Users can now check whether their network is exposed to Mirai, one of the most prolific botnets to have targeted Internet of Things (IoT) devices this year.
The botnet was initially detailed in early September, but it became more popular in early October when its author released the source code online. The malware, designed to harness the power of insecure IoT devices to launch distributed denial of service (DDoS) attacks, had been previously used in massive incidents targeting Brian Krebs’ blog and hosting provider OVH.
With the primary purpose of IoT botnets being DDoS attacks, it’s no wonder that Akamai said that Mirai wasn’t alone in the 665 gigabits per second (Gbps) attempt to take down Krebs. However, security researchers reported that Mirai was increasingly used in DDoS incidents following the source code leak.
One such Mirai attack targeted DNS provider Dyn and disrupted popular websites such as Twitter, Etsy, GitHub, Soundcloud, PagerDuty, Spotify, Shopify, Airbnb, Intercom and Heroku. With infected devices in 164 countries and the use of Internet protocols that aren’t usually associated with DDoS attacks, such as STOMP floods, Mirai continues to wreak havoc.
Because Mirai’s success is fueled by the existence of IoT devices that aren’t properly secured, it could be easily countered by simply changing the default credentials on vulnerable devices and by closing the Telnet port the botnet uses for infection. That, however, is an operation that users and network admins need to perform, but they might not always be aware of such an issue impacting them.
To help users determine whether their network is exposed to Mirai or not, IoT Defense Inc., a startup company based in the Washington DC Metro area, launched a web scanner that does exactly that: it searches for opened TCP ports and informs users whether they are safe or not.
The IoT Defense scanner was written using a combination of Python, Node JS and Jade frameworks and scans for nearly a dozen ports that botnets can exploit. Accessing and using the scanner is free and little instructions are needed, as it does all with a simple click of a button.
The tool was designed to scan for ports such as File Transfer Protocol (FTP), Secure Shell (SSH), Telnet (both 23 and the alternative 2323), HTTP, HTTPS, Microsoft-SQL-Server, EtherNet/IP, Telnet (alternative), Microsoft Remote Desktop Protocol (RDP), Web Proxy, and Apache Tomcat SSL (HTTPS).
While not all of these ports are targeted by Mirai, a couple is, with the 2323 Telnet port being specifically attacked. The IoT botnet scans the Internet for exposed IoT devices such as routers, IP cameras, and DVRs, and, when it finds vulnerable devices, it attempts to log into them using a list of default login credentials.
This, however, is a behaviour employed by other botnets as well. What’s more, while disinfecting a device compromised by Mirai is very easy, because a simple reboot would suffice, keeping the malware away from that device is more complicated. Because of constant scans, vulnerable IoT products are re-infected within minutes.
Device vendors are those who need to take action because users rarely do so T. Roy, CEO, IoT Defense, told SecurityWeek via email. They should add in-field auto-updates to their devices, should use per-device unique passwords (something that router manufacturers have already started implementing), and should not open up unnecessary ports.
Because their incentives are not aligned with device vendors, it’s clear that users might not be the ones to fix this issue. Users might not care – provided that they are aware of an issue – that their routers, IP cameras, or DVRs are used to DDoS websites and DNS providers. As long as the bandwidth usage doesn’t affect them, they are not disadvantaged, and T. Roy believes that one solution would be for ISPs to impose bandwidth caps.
A set of rules to impose stricter security of IoT devices would also be of help, and steps in this direction are already being taken, with the Department of Homeland Security (DHS) publishing its Strategic Principles for Securing the Internet of Things. The document includes six non-binding principles designed to provide security across the design, manufacturing and deployment of connected devices.
IoT Defense’s CEO also notes that IoT vendors need to have a servicing model in place, to resolve vulnerabilities in their devices when they are discovered. Just as it happens with many other products, vendors would be given a window to resolve the found issues or face consequences. However, he isn’t very optimistic about vendors actually taking the stance.
“As of today, IoT device manufacturers have very little to show for security which always gets trumped by new features and time or market concerns. It is wishful thinking to expect device vendors to step up their game and make security and privacy key differentiators for their products,” T. Roy said.
Last year, Gartner said that the number of connected devices will grow above the 20 billion mark by 2020. Now, Juniper Research estimates that there will be 38.5 billion connected IoT devices by that year and that 70% of these units are expected to be non-consumer devices. Should the level of insecurity within these devices remain the same, the consequences will be dire for consumers, enterprises, and vendors alike.
