As scary as the epidemics of malware for Internet of Things devices have been, they had one saving grace: because they only lived in RAM (where they were hard to detect!), they could be flushed just by rebooting the infected gadget.
But a new strain of malware, dubbed "Hide n Seek," can live through a power-cycle: it writes a copy of itself to the /etc/init.d/ directory in the IoT device's embedded GNU/Linux system, where startup programs are stored. When a device that's been infected this way is rebooted, it is freshly infected.
Bitdefender experts first spotted the HNS malware and its adjacent botnet in early January, this year, and the botnet grew to around 32,000 bots by the end of the same month. Experts say HNS has infected 90,000 unique devices from the time of discovery until today.Crooks used two exploits to create their initial botnet, which was unique from other IoT botnets active today because it used a custom P2P protocol to control infected systems.
Now, experts have found new HNS versions that have added support not only for two other exploits [1, 2] but also for brute-force operations.
What this means is that HNS infected devices will scan for other devices that have an exposed Telnet port and attempt to log into that device using a list of preset credentials.
"Hide and Seek" Becomes First IoT Botnet Capable of Surviving Device Reboots [Catalin Cimpanu/Bleeping Computer]
