Level 3 unveils details of botnet lives

The Level 3 Threat Research Labs, Level 3 Communications' threat intelligence and research arm, has uncovered details about botnet profile for the malware commonly referred to as Lizkebab, BASHLITE, Torlus or gafgyt.

The research has found that the malware family is responsible for botnets that control approximately one million endpoints:

• A large percentage of the bots are located in Taiwan, Brazil and Colombia, pointing to the uptick in malicious activity in the region.
• Almost 96% of the infected devices were Internet of Things (IoT) items of which 95% were cameras and digital video recorders. Roughly 4% were home routers and less than 1% were compromised Linux servers.
• The team observed that the bots do not scan for open ports but wait until they are instructed by the command-and-control (C2) servers before taking any action.
• Three-quarters of attacks last less than 5 minutes.
• Some C2s exceeded 100 attacks a day. The median active time for a C2 is around 13 days and often not contiguous.

Level 3 advises IoT users to:

• Buy from a trusted source or research and read consumer feedback. Ensure the product supports encryption.
• Change the factory setting password to a “pass phrase.” Pick a strong password and use a different one for every IoT device.
• Update devices regularly to take advantage of the latest security patches.

Interested?

Read the research

Hashtag: #IoTSecurity