Hacked DVRs Surge To 400,000

Author: Brian Karas, Published on Oct 19, 2016

The global internet is under attack from record breaking botnets. And it is getting worse, Mirai doubled in size in the last month.

Shamefully, the video surveillance industry is mostly to blame.

New Mirai Research

New research from Level 3 provides deeper insight into Mirai:

Prior to the Mirai source code release, we identified approximately 213,000 bots using this method.  Since the code release, multiple new Mirai botnets have accumulated an additional 280,000 bots, bringing the count of Mirai bots to 493,000.  The true number of actual bots may be higher based on an incomplete view of the infrastructure.

This would be bad enough, but the security industry, at the center of this growth, gets a black eye:

The majority of these bots are DVRs (>80percent)

And if you think these bots are outside of the US, in some country with unskilled installers leaving ports open you are wrong:

The highest fraction of devices used are located in the United States (29 percent) 

Level 3 Overview

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

Level 3 is a global network communications company, connecting the core of the internet, which also gives them an ability to observe and analyze internet traffic patterns. When botnets erupt, Level 3 inadvertently becomes becomes a pawn in their game, but they also get an ability to deconstruct how the botnet is propagating and being controlled.

The Problem Will Not Go Away On Its Own

Attackers have recognized that IoT devices, particularly DVRs, NVRs, security cameras, and related devices make ideal targets, in some cases the same device is exploited by multiple malware variants:

Of the hosts we are confident have been assimilated by the Mirai botnet, 24 percent of them overlap with bots known to be used in gafgyt attacks.  Such a high overlap indicates that multiple malware families are targeting the same pool of vulnerable IoT devices.

Gafgyt is an earlier botnet that Mirai is suspected to be based on.

As long as these devices remain insecure and exploitable, there is every reason to believe they will continue to be taken over by botnet malware, and that the complexity of the malware will evolve, possibly to scan local networks for other exploitable devices that do not have inbound ports open, but can communicate outbound as attackers.

Botnet Scanners Do Not Discriminate

The Mirai botnet relies heavily on Dahua and XiongMai, but a similar botnet could be built on exploitable Axis cameras, or ADI/Tri-Ed cameras that have not been upgraded

Test Your Network

An Nmap scan of your network can help identify open ports like telnet (port 23) or SSH (port 22) that typically are used by botnets for infection, and generally are not required for standard camera/recorder access. Our Nmap tutorial shows how to use Nmap and interpret the results.

Security Integrators Need To Take Action

Although security integrators may be able to justify ignoring Mirai, they are the best chance for stopping it from doubling in size yet again. Manufacturers are shipping exploitable products, and customers (especially those without dedicated IT departments) do not always understand the risks of connecting camera and recorders to the internet. This leaves the integrator stuck in the middle, as they often are, as the best resource to solve this problem and help save the reputation of the industry.

 

Vote

Comments (37): PRO Members only. Login. or Join.

Related Reports on Hacking

Avigilon CEO Attacks Asian Companies Cyber Insecurity on Aug 18, 2017
Avigilon CEO is taking aim at their Asian competitors. And he is going directly after these company's cyber security issues. In this note, we...
IP Networking Course September 2017 on Aug 17, 2017
This is the only networking course designed specifically for video surveillance professionals plus it includes live training, personal help and...
Hikvision Responds To Cracked Security Codes on Aug 15, 2017
Hikvision has responded to IPVM's report on Hikvision's security code being cracked, both with a 2 page update to dealers and communication...
Vulnerability Directory For Access Control Cards on Aug 14, 2017
Knowing which access credentials are insecure can be unclear, especially because most look and feel the same. Even the most insecure 125 kHz types...
Hikvision Security Code Cracked on Aug 08, 2017
Hikvision's 'security code' feature has been cracked and a program generating security codes is being distributed online. IPVM has obtained and...
US Army Bans Chinese DJI Drones on Aug 08, 2017
The US Army has issued a ban on Chinese-made DJI drones. A US Army memo obtained by sUAS News references a classified document from the Army...
Dahua Suffers Second Major Vulnerability, Silent [Finally Acknowledges] on Jul 25, 2017
Less than 3 months ago, Dahua received DHS ICS-CERT's worst score of 10.0 for their backdoor. Now, Dahua has received another 10.0 score for a new...
Wireless Burglar Alarm Sensors Guide on Jul 21, 2017
Wireless sensors for burglar alarm sensors are an increasingly common option for the historical labor intensive wired alarm systems. However,...
PR Campaign Exploiting Manufacturer Cybersecurity on Jul 20, 2017
Manufacturers increasingly have a bulls-eye on their back. As cyber security solutions providers grow, they realize a great way to get publicity...
Hikvision USA Head of Cybersecurity Exits on Jul 18, 2017
Hikvision USA's Head of Cybersecurity has exited the company. In this note, we review the move, share Hikvision's feedback and examine the...

Most Recent Industry Reports

Avigilon CEO Attacks Asian Companies Cyber Insecurity on Aug 18, 2017
Avigilon CEO is taking aim at their Asian competitors. And he is going directly after these company's cyber security issues. In this note, we...
Sony Next Gen HD Dome Camera Tested (SNC-EM642R) on Aug 18, 2017
Sony has released their latest generation, claiming improved WDR and low light, increased IR range, and more. We tested the SNC-EM642R outdoor IR...
IP Networking Course September 2017 on Aug 17, 2017
This is the only networking course designed specifically for video surveillance professionals plus it includes live training, personal help and...
Knightscope Raises $10 Million With $3,320 Average Per Investor on Aug 17, 2017
Congrats to Knightscope. And condolences to their legion of little investors. Knightscope has disclosed they have raised $10+ million from their...
Axis and Arecont Legal Conflict Over Multi-Imager Cameras on Aug 17, 2017
Arecont threatened Axis. Axis has responded by moving to invalidate an Arecont patent. It is an important contest. Multi-imagers are Arecont's...
Directory Of Consumer Security Cameras on Aug 16, 2017
The consumer camera segment continues to grow, with new startups and models from existing players released seemingly every month. In this report we...
Cat 5e vs Cat 6 vs Cat 6a Network Cable Usage Statistics on Aug 16, 2017
Cat 5e? Cat 6? Cat 6a? What do integrators use in practice, today? 140+ integrators told IPVM. Here are the results: For those who want to...
Hikvision Responds To Cracked Security Codes on Aug 15, 2017
Hikvision has responded to IPVM's report on Hikvision's security code being cracked, both with a 2 page update to dealers and communication...
Stolen Video NVR / DVR Statistics on Aug 15, 2017
"But what happens if someone steals my recorder?" Anyone who has done more than a handful of jobs has probably heard this question several times....
Hikvision Europe Cutting Out Unauthorized End User Sales on Aug 15, 2017
The days of anyone buying Hikvision from anywhere off the Internet are numbered, at least in Europe, if Hikvision's plan comes to fruition. In...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact