One of the Most Destructive Botnets Can Now Spread To Nearby Wi-Fi Networks (arstechnica.com) 28
The sophistication of the Emotet malware's code base and its regularly evolving methods for tricking targets into clicking on malicious links has allowed it to spread widely. "Now, Emotet is adopting yet another way to spread: using already compromised devices to infect devices connected to nearby Wi-Fi networks," reports Ars Technica. From the report: Last month, Emotet operators were caught using an updated version that uses infected devices to enumerate all nearby Wi-Fi networks. It uses a programming interface called wlanAPI to profile the SSID, signal strength, and use of WPA or other encryption methods for password-protecting access. Then, the malware uses one of two password lists to guess commonly used default username and password combinations. After successfully gaining access to a new Wi-Fi network, the infected device enumerates all non-hidden devices that are connected to it. Using a second password list, the malware then tries to guess credentials for each user connected to the drive. In the event that no connected users are infected, the malware tries to guess the password for the administrator of the shared resource.
"With this newly discovered loader-type used by Emotet, a new threat vector is introduced to Emotet's capabilities," researchers from security firm Binary Defense wrote in a recently published post. "Previously thought to only spread through malspam and infected networks, Emotet can use this loader-type to spread through nearby wireless networks if the networks use insecure passwords." The Binary Defense post said the new Wi-Fi spreader has a timestamp of April 2018 and was first submitted to the VirusTotal malware search engine a month later. While the module was created almost two years ago, Binary Defense didn't observe it being used in the wild until last month.
"With this newly discovered loader-type used by Emotet, a new threat vector is introduced to Emotet's capabilities," researchers from security firm Binary Defense wrote in a recently published post. "Previously thought to only spread through malspam and infected networks, Emotet can use this loader-type to spread through nearby wireless networks if the networks use insecure passwords." The Binary Defense post said the new Wi-Fi spreader has a timestamp of April 2018 and was first submitted to the VirusTotal malware search engine a month later. While the module was created almost two years ago, Binary Defense didn't observe it being used in the wild until last month.
It is destructive (Score:3)
If you aren't forced to create a better password than 12345.
Most devices get stuck with an admin named account, and you have to hope there aren't telnet subsystems hard-coded into your device. Or hidden accounts with known user-ids and passwords you can't remove.
"Then, the malware uses one of two password lists to guess commonly used default username and password combinations."
Re: It is destructive (Score:2)
What about 123456?
Re: It is destructive (Score:1)
Being such a security professional is why I use P@ssw0rd123!
Re: (Score:2)
The XKCD comic explained this very well years ago.
https://xkcd.com/936/ [xkcd.com]
Re: (Score:3)
Too bad that every secured site out there prevents you from using this kind of password. You need to have some caps, some numbers, and perhaps a symbol. That puts you back into the world of hard-to-remember passwords. So you use a short, daily guessable one instead.
Re: (Score:2)
We are our own worst enemy.
Re: (Score:1)
The kicker?
"Reeeally-secure-password, like-no-kidding" (which, according to howsecureismypassword.net, would take until the heat death of the universe to crack) breaks five of the rules and is considered insecure and disallowed. "abcde1!" does not break any rules, and is thus allowed as a password.
Re: (Score:2)
Re: (Score:3)
Most people are not capable of creating secure passwords. A dictionary attack with unlimited time is also likely to have pretty good success rates.
Targeted attacks are much harder to implement with something like this, but spreading effectively via a typically less-hardened path is likely to work quite well.
Even most of the unique “passwords” for ISP router/APs are calculated based on MAC address, IIRC. I could easily expect a 2% or better success rate without really pushing the limits. Add i
Re: (Score:2)
Re: (Score:2)
Unfortunately that doesn’t work especially well at the network level. You have dumb devices that are supposed to “just work”, and blocking them for an exponential period because someone didn’t fix a problem for a day or two gets ineffective quickly. You also have the very easy option of changing mac addresses and starting over.
