Brace yourselves—source code powering potent IoT DDoSes just went public:
Both Mirai and Bashlight exploit the same IoT vulnerabilities, mostly or almost exclusively involving weakness involving the telnet remote connection protocol in devices running a form of embedded Linux known as BusyBox. But unlike Bashlight, the newer Mirai botnet software encrypts traffic passing between the infected devices and the command and control servers that feed them instructions. That makes it much harder for researchers to monitor the malicious network. There’s also evidence that Mirai is able to seize control of Bashlight-infected devices and possibly even patch them so they can never be infected again by a rival botnet. About 80,000 of the 963,000 Bashlight devices now belong to Mirai operators, Drew said.
Next time you see a vendor sell you something that can be connected to the Internet, be sure to ask:
- How long will you be providing support for this product?
- How will you be pushing security updates to this product?
- What mitigation strategies have you implemented to ensure that a third-party doesn’t take control of this product?
- What will you do to help me when this device is compromised because of a vulnerability in this product?
I can almost guarantee that whomever is selling the product will either look at you slackjawed or try to use buzzwords to indicate the product is secure. But they will almost certainly be unable to genuinely answer the questions because vendors are not securing their devices. It’s their failures which are have created the current generation of threats that the global Internet is just now starting to grapple with.
Excited Pixels 