Stealth Router-based Botnet Discovered
Mar 24, 2009 Security News
The guys over at DroneBL, a realtime monitor of abusable IPs, has discovered a botnet they are calling “psyb0t“.
We have come across a botnet worm spreading around called “psyb0t”. It is notable because, according to my knowledge, it:
- is the first botnet worm to target routers and DSL modems
- contains shellcode for many mipsel devices
- is not targeting PCs or servers
- uses multiple strategies for exploitation, including bruteforce username and password combinations
- harvests usernames and passwords through deep packet inspection
- can scan for exploitable phpMyAdmin and MySQL servers
Vulnerable is any Linux MIPSel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including OpenWRT/DD-WRT devices).
Read the whole thing HERE
Leave a Reply