This unusual new IoT botnet is spreading rapidly via peer-to-peer communication

Video: The Internet of Things must be futureproofed

A new Internet of Things botnet is the first of its kind to use custom-built peer-to-peer communication to spread to new targets.

Dubbed Hide 'N Seek (HNS) by the researchers at security company Bitdefender, the botnet first appeared in early January before disappearing then re-emerging on January 20.

The botnet communicates between devices using a decentralised peer-to-peer mechanism. It uses the same exploit as the Reaper botnet to infect devices, although there's currently no indication that the two armies of hijacked machines are related.

While Hide 'N Seek isn't the first botnet to have a peer-to-peer element -- the Hajime botnet used P2P architecture -- but rather than being constructed around a existing BitTorrent protocol, HNS uses a custom-built P2P system.

Equipped to carry out commands including data exfiltration, code execution, and interfering with a device's operation, initial reports said 2,700 devices were infected by the malware as of the end of January 23.

Now, under 48 hours later, the figure is thought to be over 24,000, and the botnet has spread around the globe. This is a network which just days ago was only made up of 12 devices in South-East Asia.

Many of the initial infections appear to be based around IP cameras made by a South Korean manufacturer, but the botnet isn't specifically targeting these devices; this only appears to be an initial starting point for carrying out attacks against other hardware.

The HNS botnet spreads via the use of a worm-like mechanism which generates IP addresses at random, before attempting a raw socket SYN connection to each of the devices on the list. If successful, the bot looks for the 'buildroot login' banner presented by the device and attempts to login with a set of predefined credentials.

If this isn't successful, the attack uses a form of brute force in the form of a dictionary attack, attempting to pair together words from a hardcoded list in order to crack the device passcode.

See also:What is the IoT? Everything you need to know about the Internet of Things right now

Once successfully penetrated, the bot runs a process to identify what the target device is and how to further compromise it. For example, if additional targets are on the same LAN as the bot, it sets up a TFTP (Trivial File Transfer Protocol) server to deliver additional malware.

Meanwhile, if the victim is infiltrated via the internet, the bot uses remote payload delivery to get the victim to download the malware. All the exploitation techniques are preconfigured and are located in a digitally signed memory location in order to prevent the code from being tampered with.

Once a device is infected, the malware can take control of it and use commands to do as it pleases -- and it's for far more than carrying out DDoS attacks.

"The infection agents include a state machine that identifies what device or operating system it infected, thus enabling the botnet owner to execute a command like exfiltrate the wifi.conf file from all devices of a certain type. Long story short, the attacker can request any file they want from the infected systems," Alex Balan, chief security researcher at Bitdefender, told ZDNet.

While some malicious botnets have previously been disabled once the main server was taken down, in the case of Hide 'N Seek, this approach is much more difficult because its peer-to-peer nature means there's no central command unit to hunt for when looking to disrupt it.

"Each infection is also a command and control server, file server and platform for redistribution," said Balan.

Download now: Research: Defenses, response plans, and greatest concerns about cybersecurity in an IoT and mobile world

The rapid expansion of the Hide 'N Seek botnet is accompanied by constant redesign, indicating that it is likely the work of a sophisticated hacking group.

In order to have the best chance of preventing IoT devices being roped into a malicious botnet, it's important to ensure that -- if possible -- the default password of the product is changed to something complex.

Recent and related coverage

Security flaw in LG IoT software left home appliances vulnerable

LG has updated its software security after researchers found flaw that left dishwashers, washing machines, air conditioners, and even a robot vacuum cleaner accessible by hackers.

Arm announces PSA security architecture for IoT devices

Arm hopes the adoption of its new PSA system will help protect trillions of connected devices in the future.

How IoT network standards can influence security

Chris Penrose, president of IOT solutions at AT&T, explains the security factors that influenced AT&T's decision to deploy LTE-M networks.

Security flaws in children's smartwatches make them vulnerable to hackers

It's another IoT security flaw - attackers can hack smartwatches to monitor the wearer's location, eavesdrop on conversations or even communicate with the child.

READ MORE ON CYBERCRIME

• Satori IoT botnet malware code given away for Christmas
• 120,000 IoT cameras vulnerable to new Persirai botnet say researchers
• Your internet connected cameras and DVRs could attack you [CNET]
• Botnets: Inside the race to stop the most powerful weapon on the internet
• The future of cyberwar: Weaponised ransomware, IoT attacks and a new arms race [TechRepublic]