Has anyone dug on:
Did you ever play HIDE-AND-SEEK?
Q
I just found this….
Unique “Hide ‘N Seek” IoT Botnet May Be a Sign of What’s to Come
SEE PIC
The “Hide ‘N Seek” (HNS) Internet of Things botnet is back in action, and now it’s bigger and badder than ever. First spotted in early January 2018, this botnet went M.I.A. for nearly two weeks before researchers at Bitdefender uncovered it once again, with a device count of more than 24,000! What started out as a dozen infected devices in Southeast Asia earlier this month has now become a global phenomenon. How can this level of growth be possible?
HNS owes its alarming momentum to its advanced communication tactics – using custom-built peer-to-peer interactions to rapidly exploit new victims. It also happens to be just the second known botnet to use a decentralized, P2P architecture. According to an SC Magazine report, HNS may represent a concerning and widespread shift in the way cybercriminals seek to leverage botnets. Here’s an excerpt from the article:
“The botnet also uses multiple anti-tampering techniques to prevent a third party from hijacking or poisoning and can perform web exploitations against a series of devices via the same exploit as CVE-2016-10401 and other vulnerabilities against networking equipment.
HNS also embeds a plurality of commands such as data exfiltration, code execution and interference with a device’s operation. The botnet also features a worm-like spreading mechanism that randomly generates a list of IP addresses to get potential targets.”
sauce:
https://www.secplicity.org/2018/01/25/unique-hide-n-seek-iot-botnet-may-sign-whats-come/
The Hide ‘N Seek IoT Botnet Just Unlocked a New Achievement: Persistence
The Hide ‘N Seek IoT Botnet Just Unlocked a New Achievement: Persistence
May 8, 2018 By The Editor
Remember when we said the “Hide ‘N Seek” IoT (Internet of Things) botnet may be a sign of what’s to come? Well, according to a blog post published by Bitdefender on May 7, it looks like the prophecy is true. Hide ‘N Seek has infected close to 90,000 devices total (including more than 20,000 over the course of just a few days back in January) and has unlocked an extremely concerning new achievement: Persistence. The latest version of the malware discovered last week is the world’s first to gain persistence (the ability to survive a reboot) on infected devices.
If that wasn’t enough cause for alarm, the most recent version of the Hide ‘N Seek malware also wields new binaries that allow it to target new vulnerabilities and types of devices. In a SecurityWeek report posted earlier today, Bitdefender Senior E-Threat Analyst Bogdan Botezatu elaborates on which IoT devices this malware is targeting. Here’s an excerpt:
“The list is extremely long and features several camera models, but the hardcoded credentials also target several router models. In addition to specific models, the bot also attempts these credentials against Telnet for all sorts of devices. The fact that it has binaries compiled for 10 platforms and architectures shows that the attacker is aiming at enrolling as many devices, regardless of type, maker, and model,” Botezatu said.
“We’ve notified vendors about this,” he added.
Over the past three months, Hide ‘N Seek has been growing steadily although some devices left the botnet, while others joined it. Most likely, the botnet lost those devices “that could not be exploited in a way to offer persistence,” Botezatu said.
According to Botezatu, Hide ‘N Seek appears to be in the growth phase – hunting IoT devices that can be exploited in a way to offer persistence – to help the botnet seize as many devices as possible. But what is Hide ‘N Seek’s end game? Botezu notes that Bitdefender’s researchers have yet to find any support for distributed denial of service (DDoS) in the five versions of the botnet they’ve observed thus far.
The lack of weaponized features in the binary – particularly DDoS, which is the most common objective of IoT botnets found in the wild – indicates that Hide ‘N Seek’s game plan is to get even bigger before it returns again even badder.
You can read the full article on SecurityWeek and learn more about the evolution of this unique IoT botnet here on Secplicity.
SAUCE:
https://www.secplicity.org/2018/05/08/the-hide-n-seek-iot-botnet-just-unlocked-a-new-achievement-persistence/