Re:It is destructive (Score:5, Interesting)
Routers/APs tend to be all or nothing though; it's "admin or bust" as there are not generally multiple user accounts that you can use to do a privilege escalation attack on to get root. MACs obviously don't travel beyond their local subnet in normal operation (but may still be acquired; some protocols can encapsulate them in the payload, and if you're able to sniff the AP traffic then you can obviously just grab them from the air), but sign-on banners are typically unique to a given vendor, or even hardware model, and if you know the vendor/model then you've got half the MAC because you know their OID (or OIDs if a larger vendor), and quite likely have reversed engineered any MAC-to-default-password scheme. Congrats your search space just went down by a factor of 2^24, and because most vendors are just as lazy as their users that's also pretty much game over given enough time to retry.
As a data point on that; for grins last Christmas I setup a honey pot - an "SSH server" on a non-standard and officially unassigned port that returned an imitation of genuine router signon banner on connect, but would refuse all login attempts - to get a feel for typical botnet size and operation. I got a port scan hit after a couple of days (on Dec 24th) and started seeing login attempts using common username/password pairs from multiple IPs almost immediately, so I shutdown the server and starting dropping the traffic to study the "afterglow". As of today (Feb 12th) the same botnet (consisting of at least 6,000 hosts, so far) is still attempting to connect to the dead port at the rate of about 200 connection attempts a day (the same rate I was seeing in December), and doesn't appear to be tailing off at all. Unless your router/AP's login timeout code takes into account multiple IPs working in concert, bad actors are going to get a *lot* of attempts in, are quite prepared to spend a lot of time using somebody else's resources to try and get it if they think they have a live one, and (apparently) don't check too often to see whether this fish is actually still on the hook.
So - no surprise to anyone that keeps up with best practice - but complex passwords absolutely need to gain entropy by virtue of being *truly* random; sticking a few "special characters" in there and/or transposing letters for numbers simply isn't going to do it any more if you get confronted with an off-line dictionary attack. If you really must do a memorable password, then mix up some languages or put some jargon in there that isn't likely to be in a "most common words" dictionary file *or* related to the industry (assume the attacker knows who they are hitting), and (duh!) limit access to your router/AP to the smallest subset of IPs possible on your internal LAN only, or better yet, restrict it to the local console port if that's an option.
Re: (Score:2)
Most people are not capable of creating secure passwords.
Most people are stupid and lazy.
https://strongpasswordgenerato... [strongpass...erator.com]
It's not hard to create a strong password. It's hard to get people to understand the value of it. And that's obvious when you look at the Top 10 Shitty Password lists that haven't changed in decades regardless of increased risk.
You can't fix Stupid. You can't even patch it.
Re: (Score:2)
Re: (Score:2)
In fact, this whole "most destructive" thing uses known vulnerabilities and user stupidity.
Userid/Password? (Score:2)
So where is the list of Userid and Password this thing uses? Too complicated for the scaremongers to decode I guess.
Re: (Score:2)
admin/admin I suspect.
Hackers must be removed (Score:2)
How long before the malware evolves into an AI? (Score:2)
It's WINDOWS malware (Score:2)
Ask yourselves why when Windows malware makes the news it's hard to find WINDOWS mentioned unless/until technical explanations of how it works are shown.
WINDOWS should be in the first paragraph and the title.
The Register do that but they're British so unbeholden to Redmond..
Non-techies (msmashdot is not news for nerds) should be informed so they don't assume Windows malware infects superior operating systems. That requires mentioning Window.
Re: (Score:2)
Just in case anyone else is wondering:- Game over, LAN, game over! Windows software nasty Emotet spotted spreading via brute-forced Wi-Fi networks [theregister.co.uk].
Re: (Score:2)
Here is the thing if you are a hacker and you want to infect as many systems as possible you will go for the most popular operating system so we already know it's windows. If Microsoft went bankrupt and windows went away who ever replaced them would have an ever escalating fight for security because when there is money to be made people will find a way.
Re: (Score:2)
"We" do but non-geeks do not. The non-techie cluelessness level is amazing, but not in a good way.
MICROS~1 strikes again (Score:2)