IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

New Mirai variant 'hijacked TalkTalk routers for botnet'

99% of the botnet routers belong to TalkTalk, says Imperva

Malware

Security researchers at Imperva yesterday said that a number of home routers have been hijacked by a new Mirai-based botnet, with 99% of them belonging to TalkTalk customers.

The attack appears to have taken advantage of a new TR-064 vulnerability, and researchers said this could be a "threat to customers of ISPs around the world".

TR-064 is a protocol adopted by most ISPs when remotely operating routers and uses port 7547 to receive remote commands.

Imperva said: "One such command is Time/SetNTPServers, used to synchronise a router with an external time source. However, this same command can also be modified to let hackers remotely execute bash commands."

Although the security firm had not found any routers with open 7574 ports, it discovered that some ports had been left open until a few days ago.

All of the 2,398 attacking botnet devices were said to be located in the UK.

Imperva said: "This kind of IP distribution is uncommon for DDoS botnets. Typically it indicates a vulnerability in a device supplied by local retailers, which allows for such a regional botnet to appear".

The company had also found one of its clients, a Bitcoin company, had been hit by a series of GET and POST flood attacks on 5 December.

Imperva said it is hard to know for sure whether the malware that attacked these TalkTalk home routers was the same Mirai variant used in the Deutsche Telekom attack last week.

"The offenders' persistence, as well as its choice of targets, shows this to be a premeditated offensive- not the typical random burst launched from a rented DDoS-for-hire service," said the researchers.

According to Imperva, TalkTalk is aware of the attack and issued a fix for the TR-064 vulnerability and issued a fix for the vulnerability.

A TalkTalk spokeswoman said in a statement emailed to IT Pro: ""Along with other ISPs in the UK and abroad, we continue to take steps to review the potential impacts of the Mirai worm. A small number of customer routers were affected by this issue. We have made good progress repairing these and continue to deploy additional network-level controls to further protect our customers."

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

RATDispenser evades nine in ten anti-virus engines
Security

RATDispenser evades nine in ten anti-virus engines

24 Nov 2021
Hackers use Linux backdoor on compromised e-commerce sites with software skimmer
malware

Hackers use Linux backdoor on compromised e-commerce sites with software skimmer

19 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021
Millions of routers and NAS devices vulnerable to BotenaGo malware
malware

Millions of routers and NAS devices vulnerable to BotenaGo malware

12 Nov 2021

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
Attracting and retaining talent through training
Sponsored

Attracting and retaining talent through training

13 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022