Threat Actors Breach Consumer Devices to Build IoT Botnets
When Fortinet initially tracked HNS in early 2018, the malware was using complex, peer-to-peer communication to compromise routers, IP cameras and DVRs. Over the past several months, the creators added new capabilities. Now, HNS “targets cross-platform database solutions and smart home devices,” according to a July 2018 Fortinet threat report.
Trend Micro discovered a new exploit in early July that uses the Android Debug Bridge (ADB) command line utility, which automatically listens on port 5555, to create a mining botnet. While the threat is currently limited in scope because ADB is turned off by default, Shodan, a search engine for IoT devices, turned up 48,000 exploitable devices.