This week, the US government-backed ICS-CERT warned that the troubling new generation of computer attacks is powered by malware that can infect cellular modems used to connect automotive and industrial equipment to the Internet.
An advisory published Wednesday listed five industrial control devices manufactured by Sierra Wireless that are vulnerable to malware known as Mirai when default passwords that ship with the equipment aren't changed on the gateways. The advisory referenced a separate notice from Sierra Wireless (PDF) that reported infections have succeeded against actual devices by connecting to the ACEmanager, a graphical interface used to remotely administer and configure them.
The Sierra Wireless post stated:
Sierra Wireless has confirmed reports of the "Mirai" malware infecting AirLink gateways that are using the default ACEmanager password and are reachable from the public internet. The malware is able to gain access to the gateway by logging into ACEmanager with the default password and using the firmware update function to download and run a copy of itself.
Wednesday's CERT advisory urged device owners who haven't changed factory default login credentials to do so immediately. Sierra Wireless also recommended customers disable various types of remote access on the devices if they're not needed. When such access is required, the company suggested customers use a measure known as port forwarding and disable settings known as DMZ Host and Public Mode whenever possible.
Over the past month or so, Mirai has infected hundreds of thousands of networked cameras and other so-called Internet of Things devices. It then corrals them into networks that bombard websites with so much data they can't be accessed by legitimate visitors. Mirai is currently one of two known IoT botnet engines that has infected at least 1.2 million devices and is creating some of the biggest distributed denial-of-service attacks ever recorded. The Mirai source code was released to the public two weeks ago, an event that could make the scourge even worse.
Earlier this week, content delivery network Akamai reported that malicious hackers are expanding the types of activities carried out by the IoT devices they infect. Whereas once-compromised devices were mainly used in DDoS attacks, Akamai researchers have unearthed evidence that millions of devices are being used to break into corporate networks using a technique known as credential stuffing.
Neither the CERT advisory nor the Sierra Wireless report mentioned Bashlight, the other IoT malware contributing to the record DDoS attacks. It's a fair bet that, if Mirai can infect the wireless gateways, its Bashlight rival can, too. Don't be surprised if wireless gateways from other manufacturers are similarly vulnerable.
The CERT advisory says once Mirai infects a gateway it deletes itself and runs only in memory. That means users can disinfect a device by restarting it. The group warned, however, that the device will likely be reinfected unless its default password is changed. The only obvious signs a device has been compromised are the presence of abnormal traffic flowing over ports 23 and 48101 and, in the event the device is participating in a DDoS attack, a large amount of outbound traffic.
The specific Sierra models covered in the CERT advisory are:
LS300, GX400, GX/ES440, GX/ES450, and RV50The Shodan search engine showed more than 30,000 of the affected Sierra Wireless devices were connected to the Internet, some of which were remotely accessible by telnet or similar protocols.
This post originated on Ars Technica