Mirai-based botnet exploits weak authentication to mine imaginary money.
A worm has been quietly building a botnet for the past year.
It breaks into Linux SSH servers with weak authentication.
In today's SB Blogwatch, we urge a switch to key-based auth.
Your humble blogwatcher curated these bloggy bits for your entertainment.
The main bot client is based on the old Mirai worm whose source code has been available for years.
Akamai has recorded over 800 unique IP addresses from around the world that showed signs of NoaBot infections with 10% of them based in China.
SSH dictionary attacks - where the attacker will test predefined pairs of usernames and passwords - are nothing new and are also easy to defend against by following best security practices like using SSH key-based authentication and disabling password authentication.
This means that the servers compromised by NoaBot are likely low-hanging fruit from a security perspective.
The Akamai researchers said that the hackers take great care to hide the wallet address where the cryptominer sends mined coins.
Originally used for distributed denial-of-service attacks, Mirai eventually became a tool for other malicious activities.
Restricting arbitrary internet SSH access to your network greatly diminishes the risks of infection.
Using strong passwords also makes your network more secure.
Spreads via password authenticated SSH, which is the first thing you disable when you set up an SSH server.
Does a few mildly crafty things to prevent reverse engineering.
This doesn't seem serious at all, nor difficult to detect.
Many of these devices run some kind of Linux, allow for outside connections via SSH, and basically have as much thought put into security by their devs as a door without a knob.
The people who own them often don't even know that they're vulnerable because someone set the admin password to abc123 at the factory and nobody ever changed it.
It's been known for many years that if you use a guessable password someone might guess it.
Past performance is no guarantee of future results.
This Cyber News was published on securityboulevard.com. Publication date: Thu, 11 Jan 2024 18:13:03 +0000