Critical bugs in dozens of Zyxel and Lilin IoT models under active exploit

reader comments

21 with 18 posters participating

Criminals are exploiting critical flaws to corral Internet-of-things devices from two different manufacturers into botnets that wage distributed denial-of-service attacks, researchers said this week. Both DVRs from Lilin and storage devices from Zyxel are affected, and users should install updates as soon as possible.

Multiple attack groups are exploiting the Lilin DVR vulnerability to conscript them into DDoS botnets known as FBot, Chalubo, and Moobot, researchers from security firm Qihoo 360 said on Friday. The latter two botnets are spinoffs of Mirai, the botnet that used hundreds of thousand of IoT devices to bombard sites with record-setting amounts of junk traffic.

The DVR vulnerability stems from three flaws that allow attackers to remotely inject malicious commands into the device. The bugs are: (1) hard-coded login credentials present in the device, (2) command-injection flaws, and (3) arbitrary file reading weaknesses. The injected parameters affect the device capabilities for file transfer protocol, network time protocol, and the update mechanism for network time protocol.

Sometime in late last August, Qihoo 360 researchers started seeing attackers exploit the NTP update vector to infect devices with Chalubo. In January, the researchers saw attackers exploit the FTP and NTP flaws to spread FBot. That same month, Qihoo 360 reported the flaws to Lilin. Seven days after that, the researchers detected Moobot spreading through the use of the FTP vulnerability. Lilin fixed the flaws in mid-February with the release of firmware 2.0b60_20200207. The CVE designation used to track vulnerability is unknown.

Qihoo 360’s report came a day after researchers from security firm Palo Alto Networks

Continue reading – Article source