By Dan Goodin in San Francisco
24th March 2009
Security researchers have identified a sophisticated piece of malware
that corals consumer routers and DSL modems into a lethal botnet.
The "psyb0t" worm is believed to be the first piece of malware to target
home networking gear, according to researchers from DroneBL, which bills
itself as a real-time monitor of abusable internet addresses. It has
already infiltrated an estimated 100,000 hosts. It has been used to
carry out DDoS, or distributed denial of service, attacks and is also
believed to use deep-packet inspection to harvest user names and
"This technique is one to be extremely concerned about because most end
users will not know their network has been hacked, or that their router
is exploited," the DroneBL researchers wrote here. "This means that in
the future, this could be an attack vector for the theft of personally
identifying information. This technique is not going away."
Vulnerable devices include any home router or modem that uses Linux
Mipsel, has an administration interface, sshd, or telnet in a DMZ, and
employs a weak password. Once the malware takes hold, it locks
legitimate users out of the device by blocking telnet, sshd, and web
access. It then makes the devices part of a botnet. The researchers said
they first learned of the worm while investigating DDoS attacks that hit
DroneBL's infrastructure two weeks ago.
Best Selling Security Books and More!