Forest Global Training Partners

Cyber Risks · Krebs on Security

IoT Devices as Proxies for Cybercrime

Summary: A researcher's honeypot simulating hackable Asus and Linksys routers with default credentials received traffic instructing it to download malware with two functions: beaconing an 'I'm here' registration to hard-coded addresses and listening for commands to scan for vulnerable hosts or run additional malware. The pushed malware turned the faux router into a SOCKS proxy server, and after decrypting traffic through additional honeypots, the researcher found the systems were used to proxy traffic to cybercrime forums and test stolen credit cards, with the proxies marketed on a criminal service selling SOCKS access for Bitcoin.

Bottom line: Hacked routers and other default-insecure IoT devices are being rented out as anonymizing proxies for credit card and tax refund fraud, and the source notes the same proxying likely extends to Internet-connected cameras and DVRs already conscripted into denial-of-service attacks.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related