New Botnet Targets Android Set-Top Boxes

Thousands of Android set-top boxes of the sort used by people to stream media from Hulu, Netflix, and other services have been infected with malware and become part of a growing botnet of similarly compromised devices.

Internet of Things (IoT) security vendor WootCloud, which discovered the threat, has dubbed it the ARES ADB botnet. The botnet is being used as a launchpad to trigger multiple attacks such as brute-force password cracking, denial-of-service attacks, and cryptomining.

In a report this week, WootCloud described the botnet as targeting Android Debug Bridge (ADB), a management component on Android devices that enables debugging and remote management operations.

The ADB service is often left open and unauthenticated on many Internet-connected Android devices, giving attackers a way to access them and take full administrative control. "Accessing the device through TCP port 5555 results in obtaining shell which allows remote command execution, uploading/downloading of custom applications, data access," and other activity, WootCloud warns.

The ARES botnet is the latest sign of attackers targeting vulnerable non-computer IoT devices to build botnets for a variety of malicious purposes. Following the Mirai botnet attacks of 2016, attackers have been actively targeting home routers, security cameras, DVRs, smart TVs, and other Internet-connected devices, which often have weak to no security protections. Many of these devices often provide unauthenticated remote access or are protected only with default passwords and cannot be easily patched or updated. Though many of the devices individually have little computing power, attackers are often able to infect tens of thousands of them at the same time to build botnets capable of doing considerable damage.

With the latest threat, attackers are actively exploiting the ADB configuration issue to install the ARES bot on Android-based set-top boxes from several vendors, including HiSilicon and Cubetek. Once the bot gets installed on a device, it starts scanning for other set-top boxes with similarly misconfigured ADB interfaces and then installs payloads for triggering additional attacks.

Most infections so far have been in South Asia and the broader Asia-Pacific region. The command-and-control servers with which infected devices have been communicating have been observed at multiple locations, including North America.

Potentially Major Impact
Srinivas Akella, founder and chief technology officer at WootCloud, says the ARES botnet poses a potentially major threat to the growing number of other Android-based set-top boxes that consumers and enterprises are using. "This botnet has the potential to affect smart TVs and other IoT devices that have a misconfigured ADB," he says.

With standard Android images, the ADB is not enabled by default. However, several set-top boxes that are available today are running customized versions of the Android OS, which have been rooted and have ADB enabled by default, he says.

To protect against the ADB being misused in cases where it is left enabled, routers can be configured to block the ingress and egress network traffic to TCP port 5555, which is the port that ADB uses.

Enterprises should also configure their network policies to restrict ingress and egress network traffic to IoT devices. "Restrict the ADB interface on the IoT devices to authorized IP address space," he says. "Monitor the ADB interface traffic originating from unknown resources, including the network traffic originating from these devices."

Organizations should also ensure that interfaces on IoT devices such as telnet and SNMP are properly protected with strong passwords to prevent unauthorized access, Akella says.

Home users of vulnerable set-top boxes may have a slightly harder time mitigating the risk. A lot depends on the design of the set-top box and whether the vendor provides an option to disable ADB functionality. When the option is not available, "home users will need to have technical acumen to disable the ADB functionality either by setting up their routers to block traffic," Akella says, "or by logging in to the device and disabling ADB services on the command prompt."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Fuzzing 101: Why Bug-Finders Still Love It After All These Years."