New Variants of Mirai Botnet Detected, Targeting More IoT Devices

An anonymous reader quotes a report from Ars Technica: Mirai, the "botnet" malware that was responsible for a string of massive distributed denial of service (DDoS) attacks in 2016 -- including one against the website of security reporter Brian Krebs -- has gotten a number of recent updates. Now, developers using the widely distributed "open" source code of the original have added a raft of new devices to their potential bot armies by compiling the code for four more microprocessors commonly used in embedded systems.

Researchers at Palo Alto Networks' Unit 42 security research unit have published details of new samples of the Mirai botnet discovered in late February. The new versions of the botnet malware targeted Altera Nios II, OpenRISC, Tensilica Xtensa, and Xilinx MicroBlaze processors. These processors are used on a wide range of embedded systems, including routers, networked sensors, base band radios for cellular communications and digital signal processors. The new variants also include a modified encryption algorithm for botnet communications and a new version of the original Mirai TCP SYN denial-of-service attack. Based on the signature of the new attack option, Unit 42 researchers were able to trace activity of the variants back as far as November 2018.

Remember kids ...

[dc29A]

The 'S' in IoT stands for 'Security'.

Oh goody

[JustAnotherOldGuy]

Yay, more malware. Just what we need.

MAGA

[raind]

My attorney got arrested. Doesn't matter when it's backdoored.

Re:

[arglebargle_xiv]

That's a weird set of processors, Nios II and Microblaze are either soft-cores or IP blocks on an FPGA, they aren't really used on consumer equipment. And who uses OpenRISC at all? Did they do this just because they can?

Re:

[Zocalo]

Mirai doesn't really target PCs; it's main focus is embedded systems, especially routers and (obviously) IoT devices in both consumer and industrial spaces, so I guess the authors are mostly trying to expand their attack space. They've already added a whole bunch of additional vendors and device types since the original version, so I guess this is just the next stage down the long tail of being able to attack as much as possible. My understanding is the Mirai code is very modular and fairly easy to add ne