CyberInsecure.com

Stealthy Router-based Worm Breeds 100,000 Hosts Botnet

Security researchers have identified a sophisticated piece of malware that corrals consumer routers and DSL modems into a botnet.

The “psyb0t” worm is believed to be the first piece of malware to target home networking gear, according to researchers from DroneBL, which bills itself as a real-time monitor of abusable internet addresses. It has already infiltrated an estimated 100,000 hosts. It has been used to carry out distributed denial of service (DDoS) attacks and is also believed to use deep-packet inspection to harvest user names and passwords.

“This technique is one to be extremely concerned about because most end users will not know their network has been hacked, or that their router is exploited,” say DroneBL researchers. “This means that in the future, this could be an attack vector for the theft of personally identifying information. This technique is not going away.”

Vulnerable devices include any home router or modem that uses Linux Mipsel, has an administration interface, sshd, or telnet in a DMZ, and employs a weak password. Once the malware takes hold, it locks legitimate users out of the device by blocking telnet, sshd, and web access. It then makes the devices part of a botnet. The researchers said they first learned of the worm while investigating DDoS attacks that hit DroneBL’s infrastructure two weeks ago.

The worm also helps identify exploitable phyMyAdmin and MySQL servers. More information about psyb0t is available from research paper (PDF) published in January and DroneBL post.

Credit: The Register

Share this item with others:

Posted in Botnets, Data Theft, Hardware, Malware, Trojans & Worms, Vulnerabilities |  Print This Post