{"id":64205,"date":"2016-11-08T21:03:49","date_gmt":"2016-11-09T05:03:49","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=64205"},"modified":"2025-06-02T20:54:25","modified_gmt":"2025-06-03T03:54:25","slug":"more-capable-iot-botnets-to-emerge-as-the-pros-enter-the-fray","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/more-capable-iot-botnets-to-emerge-as-the-pros-enter-the-fray\/","title":{"rendered":"More Capable IoT Botnets to Emerge as the ‘Pros’ Enter the Fray"},"content":{"rendered":"

\"botnet1\"<\/a><\/p>\n

On the heels of severe distributed denial of service (DDoS) attacks, we see new botnets emerging that are powered by the Internet of Things (IoT). There are already hundreds of such botnets in the underground hacking ecosystem, from which services, code, and specific attacks can be purchased or acquired. New botnets are being developed to meet the growing demand and to circumvent anticipated security controls.<\/p>\n

The latest IoT botnet<\/strong><\/h2>\n

Researchers have spotted the new IoT botnet<\/a>\u00a0Linux\/IRCTelnet.\u00a0In just five days, it infected 3,500 devices<\/a> and features an old-school adaptation: using Internet relay chat (IRC) as the control structure. IRC is a very old technology based upon the original chat boards (before the World Wide Web). A\u00a0decade ago many of the first botnets used IRC. It is not particularly difficult for security software to combat, and thus represents a curious choice by the attackers, whom I assume are not top tier (certainly not at the level of nation-states).<\/p>\n

Linux\/IRCTelnet is not based upon the popular Mirai IoT DDoS botnet software, but rather on\u00a0Aidra code<\/a>. Linux\/IRCTelnet does, however, leverage the default passwords of IoT devices to gain control. It is the easiest path at the moment. Attackers will find other entries once that door closes, so do not imagine we can “solve” IoT security with the elimination of default passwords. It is just one chess move in a long game we are begrudgingly forced to play. Although this Linux bot is still new and small, it could hold the potential for more directed attacks and highlights how malware writers are working to differentiate their attack code.<\/p>\n

More targets will arise<\/strong><\/h2>\n

We already see a broad range of telecommunications, political, business, Internet infrastructure, and social sites being targeted. The latest is an attack against the national Internet access of\u00a0Liberia<\/a>. Access to the web has been spotty for customers, with attackers at times pushing more than 600Gb\/second of data to choke the network. Most access is provided by the African Coast to Europe undersea cable, and these attacks could affect many other nations in West Africa that rely on this data pipeline.<\/p>\n

What comes next?<\/strong><\/h2>\n

Expect more entry-level botnets, many of which will eventually be supplanted by more professional malware. Thus far, most of the IoT botnets have been basic. This will change as more professional and well-funded players emerge.<\/p>\n

Look for sophisticated attackers to do the following when they enter the fray:<\/p>\n