IoT Bot Landscape Expands, Attacks Vary by Country

New report finds 1,005 new user names and passwords beyond Mirai’s original default list two years ago.

Roughly two years after the Mirai Internet of Things (IoT) bot took down the Internet for much of the eastern United States and parts of Europe, Netscout security researchers have found that the bot landscape has expanded considerably.
By setting honeypots across North America, South America, Europe, and Asia, researchers observed nearly 200,000 brute-force attacks from Sept. 1 through Sept. 30, according to Matt Bing, a security research analyst at Netscout. The team found 1,005 additional user name and password combinations beyond Mirais original default list of 60.
A lot of what we were trying to do is find out what has changed from the original Mirai source code from the fall of 2016 and how it has expanded, Bing explained in a
blog post
today. We found they were looking to attack new and different types of IoT devices, such as webcams and travel routers. The first Mirai attacks focused on DVRs.
Bing said the researchers also found trends specific to certain regions. For example, root/20080826 was found in Russia on a travel router widely used there, while telecomadmin/admintelecom was prevalent in China, where that user name and password combo is found on widely used Huawei routers.
We also found that when bots using specific manufacturer default passwords would infect devices, they would launch attacks from those compromised devices, Bing said.
Given this new information, Bing advised security pros to keep their IoT devices up to date and behind a firewall. Home users should place their IoT devices behind a home router.
Wed also suggest companies use honeypots to understand the landscape and gain insights into where these IoT attacks are headed, Bing said.
Related Content:
Gartner Experts Highlight Tech Trends – And Their Security Risks
New Security Woes for Popular IoT Protocols
7 Serious IoT Vulnerabilities
FBI Offers New IoT Security Tips

Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
IoT Bot Landscape Expands, Attacks Vary by Country