Botnet Authors Don’t Learn Anything From Victims and Secure Databases With Root/Root


Botnet operators can be as clueless about security as their victims, according to Ankit Anubhav, Principal Researcher at NewSky Security, a cyber-security company specialized in IoT security.

Anubhav told Bleeping Computer that he recently stumbled upon two databases of two distinct IoT botnets secured with the trivial username and password combination of root/root.

Botnet herders didn’t learn anything from their victims

What makes this incredibly ironic is that both databases belonged to botnets built with a version of Owari, a malware strain that infects IoT devices using weak or default credentials.

It appears that in their haste to take over IoT devices running on weak credentials, the botnet authors themselves forgot to choose a stronger username and password combo for their command and control (C&C) server’s database

Because of this mistake, Anubhav was able to gain access to these botnets and retrieve details about infected devices, but also about the botnet operators and even some of the clients to whom they’ve rented out the botnet for DDoS attacks.

Botnets moved C&C in the meantime

Both of these weakly secured botnet C&C servers —located at and— are now offline.

They went offline as part of their regular modus operandi, Anubhav says. Both botnets regularly change the IP addresses of their C&C servers after one week.

Anubhav says the reason that miscreants regularly move C&C servers is because the IPs of their attack infrastructure get added to blacklists, and they need to move the C&C servers to new IPs in order to keep control of their attack infrastructure (bots, aka infected routers/IoT devices).

This also means that two Owari IoT botnets are still somewhere out there using root/root as their C&C server credentials. After today’s revelation from Anubhav, these botnets won’t last for long. Grayhat security researchers won’t think twice about taking these botnets down, while other crooks will surely be looking into hijacking the weakly secured botnets from their original owners and adding it to their own.

To read the original article:

Laisser un commentaire

Next Post

Visa payments DOWN: Millions affected by a service disruption

The Visa card payment system is suffering a widespread outage across Europe, millions of users were unable to make payments using their cards. Shoppers and travelers were unable to make payments with their cards since at around 2.30pm on Friday across Europe. At the time of writing, Visa confirmed the […]