New Mirai variant 'hijacked TalkTalk routers for botnet'
99% of the botnet routers belong to TalkTalk, says Imperva
Security researchers at Imperva yesterday said that a number of home routers have been hijacked by a new Mirai-based botnet, with 99% of them belonging to TalkTalk customers.
The attack appears to have taken advantage of a new TR-064 vulnerability, and researchers said this could be a "threat to customers of ISPs around the world".
TR-064 is a protocol adopted by most ISPs when remotely operating routers and uses port 7547 to receive remote commands.
Imperva said: "One such command is Time/SetNTPServers, used to synchronise a router with an external time source. However, this same command can also be modified to let hackers remotely execute bash commands."
Although the security firm had not found any routers with open 7574 ports, it discovered that some ports had been left open until a few days ago.
All of the 2,398 attacking botnet devices were said to be located in the UK.
Imperva said: "This kind of IP distribution is uncommon for DDoS botnets. Typically it indicates a vulnerability in a device supplied by local retailers, which allows for such a regional botnet to appear".
The company had also found one of its clients, a Bitcoin company, had been hit by a series of GET and POST flood attacks on 5 December.
Imperva said it is hard to know for sure whether the malware that attacked these TalkTalk home routers was the same Mirai variant used in the Deutsche Telekom attack last week.
"The offenders' persistence, as well as its choice of targets, shows this to be a premeditated offensive- not the typical random burst launched from a rented DDoS-for-hire service," said the researchers.
According to Imperva, TalkTalk is aware of the attack and issued a fix for the TR-064 vulnerability and issued a fix for the vulnerability.
A TalkTalk spokeswoman said in a statement emailed to IT Pro: ""Along with other ISPs in the UK and abroad, we continue to take steps to review the potential impacts of the Mirai worm. A small number of customer routers were affected by this issue. We have made good progress repairing these and continue to deploy additional network-level controls to further protect our customers."
What you need to know about migrating to SAP S/4HANA
Factors to assess how and when to begin migrationDownload now
Your enterprise cloud solutions guide
Infrastructure designed to meet your company's IT needs for next-generation cloud applicationsDownload now
Testing for compliance just became easier
How you can use technology to ensure compliance in your organisationDownload now
Best practices for implementing security awareness training
How to develop a security awareness programme that will actually change behaviourDownload now