Attacks using IoT devices and Windows SMB escalate in 2019

Attacks using IoT devices and Windows SMB escalate in 2019
12.09.2019 09:44 am

Attacks using IoT devices and Windows SMB escalate in 2019

Security and Compliance , Security

Cyber criminals upped the intensity of IoT and SMB-related attacks in the first half of 2019, according to a new F-Secure report, “Attack Landscape H1 2019”. The report underscores the threats IoT devices face if not properly secured when online, as well as the continued popularity of EternalBlue and related exploits two years after WannaCry.

F-Secure's honeypots – decoy servers that are set up to lure in attackers for the purpose of collecting information – measured a twelvefold increase in such events compared to the same period a year ago. The increase was driven by traffic targeting the Telnet and UPnP protocols, which are used by IoT devices, as well as the SMB protocol, which is used by the Eternal family of exploits to propagate ransomware and banking Trojans.

Telnet traffic accounted for the largest share of traffic for the period, with over 760 million attack events logged, or around 26 percent of traffic. UPnP was the next most frequent, with 611 million attacks. SSH, which is also used to target IoT devices, had 456 million attacks. Likely sources of this traffic are IoT devices infected with malware such as Mirai, which was also the most common malware family seen by the honeypots. Mirai infects routers, security cameras, and other IoT devices that use factory default credentials.

Traffic to SMB port 445 accounted for 556 million attacks. The high level of SMB traffic is an indication that the Eternal family of exploits, the first of which was used in the devastating WannaCry ransomware outbreak of 2017, is still alive and well, trying to ravage millions of still-unpatched machines.

“Three years after Mirai first appeared, and two years after WannaCry, it shows that we still haven’t solved the problems leveraged in those outbreaks,” said F-Secure Principal Researcher Jarno Niemela. “The insecurity of the IoT, for one, is only getting more profound, with more and more devices cropping up all the time and then being co-opted into botnets. And the activity on SMB indicates there are still too many machines out there that remain unpatched.”

Related News

ICA to Host the BIGGEST Online Event for Compliance Professionals in 2020

The International Compliance Association (ICA), the leading professional body for the global regulatory and financial crime compliance community, is organising ‘The BIG... Read more »

UK prof body partners Philippines in efforts to help eradicate money laundering & terrorism financing

The Chartered Institute for Securities & Investment (CISI) has announced a key project in the Philippines to support the country’s compliance with anti-... Read more »

Wolters Kluwer Continues PPP Educational Series With Loan Forgiveness Webinar

Wolters Kluwer Compliance Solutions is continuing to prove its industry leadership,... Read more »

Verizon Report Shows Money Still Makes the Cyber-crime World Go Round

The Verizon Business 2020 Data Breach Investigations Report (2020 DBIR) shows that financial gain remains the key driver... Read more »

Wolters Kluwer develops TSoftPlus Technology for loan forgiveness stage of U.S. Paycheck Protection Program

Wolters Kluwer Compliance Solutions is set to help local lenders and their small... Read more »

Enfuce Provides Turn-key PSD2 Compliance Services to OP Financial Group in Estonia, Latvia, and Lithuania

 Finland’s biggest fintech start-up Enfuce provides full PSD2 compliance as a service to Finland’s largest financial services group, OP Financial Group, in the Baltic states.... Read more »

Magazine
ALL
Free Newsletter Sign-up
+44 (0) 208 819 32 53 +44 (0) 173 261 71 47
Download Our Mobile App
Financial It Youtube channel