Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/31/2019
02:30 PM
50%
50%

New SOAP Attack Hits South African Home Routers

A huge wave of attacks is targeting home routers in South Africa for recruitment into a Hakai-based botnet.

A new malware campaign is attempting to build a bigger botnet, and it's raising warning flags for its attack vector — and the location of the victims.

According to NetScout, IoT honeypots run by its ATLAS Security Engineering & Response Team (ASERT) saw, from April 22 to May 10, a 5,043% increase of exploit attempts that originated in Egypt and targeted consumer routers in South Africa. The attacks, with a payload that attempted to recruit the routers into a botnet using a Hakai DDoS bot variant, exploit (CVE-2014-8361) a remote command execution exploit in the Realtek SDK managed SOAP service.

According to Rich Hummel, threat research manager for NetScout ASERT, these consumer routers are almost never patched or updated, with many consumers having no idea that a management interface exists, or how to use it. And unfortunately, "There are a lot of different factors here, and there are different layers, but it's really on the consumer or owner of the devices to protect themselves against the threats," Hummel says.

Asked about a possible motivation for this attack, at this time, Hummel says that ASERT can only speculate about any "deep" motivation. The most logical answer, though, is that someone simply decided to spin up a new botnet.

"This is a target of opportunity," Hummel says. "These attacks are automated, so it could be that something was seen and an automated attack was launched." As for what was seen, Hummel says that it could have been something as simple as a Shodan script looking for exposed devices with an automated attack script aimed at the results file.

Attack automation and malware as a service make botnet creation something that's available to just about anyone, Hummel says. "It can be done on a Raspberry Pi."

For more, read here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9349
PUBLISHED: 2020-04-02
The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password.
CVE-2020-11100
PUBLISHED: 2020-04-02
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
CVE-2020-11450
PUBLISHED: 2020-04-02
Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in.
CVE-2020-11451
PUBLISHED: 2020-04-02
The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary extensions and data. (This is also exploitable via SSRF.)
CVE-2020-11454
PUBLISHED: 2020-04-02
Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to exploit this vulnerability, a user needs to get access to a shared dashboard or have the ability to create a dashboard on the app...