quote:

---

This bot looks interesting, though, in that it doesn’t seem to target PCs (at least, not for recruiting as drones): instead, it targets routers and DSL modems, containing shellcode for a number of mipsel devices (that is, devices running on an architecture supported by some flavours of embedded linux), and including some wrinkles that would make it difficult for a home user to get back control of their router, even if they became aware of the problem.

This is by no means a brand-new idea: Nenolod* released a paper on the potential attack in 2006 (see link below), and I reviewed an interesting conference paper submission a year or so ago (unfortunately, I can’t remember the source, so I don’t know if it was accepted or published!) that covered similar ground from a more formal standpoint. And it’s far from the first attack to target devices that aren’t normally thought of as computers - one that springs to mind is a long-gone PostScript Trojan that could render some Apple printers to all intents and purposes unusable.

(This attack doesn’t make the device unusable - there’s no potential profit in that - but if it manages to take hold of your router/modem, it will try to lock you out so that you can’t easily remove it.)

However, the site estimates that somewhere in the region of 100,000 systems are affected (or were): if Dronebl is anywhere near the right ballpark, that looks like a serious exploration of the concept.

I suspect that it’s a concept (or a real attack) that we’ll see more of: for an attacker, it makes a lot of sense to use systems that the average home user never even thinks about, and that are available 24/7.

Now is probably the time to think about checking the device that connects your home PC to the world for weak username/password combinations.

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

---

said by EGeezer :

See »dronebl.org/blog/8
For more detail.

quote:

---

Disinfection Instructions

We have been getting asked a lot about disinfection instructions.

To disinfect, simply powercycle your device and take appropriate action to lock it down, including the latest firmware updates, and using a secure password.

---

said by Larry Seltzer :

---

Linux seems to be a great platform for these little embedded devices. It's small enough that it can fit in economical hardware, portable enough that you can put it on almost any processor and platform, and it's got great networking tools. This particular bot runs on Linux Mipsel devices ("Mipsel" is the port of Debian Linux on MIPS processors). But it's not hard to see the same thing happening to any sufficiently large population of Internet-facing devices based on Linux or any other platform. I'm especially curious about DVRs now.

The bot will not persist if the router is power-cycled, but who does that on purpose? I also wouldn't discount the possibility that such a bot could be built to flash itself into an EPROM or some other persistent memory, and then the device is probably unsalvageable. Such an attack would be highly model-specific.

The problem with routers is that they're "set and forget" devices. Often they're designed to just work out of the box with no configuration at all. Users won't change the default admin password, they won't check if security options are turned on, and the last thing they would ever do is check to see if there's a firmware upgrade that fixes a serious vulnerability in the router. Who even realizes that these things are little computers?

It's also easy to imagine a router botnet being built off of a Windows botnet. Once you have control of a system inside the network, it's easy to start probing the device at 192.168.1.1 (or, in fact, whatever the address of the local gateway device is) with the same sort of dictionary attack used by psyb0t. With some effort you could actually build a cross-platform bot with a standard series of interfaces.

The initial research shows that the psyb0t botnet has at least 100,000 nodes in it, and this is from devices, according to the reports, that don't have much presence in the West. This paper on the botnet discusses the hardware in more detail, including information about the vulnerabilities exploited in them. According to the paper:

Modems with similar hardware configurations (unknown brands) from Italy, Brazil, Ecuador, Russia, Ukraine, Turkey, Peru, Malaysia, Columbia, India and Egypt (and likely more countries) also seem to be affected, and are spreading the bot.

There are, and have been for many years, Linux-based embedded devices popular in the US and Europe and they must have their own vulnerabilities. I'm expecting malware authors to be inspired by this to build similar networks. Consider this list of Linux router or firewall distributions as a starting point.

What can you do for your own devices? Apply the latest firmware and make sure they have non-trivial admin passwords. And if there's an option for remote administration, make sure it's turned off.

---

quote:

---

The bot will not persist if the router is power-cycled, but who does that on purpose? I also wouldn't discount the possibility that such a bot could be built to flash itself into an EPROM or some other persistent memory, and then the device is probably unsalvageable. Such an attack would be highly model-specific.

---