Saturday, October 12, 2024
HomeSecurity NewsHackers Used Default/weakest Credentials for IoT Botnet Command and Control Server

Hackers Used Default/weakest Credentials for IoT Botnet Command and Control Server

Published on

Malware protection

Hackers used default Username: root, Password: root for their IoT botnet command and control server.

IoT botnet Owari relies on default/ weak credentials to hack IoT devices uses a MySQL server for command and control that allows attackers to maintain communications with compromised systems.

NewSky Security researcher Ankit Anubhav observed that their honeypot with default credentials attacked by OWARI bot and attempts to download payload form IP 80[.]211[.]232[.]43.

- Advertisement - SIEM as a Service

Also Read Secure Cloud Migration Guide – Technical and Business Considerations

With their further investigation on attack IP 80[.]211[.]232[.]43, it was identified that default MySQL server port 3306 was open and unexpectedly the server contains the default and weakest credential that every computer user know.

Username: root
Password: root

Ankit Anubhav said the database contains the login credentials of users who control’s the database and the time duration limit for users to utilize the bot for the DDoS attack.

“Some of them can be botnet creators or some can simply be the customers of the botnet, a.k.a black box users, who pay a sum of money to launch DDoS attacks.”

Ankit Anubhav points out that history tables show that bot has been used to launch a DDoS attack against various IP address and the next table is whitelist which contains no Ip address.

IoT botnet Owari

“This IP was not a standalone case with its database exposed via weak credentials. The MySQL database of another attack IP 80[.]211[.]45[.]89 was accessible with “root: root” credentials.”

He concluded that both IP’s are offline now, they aware “their IPs will be flagged soon due to the bad network traffic” and “to stay under the radar, they often voluntarily change attack IPs.”

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Threat Actor ProKYC Selling Tools To Bypass Two-Factor Authentication

Threat actors are leveraging a newly discovered deepfake tool, ProKYC, to bypass two-factor authentication...

Mozilla Warns Of Firefox Zero-Day Actively Exploited In Cyber Attacks

A critical use-after-free vulnerability affecting Firefox and Firefox Extended Support Release (ESR) is being...

SpyCloud Embeds Identity Analytics in Cybercrime Investigations Solution to Accelerate Insider and Supply Chain Risk Analysis & Threat Actor Attribution

IDLink, SpyCloud’s new automated digital identity correlation capability, is now core to its industry-leading...

Abusix and Red Sift Form New Partnership, Leveraging Automation to Mitigate Cyber Attacks

The agreement has marked over 600,000 fraudulent domains for takedown in just two months...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Critical PDF.js & React-PDF Vulnerabilities Threaten Millions Of PDF Users

A new critical vulnerability has been discovered in PDF.js, which could allow a threat...

LayerX Security Raises $26M for its Browser Security Platform, Enabling Employees to Work Securely From Any Browser, Anywhere

LayerX, pioneer of the LayerX Browser Security platform, today announced $24 million in Series...

Email Header Analysis – Verify Received Email is Genuine or Spoofed

Email Header Analysis highly required process to prevent malicious threats since Email is...