[ISN] Worm breeds botnet from home routers, modems

From: InfoSec News <alerts_at_private>
Date: Tue, 24 Mar 2009 02:34:06 -0600 (CST)

By Dan Goodin in San Francisco
The Register
24th March 2009

Security researchers have identified a sophisticated piece of malware 
that corals consumer routers and DSL modems into a lethal botnet.

The "psyb0t" worm is believed to be the first piece of malware to target 
home networking gear, according to researchers from DroneBL, which bills 
itself as a real-time monitor of abusable internet addresses. It has 
already infiltrated an estimated 100,000 hosts. It has been used to 
carry out DDoS, or distributed denial of service, attacks and is also 
believed to use deep-packet inspection to harvest user names and 

"This technique is one to be extremely concerned about because most end 
users will not know their network has been hacked, or that their router 
is exploited," the DroneBL researchers wrote here. "This means that in 
the future, this could be an attack vector for the theft of personally 
identifying information. This technique is not going away."

Vulnerable devices include any home router or modem that uses Linux 
Mipsel, has an administration interface, sshd, or telnet in a DMZ, and 
employs a weak password. Once the malware takes hold, it locks 
legitimate users out of the device by blocking telnet, sshd, and web 
access. It then makes the devices part of a botnet. The researchers said 
they first learned of the worm while investigating DDoS attacks that hit 
DroneBL's infrastructure two weeks ago.


Best Selling Security Books and More!
Received on Tue Mar 24 2009 - 01:34:06 PDT

This archive was generated by hypermail 2.2.0 : Tue Mar 24 2009 - 01:38:23 PDT