A new variant of Mirai based botnet called OMG was discovered turning infected IoT devices into proxy servers.According to researchers at FortiGuard Labs the new variant adds and removes some configuration found in the original Mirai variant.
A new variant of Mirai based botnet called OMG was discovered turning infected IoT devices into proxy servers. According to researchers at FortiGuard Labs the new variant adds and removes some configuration found in the original Mirai variant.The OMG retains Mirai’s original modules, including the attack, killer, and scanner modules. This means the new variant is also possible to do what the original Mirai could do like kill processes, (related to telnet, ssh, HTTP by checking open ports, and other processes related to other bots), telnet brute-force login to spread, and DOS attack.“This is the first time we have seen a modified Mirai capable of DDOS attacks as well as setting up proxy servers on vulnerable IoT devices. With this development, we believe that more and more Mirai-based bots are going to emerge with new ways of monetization” said in the blog post published by Fortinet.The main purpose of OMG is to turn IoT device to proxy servers which can be used by attackers to add anonymity while doing malicious activities and can earn money by selling access to these proxy servers to other cybercriminals.
Read more on: The Narrative is the Enemy: Cyber Crisis and Changing ParadigmsThe new variant adds a firewall rule to allow traffic to flow through randomly generated HTTP and SOCKS ports. Two strings were added to the configuration table containing the commands to add and remove the firewall rule.After enabling the firewall rule, It sets up 3proxy with predefined configuration embedded in its code.“We have also observed that the motivation for many of the modifications to Mirai is to earn more money. Mirai was originally designed for DDoS attack, but later modifications were used to target vulnerable ETH mining rigs to mine cryptocurrency. In this article we will discuss about how a Mirai-based bot called OMG turns an IoT device into a proxy serve” said Fortinet.