HNS

the malware can identify at least two types of devices and attempt to log into those systems using their factory default credentials, instead of blindly guessing passwords.

HNS will try to implant itself on these ports, utilizing the following exploits... TPLink-Routers RCE... Netgear RCE... AVTECH RCE... CISCO Linksys Router RCE... JAW/1.0 RCE... OrientDB RCE... CouchDB RCE

"Botezatu says an HNS bot can receive and execute several types of commands, such as 'data exfiltration, code execution and interference with a device’s operation.'"

According to Netlab researchers, the botnet is now capable of infecting the following types of devices, with the following types of exploits: TPLink-Routers RCE ... Netgear RCE ... AVTECH RCE ... CISCO Linksys Router RCE ... JAW/1.0 RCE ... OrientDB RCE ... CouchDB RCE

Bitdefender researchers announced they found an IoT malware strain that under certain circumstances copies itself to /etc/init.d/, a folder that houses daemon scripts on Linux-based operating systems ... By placing itself in this menu, the device's OS will automatically start the malware's process after the next reboot.

the malware can identify at least two types of devices and attempt to log into those systems using their factory default credentials, instead of blindly guessing passwords.

Bitdefender researchers announced they found an IoT malware strain that under certain circumstances copies itself to /etc/init.d/, a folder that houses daemon scripts on Linux-based operating systems ... By placing itself in this menu, the device's OS will automatically start the malware's process after the next reboot.

the malware can identify at least two types of devices and attempt to log into those systems using their factory default credentials, instead of blindly guessing passwords.

the malware can identify at least two types of devices and attempt to log into those systems using their factory default credentials, instead of blindly guessing passwords.

"The botnet spreads via dictionary brute-force attacks against devices with open Telnet ports." ... "If it gets this login banner, it attempts to log in with a set of predefined credentials. If that fails, the botnet attempts a dictionary attack using a hardcoded list."

As a side-effect for adding more payloads, HNS is also noisier now, as it needs to scan more ports to find new hosts to infect. Experts say they've seen HNS bots initiating scans on ports: 23 Telnet 80 HTTP Web Service 2480 OrientDB 5984 CouchDB 8080 HTTP Web Service ... but also random ports

"The botnet spreads via dictionary brute-force attacks against devices with open Telnet ports."

"Botezatu says an HNS bot can receive and execute several types of commands, such as 'data exfiltration, code execution and interference with a device’s operation.'"

The HNS communicates through the P2P mechanism... HNS node contacts to other P2P peers with the following 3 methods... From a hard-coded built-in list of 171 peer addresses From the command-line args From the other P2P peers

But HNS was easy to spot anyway because it's only the second major IoT botnet besides Hajime known to use a P2P structure

"If the victim has the same LAN as the bot, the bot sets up TFTP server to allow the victim to download the sample from the bot. If the victim is located on the internet, the bot will attempt a specific remote payload delivery method to get the victim to download and run the malware sample."

Netlab says HNS has also started dropping a coinminer payload on some of the infected systems. Fortunately, for the time being, it appears that these deployments have all failed, as the additional coinminer payload failed to start and generate funds for the HNS operators.