Pierluigi Paganini November 19, 2016

The popular security expert Robert Graham, CEO of Errata Security, has explained how the Mirai botnet could hack a security camera in a few seconds.

The recent string of attacks powered with the Mirai botnet has demonstrated to the security industry the potential effects of DDoS attacks on the global Internet backbone.

Experts who investigated the threat confirmed that the Mirai botnet is composed of hundred thousand compromised IoT devices, such as CCTVs and DVRs.

This week, Robert Graham, CEO of Errata Security, has explained how the Mirai botnet could hack a security camera. Graham used a $55 JideTech security camera that was behind a Raspberry Pi router that the experts configured to isolate the surveillance device from his home network.

14/x: so after it loads the first stage Mirai, it then connects out to download the full virus, like from here:
http://89.248.172.173/arm pic.twitter.com/ntTxsNnm1i

— Rob Graham ? (@ErrataRob) 18 novembre 2016

“I’m setting up a little test network for IoT devices, one isolated a bit from my home network. This is a perfect job for a computer like the Raspberry Pi (or similar computers, such as the Odroid-C2, which is what I’m actually using here)” wrote Graham in a blog post.

Graham published a series of Twitter posts to document his experiment, he confirmed that his camera was compromised by the Mirai botnet in just 98 seconds.

“Actually, it took 98 seconds for first infection” wrote the expert.

The IoT malware runs a brute force password attack via telnet using a list of 61 default credentials to gain access to the target device.

Once the Mirai component gains access to the target IoT device, it connects out to download the full virus and runs it. Then it starts sending out SYN packets at a high rate of speed, looking for other potential victims.

Once again let me highlight the importance to properly configure IoT devices, for example by changing default passwords and disabling unnecessary services.

It is essential also to protect IoT with

“The correct mitigation is ‘put these devices behind your firewall’,” Graham said. 

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Mirai botnet, IoT)

[adrotate banner=”13″]