Security researchers are warning about malware that's been enslaving routers, webcams and DVRs across the world to create a giant botnet capable of disrupting the internet.
The malware, called Reaper or IoTroop, isn't the first to target poorly secured devices. But it's doing so at an alarmingly fast rate, according to security firm Check Point, which noticed the malicious code last month.
The malware has infected "hundreds of thousands" of devices, said Maya Horowitz, threat intelligence group manager at Check Point.
Reaper brings up memories of malware known as Mirai, which formed its own giant botnet in 2016 and infected over 500,000 IoT devices, according to some estimates. It then began launching a massive distributed denial-of-service (DDoS) attack that disrupted internet access across the US.
Reaper could be used to launch a similar attack, Check Point researchers said. The good news is the infected bots haven't launched any DDoS campaigns. Instead, they're still focused on enslaving new devices.
Researchers at security firm Qihoo 360 also noticed the Reaper malware, and found evidence it was trying to infect at least 2 million vulnerable devices. Reaper even borrows some source code from Mirai, though it spreads itself differently, Qihoo said.
Unlike Mirai, which relies on cracking the default password to gain access to the device, Reaper has been found targeting around a dozen different vulnerabilities found in products from D-Link, Netgear, Linksys, and others. All these vulnerabilities are publicly known, and at least some of the vendors have released security patches to fix them.
But that hasn't stopped the mysterious developer behind Reaper from exploiting the vulnerabilities. In many cases, IoT devices will remain unpatched because the security fixes aren't easy to install.
Who may have created the malware and what their motives are still isn't known, but all the tools needed to make it are actually available online, Horowitz said. For instance, the source code to the Mirai malware was dumped on a hacking forum last year. In addition, data about the vulnerabilities Reaper targets can be found in security research posted online.
"It's so easy to be a threat actor when all these public exploits and malware can be just posted on GitHub," she said. "It's really easy to just rip the code, and combine, to create your own strong cyber weapon."
Unfortunately, little might be done to stop the Reaper malware. Security experts have all been warning that poorly secured IoT devices need to be patched, but clearly many haven't. "This is another wakeup call" for manufacturers, Horowitz said.