{"id":21181,"date":"2017-11-16T13:06:07","date_gmt":"2017-11-16T09:06:07","guid":{"rendered":"http:\/\/www.intelligentcio.com\/me\/?p=21181"},"modified":"2017-11-16T13:06:07","modified_gmt":"2017-11-16T09:06:07","slug":"cyber-security-alert-should-you-fear-the-reaper","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/me\/2017\/11\/16\/cyber-security-alert-should-you-fear-the-reaper\/","title":{"rendered":"Cyber Security Alert: Should you fear the reaper?"},"content":{"rendered":"

By Mohammed Al-Moneer, Regional Director, MENA at A10 Networks<\/em><\/strong><\/p>\n

Move over Mirai. There\u2019s a new monstrous botnet in town.<\/p>\n

The newly-discovered botnet, dubbed \u2018Reaper\u2019 or \u2018IoTroop\u2019 appears to be a more powerful strain of Internet of Things (IoT) attack malware than Mirai, the previous holder of the IoT botnet crown.<\/p>\n

And while Reaper hasn\u2019t yet to launch an attack, security researchers warn that it may only be a matter of time.<\/p>\n

Researches from Check Point announced their discovery of Reaper on October 19, claiming that it may have already infected \u201can estimated million organisations\u201d and could potentially \u201ctake down the internet.\u201d The new malware, Check Point wrote, is \u201cevolving and recruiting IoT devices at a far greater pace and with more potential damage than the Mirai botnet of 2016.\u201d<\/p>\n

Where Mirai used factory-default or hard-coded usernames and passwords to infiltrate and eventually take control of IoT devices, Reaper exploits known security vulnerabilities across IoT device makers, such as AVTECH, D-Link, Netgear, Linksys and more, according to KrebsonSecurity. Netlab 360 listed the vulnerabilities Reaper exploits in a blog post.<\/p>\n

The Reaper worm is designed to spread from one infected device to another.<\/p>\n

Infiltrating IoT<\/strong><\/p>\n

What makes Reaper and other IoT-based attacks particularly scary is their breadth and sophistication. For example, IoT attacks don\u2019t rely on spoofing to create wide attacks, instead, they are real endpoints with real IP addresses, making it more difficult to block each individual device that is sending attack traffic. Additionally, IoT attacks are widely distributed globally and each IP has to be treated differently \u2013 an organisation can\u2019t just block a network segment or a country\u2019s IP range to defend against it.<\/p>\n

And IoT attacks can have a wider breath of attacking capabilities than traditional attack strategies. For example, previous huge volume attacks used reflection (such as DNS or NTP) to create volume, meaning thousands of open resolvers (DNS reflection case) would be tricked into generating a huge traffic load. IoT attacks, on the other hand, have a vast swathe; millions of IoT devices can each generate individual traffic that can swell into gargantuan attacks \u2013 think of it as a wake building into a tidal wave.<\/p>\n

And while there have been no confirmed reports of Reaper being used to carry out an attack, the potential for DDoS (Distributed Denial of Service) attacks looms, especially considering that Mirai was used to launch some of the largest DDoS attacks on record, including attacks up to and exceeding 1 Tbps.<\/p>\n

\u201cIt is too early to guess the intentions of the threat actors behind it, but with previous Botnet DDoS attacks essentially taking down the Internet, it is vital that organisations make proper preparations and defense mechanisms are put in place before an attack strikes,\u201d Check Point wrote.<\/p>\n

Protect Yourself<\/strong><\/p>\n

Should Reaper take the same track as Mirai and be leveraged to launch IoT-fueled DDoS attacks, it\u2019s important to be protected.<\/p>\n

High-performance DDoS detection and mitigation are must-haves in the battle against IoT botnets and the sophisticated multi-vector DDoS attacks they power. Organisations need swift, surgical detection and rapid mitigation to ensure services aren\u2019t disrupted and that legitimate traffic can still get through during wartime.<\/p>\n

It is imperative for DDoS defence solutions to understand traffic patterns and behaviours to block anomalous traffic while allowing real user traffic to continue to pass through. Identifying and analysing threats quickly is also necessary.<\/p>\n

And for additional real-time protection, organisations should implement a hybrid DDoS protection model that combines the power of on-premise DDoS defense with cloud capabilities to combat high-volume DDoS attacks.<\/p>\n

Update IoT Devices<\/strong><\/p>\n

Another preventative measure is to update your devices. Updating IoT devices with new code and turning off features that involve WAN-based administration can help protect devices from Reaper, should it become active.<\/p>\n

While Mirai was primed with a list of default usernames and passwords of devices throughout the internet, Reaper uses a set of exploits seen in various devices, meaning that without any knowledge of a username or password, someone may be able to get in by leveraging one of these exploits.<\/p>\n

Failing to update devices and turn off WAN-style features could leave your admin password exposed, regardless of how complex it is.<\/p>\n

  \t<\/p>\n","protected":false},"excerpt":{"rendered":"

By Mohammed Al-Moneer, Regional Director, MENA at A10 Networks Move over Mirai. There\u2019s a new monstrous botnet in town. The newly-discovered botnet, dubbed \u2018Reaper\u2019 or \u2018IoTroop\u2019 appears to be a more powerful strain of Internet of Things (IoT) attack malware than Mirai, the previous holder of the IoT botnet crown. And while Reaper hasn\u2019t yet […]<\/p>\n","protected":false},"author":18,"featured_media":21182,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,139,809,13,79],"tags":[247,2984,4278,22,1832,292,138,577,315,284,4279,562,4280,4281,4282],"class_list":["post-21181","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-industry-expert","category-more-news","category-top-stories","category-used","tag-a10-networks","tag-botnet","tag-check-point","tag-cloud","tag-cyber-attack","tag-cyber-attacks","tag-cyber-security","tag-ddos","tag-internet-of-things","tag-iot","tag-iotroop","tag-middle-east","tag-mirai","tag-mohammed-al-moneer","tag-reaper"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/21181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/comments?post=21181"}],"version-history":[{"count":0,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/21181\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media\/21182"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media?parent=21181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/categories?post=21181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/tags?post=21181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}