Report warns of users caught in the middle of new cybercrime turf war

HONG KONG, CHINA - Media OutReach - 16 July 2020 - Trend Micro Incorporated(TYO: 4704; TSE: 4704), theglobal leader in cloud security, todayreleased new research warning consumers of a major new wave of attacksattempting to compromise their home routers for use in IoT botnets. The reporturges users to take action to stop their devices from enabling this criminalactivity.

There has been a recent spike in attacks targeting and leveragingrouters, particularly around Q4 2019. This research indicates increased abuseof these devices will continue as attackers are able to easily monetize theseinfections in secondary attacks.

"With a large majority of the population currently reliant on homenetworks for their work and studies, what's happening to your router has neverbeen more important," said Jon Clay, director of global threatcommunications for Trend Micro. "Cybercriminals know that a vast majorityof home routers are insecure with default credentials and have ramped upattacks on a massive scale. For the home user, that's hijacking their bandwidthand slowing down their network. For the businesses being targeted by secondaryattacks, these botnets can totally take down a website, as we've seen in pasthigh-profile attacks."

Trend Micro's research revealed an increase from October 2019 onwardsin brute force log-in attempts against routers, in which attackers useautomated software to try common password combinations. The number of attemptsincreased nearly tenfold, from around 23 million in September to nearly 249million attempts in December 2019. As recently as March 2020, TrendMicro recorded almost 194 million brute force logins.

Another indicator that the scale of this threat has increased is devicesattempting to open telnet sessions with other IoT devices. Because telnet isunencrypted, it's favored by attackers -- or their botnets -- as a way to probefor user credentials. At its peak, in mid-March 2020, nearly 16,000devices attempted to open telnet sessions with other IoT devices in a singleweek.

This trend is concerning for several reasons. Cybercriminals arecompeting with each other to compromise as many routers as possible so they canbe conscripted into botnets. These are then sold on underground sites either tolaunch Distributed Denial of Service (DDoS) attacks, or as a way to anonymizeother attacks such as click fraud, data theft and account takeover.

Competition is so fierce that criminals are known to uninstall anymalware they find on targeted routers, booting off their rivals so they canclaim complete control over the device.

For the home user, a compromised router is likely to suffer performance issues.If attacks are subsequently launched from that device, their IP address mayalso be blacklisted -- possibly implicating them in criminal activity andpotentially cutting them off from key parts of the internet, and even corporatenetworks.

As explained in the report, there's a thriving black market in botnetmalware and botnets-for-hire. Although any IoT device could be compromised andleveraged in a botnet, routers are of particular interest because they areeasily accessible and directly connected to the internet.

Trend Micro makes the following recommendations for home users:

• Make sure you use a strong password. Change it fromtime to time.
• Make sure the router is running the latestfirmware.
• Check logs to find behavior that doesn't make sensefor the network.
• Only allow logins to the router from the localnetwork.

To read the complete report, please visit: https://www.trendmicro.com/vinfo/hk/security/news/internet-of-things/caught-in-the-crossfire-defending-devices-from-battling-botnets 

About Trend Micro

Trend MicroIncorporated, a global leader in cybersecurity solutions, helps to make theworld safe for exchanging digital information. Our innovative solutions forconsumers, businesses, and governments provide layered security for datacenters, cloud environments, networks, and endpoints. All our products worktogether to seamlessly share threat intelligence and provide a connected threatdefense with centralized visibility and control, enabling better, fasterprotection. With more than 6,000 employees in over 50 countries and the world'smost advanced global threat intelligence, Trend Micro secures your connectedworld. For more information, visit www.trendmicro.com.hk.