[su_heading] Researchers are sounding the alarm about a powerful trojan targeting Linux Servers and IoT devices , calling it an "unprecedented, sophisticated threat."[/su_heading]
The so-called Mirai DDoS Trojan enslaves vulnerable devices, turning them into members of a sophisticated botnet and then using them to carry out DDoS attacks.
According to researcher MalwareMustDie! (MMD), the Mirai DDoS Trojan is the evolution of an older trojan, also used for DDoS attacks, and is known by many names, including Gafgyt, Lizkebab, BASHLITE, Bash0day, Bashdoor, and Torlus.
Mirai's predecessors are no joke. According to a report last week, more than a million IoT devices have been infected by Gafgyt over the past few months, and a botnet based on it has been identified, consisting of more than 120,000 bots.
Mirai's functionality is largely identical to that of Gafgyt, targeting IoT devices running Busybox. Busybox is a stripped-down version of the Linux used in IoT devices.
The trojan only targets specific types of platforms, such as ARM, ARM7, MIPS, PPC, SH4, SPARC, and x86.
Mirai infects devices by conducting brute-force attacks against the Telnet port, using a list of default administrator passwords in an attempt to exploit cases where device owners have neglected to change the default password.
When it infects a device, Mirai sends a signal to the C&C server and waits for commands. Mirai can be used not only to launch DDoS attacks, but also to carry out brute-force attacks, through which it spreads to other IoT devices. So far, Mirai seems to mainly target IP cameras and DVRs, which rely on Linux-based software.
