{"id":29941,"date":"2019-10-31T21:32:47","date_gmt":"2019-10-31T18:32:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/klon-mirai-dobavlyaet-dyuzhinu-novyh-eksplojtov-dlya-tselevyh-korporativnyh-iot-ustrojstv\/"},"modified":"2019-10-31T21:32:47","modified_gmt":"2019-10-31T18:32:47","slug":"klon-mirai-dobavlyaet-dyuzhinu-novyh-eksplojtov-dlya-tselevyh-korporativnyh-iot-ustrojstv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/klon-mirai-dobavlyaet-dyuzhinu-novyh-eksplojtov-dlya-tselevyh-korporativnyh-iot-ustrojstv","title":{"rendered":"The Mirai clone adds a dozen new exploits targeting corporate IoT devices.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers have discovered a new clone of the well-known Mirai botnet, targeted at IoT devices. This time, embedded devices intended for use in business environments are under threat. The ultimate goal of the attackers is to gain control over high-bandwidth devices and carry out large-scale DDoS attacks.<\/p>\n

\"The
\n<\/a><\/noindex><\/p>\n

Note:
\nAt the time of translating, I was unaware that a similar article already exists on Habr. a similar article<\/a><\/noindex>.\n<\/p><\/blockquote>\n

The authors of the original Mirai have already been arrested, but the availability source code<\/a><\/noindex>, published in 2016, allows new attackers to create their botnets based on it. For instance, Satory<\/a><\/noindex> and Okiru<\/a><\/noindex>.<\/p>\n

The original Mirai first appeared in 2016. It infected routers, IP cameras, DVRs, and other devices that often have default passwords, as well as devices using outdated versions of Linux. <\/p>\n

The new variant of Mirai is designed for corporate devices<\/b><\/p>\n

The new botnet was discovered by a research team Unit 42<\/a><\/noindex> from Palo Alto Networks. Its distinction from other clones is that it is aimed at corporate devices, including the wireless presentation systems WePresent WiPG-1000 and LG Supersign televisions.<\/p>\n

The remote access execution exploit for LG Supersign televisions (CVE-2018-17173) became available in September last year. The exploit for WePresent WiPG-1000 was published in 2017. Overall, the bot is equipped with 27 exploits, 11 of which are new. The set of 'unusual default credentials' has also been expanded for dictionary attacks. The new variant of Mirai also targets various embedded hardware, such as:<\/p>\n