InfectedSlurs Botnet Launches DDos Swarm 

DDoS swarm, factory reset, InfectedSlurs, Mirai, Ophtek, password change, update firmware, zero-day vulnerabilities, , , , , , ,
06
Feb 2024

Based upon the Mirai botnet, a new botnet has emerged onto the digital landscape in the form of InfectedSlurs, and it’s helping to fuel DDoS attacks.  

Once again, the cause of infection behind InfectedSlurs attack are a number of zero-day vulnerabilities. These vulnerabilities – now identified as CVE-2023-49897 and CVE-2023-47565 – allowed InfectedSlurs to compromise both a series of WiFi routers and a QNAP network video recorder. The potential for data loss here is huge, but InfectedSlurs also makes sure that it hijacks infected devices and integrates them into a huge DDoS swarm. 

The InfectedSlurs Attack 

It’s believed that the attack by InfectedSlurs involved vulnerabilities which should have been addressed by firmware updates released several years ago. However, many organizations appear to still be using legacy versions of the QNAP software. And this is what’s allowed them to be compromised. It’s also been revealed that InfectedSlurs has been running in the digital wild since late 2022, so it’s had close to a year to take advantage of legacy versions. 

A security patch was launched at the start of December 2023, to provide the strongest possible protection, and users were told to perform a factory reset alongside a password change. Users have also been advised to initiate a firmware update, found within the network video recorder settings, to ensure they have the latest and most secure version in place. Again, it’s been recommended that all passwords and access privileges are verified. 

However, for the older, legacy devices which are in their end-of-life phase, there will be no further firmware updates released. In these instances, users have no alternative but to replace their devices with the latest models, which will be fully patched against all known threats. 

How Can You Prevent These Attacks? 

There are two big takeaways from the InfectedSlurs attack: 

  1. Always install software updates as soon as possible 
  1. Replace legacy devices when they have reached their end-of-life phase 

Both these points are easy to implement, but the evidence of the InfectedSlurs attack proves this is not always undertaken by organizations. However, to protect the security of your IT infrastructure, it’s crucial that this is given priority. 

InfectedSlurs was also able to execute its attack for close to a year without being detected, so what else should you be looking out for? Well, the following signs may indicate that you have fallen victim to an attack: 

  • Slow performance: one of the telltale signs of being involved in a DDoS attack is a drop in performance from the infected PC. This is because all the processing power is diverted away from the PC’s day-to-day operations and dedicated to supporting the DDoS attack. Therefore, if your PCs are running slow, and you can’t pinpoint the cause to hardware issues, there’s a chance they may have become involved in a DDoS attack. 
     
  • Unusual server patterns: if your PCs have been integrated into a DDoS swarm, it’s likely this will result in abnormal spikes in traffic related to your server. This is because DDoS attacks usually involve high volumes of traffic from multiple sources at once. So, if your server logs indicate behavior such as this, it’s important you investigate immediately to identify if the cause is known. 

For more ways to secure and optimize your business technology, contact your local IT professionals. 

Read More

The IoT Reaper Botnet Predicts a Grim Future

Cyber Attack, Internet of things, IOT, malware, Mirai, Reaper, Security, Security Threats, , , , , ,
13
Feb 2018

With Internet of Things (IoT) devices becoming more prolific at work, their security risks are increasing. In particular, botnets are posing a major threat.

Botnets have been associated with hacking since the start of the 21st century and don’t show any signs of disappearing soon. Therefore, it’s no surprise that hackers are adopting these services into their attacks on IoT devices. The aim of a botnet is to create a huge network of infected computers connected to the internet to carry out DDoS attacks, spam campaigns and steal data. And, with the proliferation of unsecured IoT devices now online, it’s not hard to see why they’re so attractive to hackers.

One botnet which has been creating a few headlines recently is Reaper, so it’s a good place to start understanding their method of operation and how you can protect yourself.

The IoT Reaper Comes to Town

IoT devices, partly due to their recent emergence, aren’t exactly the most safe and secure devices to be connecting to your organization’s network. Sure, many of them are safe, but there are so many reports of devices being released with vulnerabilities in their code, a lack of firmware updates and default password exploitation issues. Accordingly, the warnings attributed to IoT devices need to be taken seriously. And when it comes to botnets such as Reaper, you can begin to understand why.

The Mirai botnet was the first big hack which took advantage of shortfalls in IoT security and its legacy is Reaper. Evolving the operation and build of Mirai (Reaper even shares some code with it), Reaper is a more sophisticated piece of malware. Mirai’s approach was to act purely as a password cracker, but Reaper is taking nine different approaches to exploit known vulnerabilities in devices manufactured by Linksys, GoAhead and NetGear to name but a few.

Reaper has the potential to create a huge botnet army and, with its myriad infection methods, could carry this out with much more ease than Mirai ever managed. Security researchers Checkpoint even estimate that around one million networks have been scanned in order to begin recruiting vulnerable devices. Reaper is also built to ensure that it can receive regular updates through new script updates and indicates a potential for the malware to be regularly strengthened.

Thankfully, the number of recruited bots has remained relatively low compared to initial estimates with around 10,000 to 20,000 drones being active at any one time. Experts suspect this may be down to poor coding, but with the potential for new updates to be patched into the malware, this could be rectified very quickly. A further benefit to consumers is that the hardware providers being targerted are tight on security and regularly issue firmware updates.

Keeping the Reaper at Bay

Allowing automatic firmware updates – and regularly checking manufacturers’ websites/social media for security updates – is paramount to keeping your organization’s IoT devices secure. Not only can botnets launch global attacks on computer networks, but they can also slow down individual devices and render them redundant.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More