Book Proposal Form Archives Catalog Auerbach Publications Book Proposal Form Catalog

Information Security Today Home

New Books

Malicious Bots: An Inside Look into the Cyber-Criminal Underground of the Internet by Ken Dunham and Jim Melnick; ISBN 9781420069037
Asset Protection through Security Awareness by Tyler Justin Speed; ISBN 9781439809822
Data Mining Tools for Malware Detection by Mehedy Masud, Latifur Khan, and Bhavani Thuraisingham; ISBN 9781439854549
Android Malware and Analysis by Ken Dunham, Shane Hartman, Manu Quintans, Jose Andre Morales, and Tim Strazzere; ISBN 9781482252194
Enterprise Level Security: Securing Information Systems in an Uncertain World by William R. Simpson; ISBN 9781498764452
Honeypots and Routers: Collecting Internet Attacks by Mohssen Mohammed and Habib-ur Rehman; ISBN 9781498702195

Mirai Goes Open Source and Morphs into Persirai

Robert Hamilton

The Mirai malware has become notorious for recruiting IoT devices to form botnets that have launched some of the largest distributed denial of service (DDoS) attacks we have recorded. Mirai came onto the scene in late-2016 as the malware behind very large DDoS attacks, including a 650 Mbps attack on the Krebs on Security site. It is also purported to have been the basis of the attack in October 2016 that brought down many sites including Twitter, Netflix, and Airbnb. Since then, Mirai has morphed into an even more aggressive and effective botnet tool.

When the research team at Imperva went into the Incapsula logs after the Krebs attacks last fall, they found that indeed the Mirai botnet had been active well before the notorious September attack. Imperva discovered a botnet of nearly 50,000 Mirai-infected devices spread over 164 countries with the top infected countries Vietnam, Brazil and the United States. But even before Mirai became public, the Imperva team saw vulnerable IoT devices as a problem in the making.

Back in 2014, Imperva started seeing a massive increase in the number of weekly unique DDoS bot sessions and < a href="https://www.incapsula.com/blog/wp-content/uploads/2015/08/2013-14_ddos_threat_landscape.pdf" target="blank">identified CCTV surveillance devices as a contributing factor, most of which were open to easily guessable default passwords. In 2015, < a href="https://www.incapsula.com/blog/cctv-ddos-botnet-back-yard.html" target="blank">Imperva discovered a botnet executing HTTP GET flood DDoS attacks that peaked around 20,000 requests per second from 900 CCTV cameras throughout the globe. The Imperva research foreshadowed the targeting of IoT devices as a new and plentiful source of botnets.

It was after Mirai was publically announced on Hack Forums in October that Impervaís IoT prediction gained energy. Like legitimate source code, Mirai has seen a number of improvements since its release. Miraiís focus on effectiveness at aggressively recruiting some of the most vulnerable IoT devices has made it a popular choice for hackers that want to create very large botnets.

Only weeks after the release of the original Mirai source code, Imperva documented a new variant that was found to be responsible for exploiting a newly discovered TR-069 vulnerability on wireless routers. To make the malware even more effective, the authors added the ability to close the vulnerability after the router was infected making it more difficult to update the devices remotely until they could be rebooted.

In March, Imperva Incapsula mitigated a Mirai-based attack that indicated the malware had mutated yet again. Before this attack, it appeared as though the Mirai botnet DDoS attacks focused on launching network layer DDoS attacks, which try to flood the network pipes forcing web traffic to slow to a crawl. This new attack saw a Mirai botnet launch an application layer attack on a U.S. college website that lasted over 54 hours. In total, the attack generated over 2.8 billion requests. What is interesting about Mirai's ability to launch application layer attacks is that it takes far fewer bots to bring a website down through an application attack. In this case, it took fewer than 10,000 infected IP cameras, DVRs and routers to launch a sizeable attack.

This brings us to Persirai, the newest version of Mirai that was discovered last month by researchers at Trend Micro and comes equipped with even more advanced features. Previous versions of Mirai used to rely on guessing default passwords, so any IoT devices that had default passwords changed were considered protected. Researchers discovered that Persirai became even more aggressive by exploiting a zero-day vulnerability to steal the password file from an IP camera regardless of password strength. Persiraiís ability to leverage the previous features, plus its password stealing capability has led to a substantial increase in the number of infected devices.

Persirai is on an aggressive recruitment push. Within a month after being released, Persirai has come to dominate the Mirai-variant infected devices with over 64 percent of all infections. Particularly alarming is the password stealing feature of the new Persirai variant which renders previous recommendations about simply updating passwords outdated. While a Persirai-infected device is not likely to malfunction, no organization wants to host a battalion of DDoS foot-soldiers. Additional measures to ensure IoT devices do not become unwitting members of a Persirai botnet include blocking internet access to admin ports and disabling universal plug and play (UPnP) on the router or firewall. Also consider isolating IoT devices on your network using segmentation or firewall policies and only let IoT devices communicate with IP addresses that are approved. To avoid being the victim of a DDoS attack regardless of the botnet, consider subscribing to a DDoS mitigation service.

Related Reading

25 Years of DDoS

IoT Threats Underline the Need for Modern DDoS Defense

About the Author

Robert Hamilton is the Director of Product Marketing for the Incapsula service at Imperva. Incapsula is a cloud-based application delivery service that protects websites and increases their performance, improving end user experiences and safeguarding web applications and their data from attack.


 
Subscribe to
Information Security Today







Bookmark and Share


© Copyright 2017 Auerbach Publications