In early April embedded devices powered by Google Android, Linux and FreeBSD (specifically the BusyBox distribution) mainly used as media players and routers came under attack from a previously unseen form of malware.
How does this malware affect compromised devices?
Once compromised the device will cease functioning within seconds; an attack being called a PDoS (Permanent Denial of Service). This occurs since the malware corrupts the devices internal storage and reduces the number of kernel (defined) threads (sequences of independent in progress tasks) from several thousand to just one, causing the devices in progress tasks/work load to halt. Security firm Radware demonstrated this result with a webcam.
How does this malware initially compromise a device?
Since early April four unique versions of this malware (dubbed BrickerBot) have emerged. The first version attempted to compromise Radware’s test device almost 2,000 times within four days with the attacks originating from all over the world. The second and more advanced version uses Tor (The Onion Router) to enable attacks to take place from the Dark web (a portion of the internet only accessible using the Tor network). This makes tracing the source of the attacks almost impossible.
Versions 3 targets further devices while version 4 was active during a very briefly and ceased its activity after 90 attempted attacks. Radware provide more details in their analysis.
The malwares authors seek to gain control of vulnerable devices by attempting to access them over the internet via the Telnet protocol (defined, which uses TCP and UDP ports 23) by entering commonly used usernames and passwords until successful. If your network contains routers or music/media devices using the BusyBox distribution they are potentially vulnerable to this malware. Attackers can use tools such as Shodan (defined) to locate vulnerable devices over the internet and begin an attack.
How can I protect my devices from this malware?
Radware provide five steps you can take to better secure your internet of things (IoT , defined) devices from this malware. They also suggest the use of an IPS (defined) in this related blog post. The above recommendations are especially important since unlike other malware where you can re-format a hard disk and re-install the operating system (defined), this malware permanently damages the device and it will require a replacement.