Software fix for Mirai-infected IoT devices 'fails'

Update to stop DDoS malware can be circumvented, security researchers find

Efforts by an IoT manufacturer to prevent DVRs and other devices becoming infected by the Mirai bot have been largely in vain, according to a security researcher.

In fact, Chinese firm XiongMai did a "terrible job" of trying to patch bugs that opened devices up to the botnet malware, according to a blog post by Tony Gee, information security consultant at Pen Test Partners.

Mirai made waves last year when it brought down Dyn, a domain name system provider that helped users navigate to several huge sites including Twitter and Github. It was later open sourced, and variants sprang up, leading to a 54-hour DDoS storm against a US university that may have exploited open telnet (23) ports and TR-069 (7547) ports to hijack CCTV cameras, DVRs and routers to launch the attack.

Gee said Pen Test Partners had brought several of XiongMai's Floureon DVRs for its demo at the Infosecurity Europe Show last month. These devices didn't have telnet open on TCP/23, which was a security improvement, but it turned out that closing down telnet access wasn't enough.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Gee simply used ncat to connect to port 9527 instead. He found that the passwords were the same as the web interface (defaults: usually admin/blank, admin/123456 or similar) and that a command shell could be opened.

From here, Gee then managed to open up a basic Linux shell that gave anyone accessing root permissions. This meant it was relatively straightforward to re-enable telnet.

"So for any new devices that have telnet now disabled, try the shell and then just start the telnet daemon. And we have Mirai all over again," said Gee.

Gee added that the version of embedded Linux tool Busybox installed in most XiongMai DVRs is very limited. "That's why we think BrickerBot didn't really work," he said. BrickerBot is the botnet that permanently disables poorly secured Internet of Things devices before they become part of the Mirai botnet. 

Metasploit and a BusyBox module were then used to jailbreak from a restricted shell to gain fuller access to the device. Gee could then use Metasploit to enumerate hosts on the network the device is attached to.

"The Metasploit module set also includes a basic wget and exec module to execute basic ASH shell scripts so there is no reason you couldn't write your own code and have it execute in a much more targeted way than Mirai did," said Gee.

Advertisement - Article continues below

He said that it wouldn't take much for hackers to re-enable the Mirai DDoS issue. All hackers would need to do was search for suitable DVRs using IoT device search engine Shodan, connect to these devices, re-enable telnet and use credentials from the Mirai source code to create a botnet.

"XiongMai needs to go back and start again with their software fix," he said.

Gee added that it wouldn't "take much to write self-propagating code to reverse the effect of BrickerBot - not that we think BrickerBot actually worked as intended on most of the DVRs we have seen."

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/business-strategy/mergers-and-acquisitions/354602/xerox-to-nominate-directors-to-hps-board-reports
mergers and acquisitions

Xerox to nominate directors to HP's board – reports

22 Jan 2020
Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020