Daily cyber threats and internet security news: network security, online safety and latest security alerts
March 24th, 2009

Stealthy Router-based Worm Breeds 100,000 Hosts Botnet

Security researchers have identified a sophisticated piece of malware that corrals consumer routers and DSL modems into a botnet.

The “psyb0t” worm is believed to be the first piece of malware to target home networking gear, according to researchers from DroneBL, which bills itself as a real-time monitor of abusable internet addresses. It has already infiltrated an estimated 100,000 hosts. It has been used to carry out distributed denial of service (DDoS) attacks and is also believed to use deep-packet inspection to harvest user names and passwords.

“This technique is one to be extremely concerned about because most end users will not know their network has been hacked, or that their router is exploited,” say DroneBL researchers. “This means that in the future, this could be an attack vector for the theft of personally identifying information. This technique is not going away.”

Vulnerable devices include any home router or modem that uses Linux Mipsel, has an administration interface, sshd, or telnet in a DMZ, and employs a weak password. Once the malware takes hold, it locks legitimate users out of the device by blocking telnet, sshd, and web access. It then makes the devices part of a botnet. The researchers said they first learned of the worm while investigating DDoS attacks that hit DroneBL’s infrastructure two weeks ago.

The worm also helps identify exploitable phyMyAdmin and MySQL servers. More information about psyb0t is available from research paper (PDF) published in January and DroneBL post.

Credit: The Register

Share this item with others:

More on CyberInsecure:
  • D-Link Routers Vulnerability Mass Scans
  • Mobile Malware Create A 100,000 Botnet On Symbian Series 60 Handsets
  • New Zlob Trojan Version Alters Wireless Router Settings And Hijacks DNS
  • Yahoo! Messenger Users Infected By New Worm, Form An IRC Botnet
  • Phishing Botnet Expands By SQL Injecting Websites Found In Google

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: Stealthy Router-based Worm Breeds 100,000 Hosts Botnet

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.