New Botnet Wipes Disks & Memory on Routers & IoT Devices

guest · Oct 6, 2020

New HEH botnet can wipe routers and IoT devices
The disk-wiping feature is present in the code but has not been used yet
October 6, 2020
https://www.zdnet.com/article/new-heh-botnet-can-wipe-routers-and-iot-devices/

A newly discovered botnet contains code that can wipe all data from infected systems, such as routers, servers, and Internet of Things (IoT) devices.

Named HEH, the botnet spreads by launching brute-force attacks against any internet-connected system that has its SSH ports (23 and 2323) exposed online.
If the device uses default or easy-to-guess SSH credentials, the botnet gains access to the system, where it immediately downloads one of seven binaries that install the HEH malware.
Click to expand...

The only features present are a function that ensnares infected devices and coerces them to perform SSH brute-force attacks across the internet to help amplify the botnet; a feature that lets attackers run Shell commands on the infected device; and a variation of this second feature that executes a list of predefined Shell operations that wipe all the device's partitions.
BOTNET IS IN ITS EARLY STAGES OF DEVELOPMENT
HEH was discovered by security researchers from Netlab, the network security division of Chinese tech giant Qihoo 360, and detailed for the first time in a report published today.

Because this is a relatively new botnet, Netlab researchers can't tell if the device-wiping operation is intentional or if it's just a poorly coded self-destruction routine.
Click to expand...

Qihoo 360 Netlab: HEH, a new IoT P2P Botnet going after weak telnet services

The operating mechanism of this botnet is not yet mature, as we can see from above, some important function such as attack module have not yet been implemented.
With that being said, the new and developing P2P structure, the multiple CPU architecture support, the embedded self-destruction feature, all make this botnet potentially dangerous.
Click to expand...

Log in or Sign up

New Botnet Wipes Disks & Memory on Routers & IoT Devices

guest Guest

Log in or Sign up

New Botnet Wipes Disks & Memory on Routers & IoT Devices

guest Guest

Useful Searches