{"id":27494,"date":"2019-06-25T19:56:00","date_gmt":"2019-06-25T19:56:00","guid":{"rendered":"http:\/\/f707690d-06ea-40a6-8e21-7c6a2e37c5a7"},"modified":"2019-06-25T19:56:00","modified_gmt":"2019-06-25T19:56:00","slug":"new-silex-malware-is-bricking-iot-devices-has-scary-plans","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/new-silex-malware-is-bricking-iot-devices-has-scary-plans\/","title":{"rendered":"New Silex malware is bricking IoT devices, has scary plans"},"content":{"rendered":"

\"Silex\"<\/span><\/p>\n

A new strain of malware is wiping the firmware of IoT devices in attacks reminiscent of the old BrickerBot malware that destroyed millions of devices back in 2017.<\/p>\n

Named Silex, this malware began operating earlier today, about three-four hours before this article’s publication.<\/p>\n

The malware had bricked around 350 devices when this reporter began investigating its operations, and the number quickly spiked to 2,000 wiped devices by the time we published, an hour later.<\/p>\n

Attacks are still ongoing, and according to an interview with the malware’s creator, they are about to intensify in the coming days.<\/p>\n

How the Silex malware works<\/h3>\n

According to Akamai researcher Larry Cashdollar<\/a>, who first spotted the malware earlier today<\/a>, Silex works by trashing an IoT device’s storage, dropping firewall rules, removing the network configuration, and then halting the device.<\/p>\n

It’s as destructive as it can get without actually frying the IoT device’s circuits. To recover, victims must manually reinstall the device’s firmware, a task too complicated for the majority of device owners.<\/p>\n

It’s expected that some owners will most likely throw devices away, thinking they’ve had a hardware failure without knowing that they’ve been hit by malware.<\/p>\n

\"Silex<\/span>

\"Silex<\/span><\/p>\n

<\/noscript> Image: Larry Cashdollar<\/span><\/p>\n

\n<\/section>\n

“It’s using known default credentials for IoT devices to log in and kill the system,” Cashdollar told ZDNet<\/em> in an email today. “It’s doing this by writing random data from \/dev\/random<\/em> to any mounted storage it finds.<\/p>\n

“I see in the binary it’s calling fdisk -l<\/em> which will list all disk partitions,” Cashdollar added. “It then writes random data from \/dev\/random<\/em> to any partitions it discovers.”<\/p>\n

“It’s then deleting network configurations, […] also, it’s [running] rm -rf \/<\/em> which will delete anything it has missed.”<\/p>\n

“It also flushes all iptables entries adding one that DROPS all connections. Then halting or rebooting the device,” the researcher said.<\/p>\n

Attacks carried out from Iranian server<\/h3>\n

“It’s targeting any Unix-like system with default login credentials,” Cashdollar told us. “The binary I captured targets ARM devices. I noticed it also had a Bash shell version available to download which would target any architecture running a Unix like OS.”<\/p>\n

This also means Silex will trash Linux servers if they have Telnet ports open and if they’re secured with poor or widely-used credentials.<\/p>\n

“It appears the IP address that targeted my honeypot is hosted on a VPS server owned by novinvps.com, which is operated out of Iran,” Cashdollar said when we inquired about the source of these attacks.<\/p>\n

At the time of writing, the IP address<\/a> has already been added on the URLhaus blacklist, after being reported by IoT malware researcher Rohit Bansal<\/a>.<\/p>\n

Who’s behind the Silex malware?<\/h3>\n

With the help of NewSky Security researcher Ankit Anubhav<\/a>, ZDNet<\/em> reached out to the Silex malware author with a series of questions about his motives and grand master plan.<\/p>\n

According to Anubhav, responsible for this destructive malware is a 14-year-old teenager going online by the pseudonym of Light Leafon.<\/p>\n

Anubhav confirmed the hacker’s identity by having him put a custom message on the Silex command and control (C&C) server, verifying that we were indeed talking to the actual Silex operator.<\/p>\n

Prior to today, Light had created the HITO IoT botnet, and had been interviewed a month ago on an episode of Anubhav’s podcast on IoT botnets and security.<\/p>\n