Back in 2016, a collection of hijacked IoT gadgets have made much of the internet inaccessible. The time has shown that zombie connected-device armies can indeed disrupt the web.
Researchers at the Chinese security firm Qihoo 360 and the Israeli firm Check Point, have discovered another botnet threat, known as the Reaper.
The researchers pointed out that the IoT botnet was built on portions of Mirai’s code, a malware that infected DynDNS. But it has one major difference: instead of merely guessing the passwords of the devices it infects, it uses known security flaws in the code of those insecure machines, hacking in with an array of compromise tools and then spreading itself further.
The malware focuses on exploiting IoT device vulnerabilities. So, Qihoo 360 named it IoT_reaper.
"The main differentiator here is that while Mirai was only exploiting devices with default credentials, this new botnet is exploiting numerous vulnerabilities in different IoT devices. The potential here is even bigger than what Mirai had," said Maya Horowitz, the manager of Check Point’s research team. "With this version it’s much easier to recruit into this army of devices."
The improvement of how it works, could potentially make damage even bigger than Mirai's.
"Currently, this botnet is still in its early stages of expansion," wrote a Qihoo 360 researcher. "But the author is actively modifying the code, which deserves our vigilance."
Qihoo 360 noticed that 9 IoT vulnerability exploits have been integrated into the samples. They include: D-Link, GoAhead, JAWS, Netgear, Vacron, Netgear, Linksys, dlink and AVTech. While many of them have patches available, most consumers aren't yet updating them.
Check Point discovered that 60 percent of the networks it tracked have been infected with the Reaper malware. Qihoo 360's researchers on the other hand, said that some 10,000 devices in the botnet communicate daily with the command-and-control server the hackers control, with millions of devices were "queued" in the hackers' code.
Initially, no DDoS attack command was found.
