New Mirai variant 'hijacked TalkTalk routers for botnet'

99% of the botnet routers belong to TalkTalk, says Imperva

Malware

Security researchers at Imperva yesterday said that a number of home routers have been hijacked by a new Mirai-based botnet, with 99% of them belonging to TalkTalk customers.

The attack appears to have taken advantage of a new TR-064 vulnerability, and researchers said this could be a "threat to customers of ISPs around the world".

TR-064 is a protocol adopted by most ISPs when remotely operating routers and uses port 7547 to receive remote commands.

Imperva said: "One such command is Time/SetNTPServers, used to synchronise a router with an external time source. However, this same command can also be modified to let hackers remotely execute bash commands."

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Although the security firm had not found any routers with open 7574 ports, it discovered that some ports had been left open until a few days ago.

All of the 2,398 attacking botnet devices were said to be located in the UK.

Imperva said: "This kind of IP distribution is uncommon for DDoS botnets. Typically it indicates a vulnerability in a device supplied by local retailers, which allows for such a regional botnet to appear".

The company had also found one of its clients, a Bitcoin company, had been hit by a series of GET and POST flood attacks on 5 December.

Imperva said it is hard to know for sure whether the malware that attacked these TalkTalk home routers was the same Mirai variant used in the Deutsche Telekom attack last week.

"The offenders' persistence, as well as its choice of targets, shows this to be a premeditated offensive- not the typical random burst launched from a rented DDoS-for-hire service," said the researchers.

Advertisement - Article continues below

According to Imperva, TalkTalk is aware of the attack and issued a fix for the TR-064 vulnerability and issued a fix for the vulnerability.

A TalkTalk spokeswoman said in a statement emailed to IT Pro: ""Along with other ISPs in the UK and abroad, we continue to take steps to review the potential impacts of the Mirai worm. A small number of customer routers were affected by this issue. We have made good progress repairing these and continue to deploy additional network-level controls to further protect our customers."

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/malware/33080/hackers-abuse-linkedin-dms-to-plant-malware
malware

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Visit/security/malware/28083/the-five-best-free-malware-removal-tools
Security

Best free malware removal tools 2019

23 Dec 2019
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/operating-systems/microsoft-windows/354526/memes-and-viking-funerals-the-internet-reacts-to-the
Microsoft Windows

Memes and Viking funerals: The internet reacts to the death of Windows 7

14 Jan 2020
Visit/hardware/laptops/354533/dell-xps-13-new-9300-hands-on-review-chasing-perfection
Laptops

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020