How the Grinch Stole IoT

Statement by Dyn

▻http://hub.dyn.com/static/hub.dyn.com/dyn-blog/dyn-statement-on-10-21-2016-ddos-attack.html

We can confirm, with the help of analysis from Flashpoint and Akamai, that one source of the traffic for the attacks were devices infected by the Mirai bonnet. We observed 10s of millions of discrete IP addresses associated with the Mirai botnet that were part of the attack.

#Flashpoint #Akamai

Krebs’s view on this

▻https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage

“The issue with these particular devices is that a user cannot feasibly change this password,” Flashpoint’s Zach Wikholm told KrebsOnSecurity. “The password is hardcoded into the firmware, and the tools necessary to disable it are not present.

#XiongMai

Rumours about extorsion

▻http://www.networkworld.com/article/3133751/security/extensive-ddos-attack-against-dyn-restarts-could-indicate-a-new-use-of

Cunningham [director of cyber operations for A10 Networks] says he’s seen chatter on underground forums indicating that the attackers tried to extort Bitcoin from Dyn by threatening the attacks, and when the provider didn’t pay up, launched them. He says Dyn seems to be doing a pretty good job of mitigating the effects relatively quickly.

Lengthy and interesting article by #Level3 on Mirai, containing information on the C2s (command & control servers) and the structure of the botnet

▻http://blog.level3.com/security/grinch-stole-iot

By analyzing the communication patterns of the Mirai C2 IP addresses, we were able to identify and enumerate Mirai’s infrastructure. This analysis was later confirmed accurate when the Mirai source code was released.

http://blog.level3.com/wp-content/uploads/2016/10/Figure-3-Mirai.jpg

#gafgyt

The Mirai source code

▻https://github.com/jgamblin/Mirai-Source-Code

Chinese firm admits its hacked DVRs, cameras were behind [Dyn DNS] massive DDOS attack

▻http://www.pcworld.com/article/3134039/hacking/chinese-firm-admits-its-hacked-products-were-behind-fridays-massive-ddos-at

Hangzhou Xiongmai Technology, a vendor behind DVRs and internet-connected cameras, said on Sunday that security vulnerabilities involving weak default passwords in its products were partly to blame.

DDos On Dyn Used Malicious TCP, UDP Traffic

▻http://www.darkreading.com/attacks-breaches/ddos-on-dyn-used-malicious-tcp-udp-traffic-/d/d-id/1327309

Scott Hilton, executive vice president of product for Dyn, in a blog post said the attackers employed masked TCP and UDP traffic via Port 53 in the attack as well as recursive DNS retry traffic, “further exacerbating its impact,” he said.

[...]

He noted that the DNS traffic sent in the DDoS attacks also generated legitimate DDoS retry traffic, making the attack more complicated to parse, and the attack generated ten- to 20 times the normal DNS traffic levels thanks to malicious and legit retries.

“During a DDoS which uses the DNS protocol it can be difficult to distinguish legitimate traffic from attack traffic,” he said in the post. “When DNS traffic congestion occurs, legitimate retries can further contribute to traffic volume. We saw both attack and legitimate traffic coming from millions of IPs across all geographies.”