremustdie.org/2016/10/mmd-0059-2016-linuxirctelnet-new-ddos.html">spotted a new IoT botnet</a> called <strong>Linux/IRCTelnet</strong>. In just 5 days it <a href="http://arstechnica.com/security/2016/11/new-iot-botnet-that-borrows-from-notorious-mirai-infects-3500-devices/">infected 3500 devices</a> and features an old-school adaptation: using Internet Relay Chat (IRC) as the command and control structure. IRC is a very old technology based upon original chat-boards of the Internet (pre world-wide-web). Many of the original botnets used IRC, a decade ago. It is not particularly difficult to undermine for security software, therefore represents an interesting choice by the attackers, whom I assume are not top-tier (ie. not nation state level). </p>
<p>Linux/IRCTelnet is not based upon the popular Mirai IoT DDoS botnet software, but rather <a href="http://www.theregister.co.uk/2016/10/31/iot_botnet_wannabe/">Aidra code</a>. It does however leverage default passwords of IoT devices to gain control. It is just the easiest path at the moment. Attackers will evolve as that door closes, so don’t get too excited and think we can ‘solve’ IoT security with the elimination of default passwords. It is just one chess-move in a long game we are begrudgingly forced to play. Although this Linux bot is still new and small, it could hold potential for more directed attacks and highlights how malware writers are working to differentiate their attack code. </p>
<h2><strong>More targets will be explored.</strong> </h2>
<p>We are already seeing a broad diversity of different telecommunications, political, business, Internet infrastructure, and social sites being targeted. The latest is an attack against the internet access for the <a href="http://www.bbc.com/news/technology-37859678">country of Liberia</a>. Access to the web has been spotty for customers with attackers at times pushing over 600 Gb/s of data to choke the network. Most access is provided by the African Coast to Europe (ACE) undersea cable and these attacks could affect many other nations in West Africa who rely on this data pipeline. </p>
<h2><strong>What comes next?</strong> </h2>
<p>Expect many more entry-level botnets, which will eventually be supplanted by more professional malware. Thus far, most of the IoT botnets have been basic. This will change as more professional and well-funded players emerge. </p>
<h3>Look for the pro’s to do the following when they come into this space: </h3>
<ol>
<li>Patch/change-passwords of the victim IoT devices after infection, so others can’t take over their prey </li>
<li>Setup more sophisticated and concealed Command and Control (C2) structures to make it more difficult to track bot-herders or interfere with their control </li>
<li>Implement encrypted communications to the end-nodes, to conceal instructions, updates, and new targeting instructions </li>
<li>Begin exploiting OS/RTOS vulnerabilities on higher-end devices to gain more functionality and persistence </li>
<li>Begin siphoning data from IoT devices, which can be valuable for many different purposes, including extending attacks further into homes, businesses, and governments </li>
</ol>
<p><br></p>
<p>I predict the next phase of availability attacks will begin right around the time the industry reaches the tipping point in addressing the ‘default’ password weaknesses. Then confidentiality attacks, followed by integrity compromises will come. Brace for a long fight as IoT devices are <a href="https://www.linkedin.com/pulse/top-5-things-know-recent-iot-attacks-matthew-rosenquist">highly coveted by attackers</a>. This matchup should be exciting as it unfolds! </p>
<p><br></p>
<p><img src="https://img1.steemit.com/0x0/http://i.imgsafe.org/dd8bd8753d.gif" width="156" height="70"/></p>
<p>Interested in more? Follow me on <a href="https://twitter.com/Matt_Rosenquist">Twitter (@Matt_Rosenquist)</a> and <a href="https://www.linkedin.com/today/author/matthewrosenquist">LinkedIn</a> to hear insights and what is going on in cybersecurity.</p>
</html>
hiveblocks