New Mirai variant 'hijacked TalkTalk routers for botnet'

99% of the botnet routers belong to TalkTalk, says Imperva


Security researchers at Imperva yesterday said that a number of home routers have been hijacked by a new Mirai-based botnet, with 99% of them belonging to TalkTalk customers.

The attack appears to have taken advantage of a new TR-064 vulnerability, and researchers said this could be a "threat to customers of ISPs around the world".

Advertisement - Article continues below

TR-064 is a protocol adopted by most ISPs when remotely operating routers and uses port 7547 to receive remote commands.

Imperva said: "One such command is Time/SetNTPServers, used to synchronise a router with an external time source. However, this same command can also be modified to let hackers remotely execute bash commands."

Although the security firm had not found any routers with open 7574 ports, it discovered that some ports had been left open until a few days ago.

All of the 2,398 attacking botnet devices were said to be located in the UK.

Imperva said: "This kind of IP distribution is uncommon for DDoS botnets. Typically it indicates a vulnerability in a device supplied by local retailers, which allows for such a regional botnet to appear".

The company had also found one of its clients, a Bitcoin company, had been hit by a series of GET and POST flood attacks on 5 December.

Advertisement - Article continues below
Advertisement - Article continues below

Imperva said it is hard to know for sure whether the malware that attacked these TalkTalk home routers was the same Mirai variant used in the Deutsche Telekom attack last week.

"The offenders' persistence, as well as its choice of targets, shows this to be a premeditated offensive- not the typical random burst launched from a rented DDoS-for-hire service," said the researchers.

According to Imperva, TalkTalk is aware of the attack and issued a fix for the TR-064 vulnerability and issued a fix for the vulnerability.

A TalkTalk spokeswoman said in a statement emailed to IT Pro: ""Along with other ISPs in the UK and abroad, we continue to take steps to review the potential impacts of the Mirai worm. A small number of customer routers were affected by this issue. We have made good progress repairing these and continue to deploy additional network-level controls to further protect our customers."

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now



AnarchyGrabber hack steals Discord tokens, IDs and passwords

27 May 2020

Scammers leverage contact-tracing in hacking attempt

27 May 2020

GitLab phished its employees and 20% handed over credentials

26 May 2020
cyber security

Governments urged to work together to stop health care cyber attacks

26 May 2020

Most Popular

Microsoft Windows

Microsoft's latest Windows 10 update is causing yet more issues

26 May 2020

Nokia breaks 5G record with speeds nearing 5Gbps

20 May 2020
Network & Internet

Intel releases Wi-Fi and Bluetooth driver updates for Windows 10

26 May 2020