The Growing Threat: Botnets Rapidly Exploit Published PoCs

Attackers Quickly Utilize Proof-of-Concept Code for Real-World Attacks

A recent study conducted by researchers at Trustwave reveals that attackers are able to swiftly turn published proof-of-concept (PoC) code into workable exploits. The researchers deployed honeypots designed to mimic common enterprise appliances and found that attackers began exploiting vulnerabilities within days or weeks of the release of PoC code. This data highlights the alarming speed at which attackers can reverse engineer patches and develop their own exploits.

The Research Findings

During the experiment, Trustwave collected data from honeypots that emulated five common enterprise appliances. The researchers discovered that attackers began exploiting one vulnerability within six days of the release of PoC code and another vulnerability within 17 days. Overall, exploit scans accounted for 25% of HTTP and HTTPS requests, while actual attacks accounted for 19% of traffic to the newly created servers.

The study also revealed that almost all the attacks originated from three specific botnets: Mozi, Mirai, and Kinsing. These botnets primarily focus on Internet of Things (IoT) and edge devices such as managed file servers, mail servers, network gateways, and industrial control systems. Mozi, Mirai, and Kinsing exploit vulnerabilities in network gateway appliances and networking devices.

Botnet Breakdown

Of the 19% of traffic that attempted to exploit the honeypots, 73% came from the Mozi botnet, 14% from the Kinsing botnet, and 9% from the Mirai botnet. It is worth noting that these botnets have adapted their operations to specifically target IoT devices due to their historically low security priority. As a result, IoT devices now make up a significant portion of the internet landscape and are considered ideal targets for attackers.

Implications and Advice

The Trustwave study highlights the need for companies to stay vigilant and proactive in addressing vulnerabilities. Ziv Mador, the Vice President of Security Research at Trustwave, emphasizes the importance of promptly applying patches and assuming that attackers will be able to reverse engineer any fix. Additionally, organizations should prioritize the patching of devices for which PoC exploits have been released or are actively being targeted.

Furthermore, Mador suggests that companies should consider deploying their own honeypots. Honeypots act as additional layers of defense and can provide valuable insights into attackers’ tactics and techniques. They offer a proactive approach to gain visibility into attacks that may not be detected by existing security measures.

The Role of IoT Devices

The rapid expansion of IoT devices, combined with the historically low priority placed on their security, has made them prime targets for botnets like Mozi, Mirai, and Kinsing. Allen West, a security researcher with Akamai, emphasizes that IoT devices, regardless of their primary purpose, can be utilized as powerful tools by attackers if they can send traffic. This realization has driven attackers to build their operations around exploiting vulnerabilities in IoT devices.

A Call for Increased Security

The prevalence of automated attacks and the speed with which attackers utilize exploit code underscores the urgent need for enhanced security measures. Organizations must prioritize the security of their IoT and edge devices, allocating resources to patch vulnerabilities promptly. Additionally, the collaboration between security professionals, researchers, and manufacturers is crucial in developing secure IoT devices and protecting against emerging threats.

The Importance of Security Awareness

Individuals and organizations alike should be aware of the constant stream of newly discovered vulnerabilities. Staying informed about potential threats enables proactive measures and timely patching, minimizing the window of opportunity for threat actors. With the ever-evolving landscape of cybersecurity, it is essential to prioritize security awareness and take active steps to protect against emerging threats.