Just a year after Mirai malware held the world to ransom when it enslaved millions of IoT devices into a botnet network which cyber-criminals used in launching massive DDoS attacks -- disrupting several internet services around the world. Security researchers however, warns that last year occurrence might repeat itself. Spotted first in September by security researchers at QIhoo 360, the new malware which is dubbed "IoT_reaper", doesn't depend cracking weak passwords in IoT devices to enslave them into botnet network but instead exploits for vulnerablities.
Also Read: The Mirai threat: How Hackers could shut off 23 Countries access to the internet
The malware attempts to exploit several vulnerablities commonly found in different IoT devices. Targeted manufactures includes: D-link, TP-Link, AVTECH, NETGEAR, MikroTik, JAWS, GoAheada, Vacron, Synology and others.
Researchers believe that IoT_reaper malware has infected nearly 2 million devices with an infection rate of 10,000 new devices per day.
A check carried out by CheckPoint on an infected GoAhead device revealed that the attackers accessed the System.ini file to check for compromise. Normally, the System.ini file is contains the credentials of the user, but on the hacked device it contained a 'Netcat' command that opens a reverse shell to the attackers IP instead!
The check revealed that he GoAhead device which was infected using the CVE-2017-8225 vulnerability, was actually transmitting the malware after being infected. This actually explains the fast rate in which the malware is spreading.
As of now, those behind this are still unknown but one thing that is clear here is that the actors are preparing for a massive global attack.
Researchers at CheckPoint also warned of the forth coming attack;
"Our researcher suggests we are now experiencing the calm before an even more powerful storm. The next cyber hurricane is about to come."
A London court has sentenced a 30-year-old Brit hacker to 32 months in prison for a DDoS attack against a telecom service in Liberia which resulted in the loss of tens of millions of dollars.
According to Securityweek, Daniel Kaye was hired by an employee of a rival telecom firm to launch a distributed denial-of-service attack (DDoS) on Liberian phone and Internet service provider Lonestar.
You might be wondering what a DDoS attack is. Well, a DDoS or distributed denial-of-service attack is a malicious attempt to disrupt normal traffic of a targeted service, server or network by flooding it with junk Internet traffic to a point where the sasaran can't accommodate the traffic and then crashes or fails.
The attack happened in 2016 when the dreaded Mirai source code was released in the Darkweb. Shortly after the release of the source code, several top websites and online services around the world went under attack, and at a stage almost half of the world Internet laid in the dark.
Also Read: The Mirai threat: How Hackers could shut off 23 Countries access to the Internet
Britain's National Crime Agency said the attack overwhelmed Lonestar's computer network and as a result knocked it out. Not only did the attack disabled Internet service across the West African country, the company also loss tens of millions dollars.
Mike Hulett of the crime agency's National Cyber Crime Unit described Kaye as "a highly skilled and capable hacker-for-hire."
Last month, Kaye pleaded to two offenses under the Computer Misuse Act and one charge possessing criminal property.
Judge Alexander Milne handed down the prison sentence on Friday at London's Blackfriars Crown Court.
Killer of the WannaCry ransomware has been arrested by the FBI in the U.S. for allegedly creating a banking malware that steals password and user credentials.
The hacker, Marcus Hutchins who owns the twitter handle, MalwareTech was arrested this week in Nevada where he was about to board a plane back to the UK after attending the Black Hat and Def Con conference. The FBI who have been on Hutchins trail for the past two years, arrested him for his alleged role in the spread of the Kronos banking malware which wrecked havoc between July 2014 and July 2015.
Also Read: The Mirai threat: How Hackers could shut off 23 Countries access to the internet
According to an indicting PDF, Hutchins and an unknown conspirator created and distributed the trojan on the now shuttered AlphaBay marketplace. The Kronos was mostly distributed using phishing emails and would lead unsuspecting computers users to fraudulent websites that was designed to look legit like real banking institutions. This trojan would then steal the victims bank credentials.
