Level 3 Threat Research Labs tracked a family of malware, variously called Lizkebab, BASHLITE, Torlus and Gafgyt, that is capable of causing IoT-based DDoS attacks. The BASHLITE malware family has been around for a while and has many variants.

L3 has been working with security firm Flashpoint to observe the growth of the botnet, which the malware uses to carry out its attack. Threatpost reported that in July, the researchers tracked command-and-control (C&C) locations that were linked to the malware and found that they were communicating with only 74 bots. At a later time, the researchers observed the C&C servers communicating with about 120,000 bots.

BASHLITE Malware Targets IoT Devices

L3 noted in the report that cybercrime groups such as Lizard Squad and Poodle Corp are increasingly targeting IoT devices with which to build botnets that can conduct DDoS attacks. They can use these botnets themselves, or they may rent them to individuals as booter or stresser services (i.e., DDoS-as-a-service). These bot herders favor security camera DVRs, which are used to collect video from security cameras, since most video devices are connected to a network.

A large percentage of the 1 million infected devices were located in Taiwan, Brazil and Colombia, L3 reported. It seems many of these bots were using generic, white-labeled DVRs.

The report basically found that a stripped-down device with no true authentication control (or an admin/admin default screen hiding somewhere) can be transformed into a willing servant with the right malware.

Big Shift in Botnet Composition

Ninety-six percent of the botnet devices used by this malware were IoT devices. Roughly 4 percent of the devices were home routers; somewhat surprisingly, less than 1 percent were tied to a Linux server.

The researchers noted that this distribution represents a large shift in the composition of botnets, compared to the traditional DDoS botnet models based on compromised servers and home routers.

The actual DDoS attacks are simple UDP and TCP floods. High-bandwidth attacks are more often used in UDP floods, while high packets-per-second attacks are typically used for TCP floods.

Fortunately, L3 found that most of the attacks are short-lived. The median duration was just over two minutes, and 75 percent of the attacks timed out shorter than five minutes.