Persirai is a new strain of Internet of Things malware that infects more than 1,250 models of security camera, all manufactured by an unnamed Chinese manufacturer that has sold at least 185,000 units worldwide.
The vulnerability the malware exploits was discovered and documented by Pierre Kim, an independent security researcher, who has located at least 185,000 vulnerable devices using the Shodan search engine. The cameras all try to tunnel out of their local firewalls by sending unencrypted data over UDP -- a cousin to TCP -- leaving them vulnerable to hijacking. Once compromised, the cameras can be used to direct devastating, unstoppable floods of traffic to bring down web sites, and can also be remotely monitored by voyeurs, burglars, and other malefactors.
The cameras are "overall badly designed with a lot of vulnerabilities" and are sold as "white-label" goods that other companies can brand and sell under a variety of model numbers (this is common with Internet-of-Shit devices, like the insecure PVRs used by criminals to monitor CCTVs in order to plan robberies).
Less than a month after Kim's report, the Persirai appeared on the scene, harnessing infected devices to serve as part of a denial-of-service botnet. Persirai alters infected devices to prevent them from being infected by competing strains of malware -- this may also offer some protection against the vigilante worms (like Brickerbot) that unknown parties have fielded to infect and permanently shut down vulnerability devices.
New IoT malware targets 100,000 IP cameras via known flaw
[Michael Kan/CSO Online]
Multiple vulnerabilities found in Wireless IP Camera (P2P) WIFICAM cameras and vulnerabilities in custom http server
[Pierre Kim/IT Security Research by Pierre]
How can a single, ill-conceived law wreak havoc in so many ways? It prevents you from making remix videos. It blocks computer security research. It keeps those with print disabilities from reading ebooks. It makes it illegal to repair people's cars. It makes it harder to compete with tech companies by designing interoperable products. It's even been used […]
Last month, a developer called Axi0mx released an Iphone crack called Checkm8, which attacks a defect in the Ios bootrom, a low-level piece of code that has not been successfully attacked since 2010. The bootrom is read-only, making its defects effectively unpatchable, short of removing the chip and swapping it for one with more robust […]
A bit of good news for pro-democracy protesters in Hong Kong, and the app developers trying to help them not get injured or killed by police.
Got some aches that a lazy rubdown won’t put a dent in? Give your muscles an early Christmas with these massage guns. If you’ve never tried one, they’re all designed to bring deep tissue relief, and they’re all at Black Friday prices now. JAWKU Muscle Blaster V2 Cordless Percussion Massage Gun This cordless massager exerts […]
Just about everybody from small-time app developers to big database administrators loves Linux. But just because it’s open-source doesn’t mean its secrets are open to everybody. For that, you need a comprehensive training program like the Complete Linux System Administrator Bundle. If you’re chasing any kind of career in coding, this is the online regimen […]
If you want to be an app developer for Android, there’s never been a better time. Languages like Kotlin are tailor-made for functionality, and the Jetpack suite of tools makes the whole process easier. The only hurdle is learning your way around these tools, and that’s where the Android Jetpack & App Development Certification Bundle […]