New Mirai variant 'hijacked TalkTalk routers for botnet'

99% of the botnet routers belong to TalkTalk, says Imperva

Malware

Security researchers at Imperva yesterday said that a number of home routers have been hijacked by a new Mirai-based botnet, with 99% of them belonging to TalkTalk customers.

The attack appears to have taken advantage of a new TR-064 vulnerability, and researchers said this could be a "threat to customers of ISPs around the world".

TR-064 is a protocol adopted by most ISPs when remotely operating routers and uses port 7547 to receive remote commands.

Imperva said: "One such command is Time/SetNTPServers, used to synchronise a router with an external time source. However, this same command can also be modified to let hackers remotely execute bash commands."

Although the security firm had not found any routers with open 7574 ports, it discovered that some ports had been left open until a few days ago.

All of the 2,398 attacking botnet devices were said to be located in the UK.

Imperva said: "This kind of IP distribution is uncommon for DDoS botnets. Typically it indicates a vulnerability in a device supplied by local retailers, which allows for such a regional botnet to appear".

The company had also found one of its clients, a Bitcoin company, had been hit by a series of GET and POST flood attacks on 5 December.

Imperva said it is hard to know for sure whether the malware that attacked these TalkTalk home routers was the same Mirai variant used in the Deutsche Telekom attack last week.

"The offenders' persistence, as well as its choice of targets, shows this to be a premeditated offensive- not the typical random burst launched from a rented DDoS-for-hire service," said the researchers.

According to Imperva, TalkTalk is aware of the attack and issued a fix for the TR-064 vulnerability and issued a fix for the vulnerability.

A TalkTalk spokeswoman said in a statement emailed to IT Pro: ""Along with other ISPs in the UK and abroad, we continue to take steps to review the potential impacts of the Mirai worm. A small number of customer routers were affected by this issue. We have made good progress repairing these and continue to deploy additional network-level controls to further protect our customers."

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020
Ransomwiz lets you test your security with simulated ransomware
ransomware

Ransomwiz lets you test your security with simulated ransomware

21 Sep 2020
Best free malware removal tools 2020
Security

Best free malware removal tools 2020

21 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Google Pixel 4a review: A picture-perfect package
Google Android

Google Pixel 4a review: A picture-perfect package

18 Sep 2020