Upgraded Mirai botnet disrupts Deutsche Telekom by infecting routers

Hackers have updated the Mirai malware to infect more devices, according to a security researcher

A new version of Mirai -- a malware that’s been enslaving poorly secured IoT devices -- has found a new victim: vulnerable internet routers from Germany's Deutsche Telekom.

The spread of the new strain of Mirai has caused internet connection problems for close to a million Deutsche Telekom customers, the company reported on Monday.   

Deutsche Telekom blamed the disruption on the notorious malware, which has already been found infecting more than 500,000 internet connected devices, including DVRs and surveillance cameras.

However, this new strain of Mirai has been upgraded, said Johannes Ullrich, a security researcher with the SANS Technology Institute. He's been observing the infections and said they've been specifically designed to exploit a vulnerability in internet routers from the company Zyxel.

Originally, Mirai was designed to infect devices built with weak default logins and passwords by scanning the internet for them and then trying a list of more than 60 password combinations. But this new strain also targets a flaw in the SOAP (Simple Object Access Protocol) service embedded in the Zyxel router products, allowing the malware to take over the devices, Ullrich said.

It's unclear how many devices may have been affected, but Deutsche Telekom said the disruption, which began on Sunday afternoon, caused 900,000 out of its 20 million customers to experience connection problems.

"The attack attempted to infect routers with a malware, but failed, which caused crashes or restrictions for 4 to 5 percent of all routers," the company said in an email.

However, Ullrich's findings suggest that the new strain of Mirai succeeded in ensnaring at least some devices. To track the malware’s spread, he established a web server on Monday designed to act as a honeypot that can lure in the attack.

"Once Mirai infects a system, it goes off looking for more victims," he said.  

As of Monday morning, he'd found 100,000 unique IP addresses attempting to infect his honeypot.

But the goal of Mirai isn’t simply to infect. By taking control of thousands of devices, the malware can form a botnet -- or an army of enslaved computers that can be used to launch massive distributed denial-of-service attacks.

That's what happened last month when Mirai-infected devices were used to cause internet outages for dozens of top U.S. websites. The DDoS attack worked by flooding a DNS service provider with an overwhelming amount of internet traffic.  

Ullrich said he hasn’t observed this new strain of Mirai launching any DDoS attacks. But the connection problems for the Deutsche Telekom customers were probably caused by the malware infecting the device, and then using the computing power on the router to infect other devices, he said.

Fortunately, Deutsche Telekom has issued an advisory, instructing customers how to remove the infection.

But Ullrich said the new Mirai strain has probably infected routers used by other companies or internet service providers; they just aren’t aware. He estimates 1 million to 2 million router products will be easily infected.

Zyxel didn’t immediately respond to a request for comment.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Michael Kan

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?