Trend Micro Incorporated detected a new Internet of Things (IoT) botnet malware called Persirai. It was recently discovered targeting over 120,000 Internet Protocol (IP) cameras that are vulnerable to Persirai via Shodan. Many of these vulnerable users are unaware that their IP Cameras are exposed to the internet which makes it significantly easier for the perpetrators behind the malware to gain access to the IP Camera web interface via TCP Port 81. Trend Micro also provides solutions to protect against this threat.
IP Cameras typically use Universal Plug and Play (UPnP), which are network protocols that allow devices to open a port on the router and act like a server, making them highly visible targets for IoT malware. After logging into the vulnerable interface, the attacker can perform a command injection to force the IP Camera to connect to a download site via commands. After receiving commands from the server, the IP Camera will then start automatically attacking other IP Camera…
IP Cameras typically use Universal Plug and Play (UPnP), which are network protocols that allow devices to open a port on the router and act like a server, making them highly visible targets for IoT malware. After logging into the vulnerable interface, the attacker can perform a command injection to force the IP Camera to connect to a download site via commands. After receiving commands from the server, the IP Camera will then start automatically attacking other IP Camera…