Anonymous-tied DDoS botnet shows insecure routers are legion

Researchers found a botnet of over 40,000 routers that are being used to launch distributed denial-of-service attacks

Tens of thousands of home routers have been infected with malware, and are being used by hackers to launch distributed denial-of-service (DDoS) attacks, including by the hacktivist group Anonymous.

The router-based botnet was discovered by Web security firm Incapsula while investigating a series of DDoS attacks against dozens of its customers that have been going on since late December.

Incapsula's researchers traced the malicious traffic back to routers made by Ubiquiti Networks and distributed by ISPs around the world to their customers.

The devices had DDoS malware programs installed on them -- usually more than one -- including some that reported back to an IRC (Internet Relay Chat) network and channel called AnonOps, the researchers said in a report published Tuesday.

This IRC network is used as a base of operations by Anonymous, a group that over the past seven years has launched politically motivated attacks against the websites of many private companies, government agencies and other organizations around the world.

The hacktivist group has argued in the past that flooding a website with requests to prevent others from accessing it is a legitimate form of protest. While that's debatable, abusing the devices and bandwidth of unsuspecting people sounds like more than just electronic civil disobedience.

The Incapsula researchers don't believe that the routers were hacked through a vulnerability in their firmware, but because they had been deployed in an insecure manner: with their management interfaces exposed to the Internet via SSH and HTTP using default credentials.

In fact, they found shell scripts running on the compromised devices that were designed to scan the Internet for other routers that could be accessed over SSH with default usernames and passwords.

"Facilitating the infiltration, all of these under-secured routers are clustered in the IP [Internet Protocol] neighborhoods of specific ISPs that provide them in bulk to end-users," the researchers said. "For perpetrators, this is like shooting fish in a barrel, which makes each of the scans that much more effective."

The problem of ISPs distributing insecure routers to their customers is a widespread one that hackers have exploited time and time again over the years.

In addition to DDoS attacks, compromised routers are used to redirect users to malicious websites, intercept online banking sessions, inject rogue ads into Web traffic, steal credentials for various online accounts and perform other illegal activities.

Anonymous is not the only group of hackers to use compromised routers. Cybersecurity journalist Brian Krebs reported in January that another group called Lizard Squad had set up a DDoS-for-hire service using hacked home routers. Lizard Squad has taken responsibility for DDoS attacks against Sony's PlayStation Network, Microsoft's Xbox Live service and other high profile websites.

The botnet made up of Ubiquiti devices is most likely not the one used in January by Lizard Squad for its DDoS service, because they are powered by different malware programs, the Incapsula researchers said. However, days after Incapsula observed a surge in attacks from the Ubiquiti botnet in April, Lizard Squad hinted on Twitter that it has a more powerful botnet.

It's possible, and even likely, that the hacked Ubiquiti routers are being used by multiple groups. This is supported by the presence of multiple DDoS malware programs on them.

Incapsula detected 40,269 different IP addresses from 1,600 ISPs in 109 countries associated with the botnet. The largest concentrations of infected devices are in Thailand (64 percent), Brazil (21 percent), the U.S. (4 percent) and India (3 percent).

The company also identified 60 servers used by hackers to control the routers, the majority of them in China and the U.S.

Users should make sure that their routers do not expose management interfaces over HTTP or SSH to the Internet. A tool on yougetsignal.com can be used to scan a router's IP for open ports.

Users should also make sure that they change the default login credentials for their routers, the Incapsula researchers said. Ubiquiti provides information on how to do this in the user guides for its airOS devices.

Join the CSO newsletter!

Error: Please check your email address.

Tags Ubiquiti Networksintrusiononline safetysecuritymalwareIncapsula

More about MicrosoftSonySSHXbox

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place