Miori IoT Botnet

First observed in 2018 Miori is a Mirai malware.

Threat ID:: CC-3143
Category:: Worm, Botnet
Threat Severity:: Low
Threat Vector:: Exploit
Published:: 11 July 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

First observed in 2018 Miori is a Mirai malware.

Affected platforms

The following platforms are known to be affected:

OpenSSL

IoT devices

ThinkPHP - Versions earlier than 5.0.23 and 5.1.31

Threat details

Miori can spread via exploitation of a ThinkPHP remote code execution vulnerability or by brute-force attacks on open Telnet ports.

Once access has been gained, Miori will attempt to connect to a command and control server (C2) using a text-based protocol for encryption, rather than the binary-based version used by other Mirai variants. Affected hosts are then enrolled into a botnet, which is then used to perform distributed denial of service attacks. Miori can also be used to execute malicious scripts on hosts.

For further information:

CVE-2018-20062

Remediation steps

Type	Step
	Telnet is inherently insecure and has been superseded by several other protocols, including SSH. If Telnet is not required, then port 23 (TCP) should be closed. If Telnet is required, please ensure: A security extension such as Transport Layer Security (TLS) or Simple Authentication and Security Layer (SASL) is used where possible. Connections using Telnet are tunnelled through a secure virtual private network (VPN). To protect against a distributed denial-of-service (DDoS) attack, organisations should ensure: They have suitable DDoS mitigation tools. They have a suitable DDoS mitigation plan in place. Should an organisation suspect it is subject to an active DDoS attack, they should ensure that every effort is made to stop the attack and restore service. However, care should be taken to ensure that the attackers are not using the DDoS attack as a distraction whilst other, potentially more sensitive, systems are exploited. Monitoring of critical systems is recommended, including the use of host-based intrusion prevention and detection systems (HIPS/HIDS) where appropriate.

Type

Step

Telnet is inherently insecure and has been superseded by several other protocols, including SSH. If Telnet is not required, then port 23 (TCP) should be closed.
If Telnet is required, please ensure:

A security extension such as Transport Layer Security (TLS) or Simple Authentication and Security Layer (SASL) is used where possible.
Connections using Telnet are tunnelled through a secure virtual private network (VPN).

To protect against a distributed denial-of-service (DDoS) attack, organisations should ensure:

They have suitable DDoS mitigation tools.
They have a suitable DDoS mitigation plan in place.

Should an organisation suspect it is subject to an active DDoS attack, they should ensure that every effort is made to stop the attack and restore service. However, care should be taken to ensure that the attackers are not using the DDoS attack as a distraction whilst other, potentially more sensitive, systems are exploited. Monitoring of critical systems is recommended, including the use of host-based intrusion prevention and detection systems (HIPS/HIDS) where appropriate.

CVE Vulnerabilities

Status

CVE-2018-20062

Last edited: 14 February 2020 2:53 pm