Criminals are exploiting critical flaws to corral Internet-of-things devices from two different manufacturers into botnets that wage distributed denial-of-service attacks, researchers said this week. Both DVRs from Lilin and storage devices from Zyxel are affected, and users should install updates as soon as possible.
Multiple attack groups are exploiting the Lilin DVR vulnerability to conscript them into DDoS botnets known as FBot, Chalubo, and Moobot, researchers from security firm Qihoo 360 said on Friday. The latter two botnets are spinoffs of Mirai, the botnet that used hundreds of thousand of IoT devices to bombard sites with record-setting amounts of junk traffic.
The DVR vulnerability stems from three flaws that allow attackers to remotely inject malicious commands into the device. The bugs are: (1) hard-coded login credentials present in the device, (2) command-injection flaws, and (3) arbitrary file reading weaknesses. The injected parameters affect the device capabilities for file transfer protocol, network time protocol, and the update mechanism for network time protocol.
Sometime in late last August, Qihoo 360 researchers started seeing attackers exploit the NTP update vector to infect devices with Chalubo. In January, the researchers saw attackers exploit the FTP and NTP flaws to spread FBot. That same month, Qihoo 360 reported the flaws to Lilin. Seven days after that, the researchers detected Moobot spreading through the use of the FTP vulnerability. Lilin fixed the flaws in mid-February with the release of firmware 2.0b60_20200207. The CVE designation used to track vulnerability is unknown.
Qihoo 360’s report came a day after researchers from security firm Palo Alto Networks reported that a recently fixed vulnerability in network attached storage devices from Zyxel was also under active exploit. Attackers were using the exploits to install yet another Mirai variant known as Mukashi, which was recently discovered. The pre-authentication command-injection flaw made it possible to execute commands on the devices. From there, the attackers were able to take over devices that used easily guessable passwords. The critical vulnerability received a severity rating of 9.8 out of a possible 10 because of the ease in exploiting it.
A Zyxel advisory lists more than 27 products that were affected by the vulnerability, which is tracked as CVE-2020-9054. A patch the manufacturer released fixed many of the devices, but 10 models were no longer supported. Zyxel recommended these unsupported devices no longer be directly connected to the Internet.
Lilin or Zyxel users affected by either of these vulnerabilities should install patches, when available for their devices. Devices that can’t be patched should be replaced with new ones. It’s also smart to place the devices—and as many as possible other IoT devices—behind network firewalls to make hacks harder. Operators frequently like the convenience of accessing these devices remotely, which makes locking them down harder. The well-earned reputation of IoT devices as buggy, insecure devices suggests that leaving IoT devices exposed to outside connections can put networks—and indeed the entire Internet—at risk.