New IoT malware targets 100,000 IP cameras via known flaw

The new malware emerged exploiting vulnerabilities that a researcher reported in March

IDG

IDG

Over 100,000 internet-connected cameras may be falling prey to a new IoT malware that’s spreading through recently disclosed vulnerabilities in the products.

The malware, called Persirai, has been found infecting Chinese-made wireless cameras since last month, security firm Trend Micro said on Tuesday. The malware does so by exploiting flaws in the cameras that a security researcher reported back in March.

The researcher, Pierre Kim, found that the vulnerabilities can allow an attacker to remotely execute code on the cameras, effectively hijacking them.

At least 1,250 camera models produced by a Chinese manufacturer possess the bugs, the researcher went on to claim.

Over a month later in April, Trend Micro noticed a new malware that spreads by exploiting the same products via the recently disclosed flaws.

“It goes to show that the people behind this are probably more aware of how to use these vulnerabilities,” said Jon Clay, Trend Micro’s director of global threat communications.

The security firm estimates that about 120,000 cameras are vulnerable to the malware, based on Shodan, a search engine for internet-connected hardware.

The Persirai malware is infecting the cameras to form a botnet, or an army of enslaved computers. These botnets can launch DDoS attacks, which can overwhelm websites with internet traffic, forcing them offline.

Once Persirai infects, it’ll also block anyone else from exploiting the same vulnerabilities on the device.

Security firm Qihoo 360 has also noticed the malware and estimated finding 43,621 devices in China infected with it.

Interestingly, Persirai borrows some computer code from a notorious malware known as Mirai, which has also been infecting IoT devices, such as DVRs, internet routers, and CCTV cameras, but by guessing the passwords protecting them.

Specifically, Persirai lifts certain functions Mirai relies on to scan the internet for new devices to infect, said Marshal Webb, CTO of BackConnect, a DDoS protection provider.

Although the resulting Persirai-powered botnet is capable of launching DDoS attacks, it’s largely refrained from assaulting any websites for the moment, probably because the malware developers are still testing how to use it.

“The security researcher, a white hat, may have had the best intentions with releasing a full disclosure on these vulnerabilities,” Webb said. “But now they're just out there, making it convenient for anyone to exploit.”

The researcher, Pierre Kim, didn't immediately respond to a request for comment, but he noted "difficulties" with finding and contacting all the vendors involved, in a blog post about the disclosure.

However, Trend Micro has identified the primary Chinese manufacturer behind the cameras and is working with it to roll out a patch.

The security firm is declining to name the manufacturer until the patch is published. Until then, it’s hard to know what exact products and brands may be vulnerable, since so many models appear to be affected.

However, owners can protect a vulnerable device by placing it behind a firewall, and blocking access to the malware’s command and control servers, which are located in Iran. Trend Micro has provided more technical details to Persirai in a blog post.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Michael Kan

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?