by Moe Janmohammad via ScienceMoez.com
Almost exactly a year after the Mirai Botnet took down half of the internet, a new IoT botnet is building itself to launch an even more disruptive attack. On October 19th, CheckPoint announced they’ve started tracking a new botnet, named “Reaper”, which had already found its way into over 1 million organizations.
Both Mirai and Reaper are worms, which means they spread automatically from one device to another, so their calls back to a command and control server can be few and far between. Mirai’s scanning is extremely aggressive, often causing an unintentional Denial of Service attack on small home routers its trying to take control of. Reaper is different in that its’ scans are much less aggressive, and spreads very deliberately. This allows it to add devices to the botnet more stealthily and fly under the radar of security operations personnel looking for suspicious activity.
Hindsight is 20-20
Looking back at the 2016 Mirai attacks, researchers can see all of the telltale signs of an impending attack. Increased communication with unknown IPs, sudden processor usage increase, and unresponsive IoT devices were all signs that could have been used to detect the botnet before it’s attacks on Dyn’s servers. Since Reaper is moving much more slowly, its intentions are harder to guess. We already know that it has enough devices to recreate the 2016 Mirai attacks, with even greater power.
Some theories about the purpose of the Reaper Botnet include a giant distributed proxy network, or Tor endpoints to create more anonymized browsing resources. Some of the signs look like it’s going to mirror the Mirai attack, but other signs are completely new to us. It even lives harmoniously with Mirai on devices that have been compromised by both!
How do I protect my devices?
Almost all of the exploits being used to take over the devices are vulnerabilities discovered in the last 3 months. There is a very good chance that your IoT devices don’t have the updates required to patch those flaws. My advice is to patch often, turn on automatic updates, and check on your devices at least once a week. The Reaper code looks like its being updated, so new vulnerabilities can, and will, be exploited to take over your IoT devices.
For now, all we can do is wait in the calm before the storm.
