Source Code of IoT Botnet Satori Publicly Released on Pastebin

The source code of the Satori internet-of-things (IoT) botnet was posted online on Pastebin, security researchers reported. In early December last year, Satori affected 280,000 IP addresses in just 12 hours, ensnaring numerous home routers to become part of its botnet.

Satori (also known as Mirai Okiru, and detected by Trend Micro as ELF_MIRAI.AUSR), which means “enlightenment” or “awakening” in Japanese (“okiru” means “to rise”), was pegged to be the successor of the infamous Mirai botnet, which similarly zombified routers and knocked high-profile sites offline. Like Satori, the original Mirai’s source code was also released publicly, and has since spawned iterations. Mirai-based attacks were recently spotted in Colombia, Ecuador, Panama, Egypt, Tunisia, and Argentina.

Satori exploits two vulnerabilities:

• CVE-2017–17215 — a vulnerability in Huawei Home Gateway routers (Huawei HG532), patched last November 2017. Attacks that use an exploit for this vulnerability targets port 37215.
• CVE-2014-8361 — a command injection vulnerability in Realtek SDK miniigd Universal Plug and Play (UPnP) SOAP interface (patched May 2015). Attacks that exploit this vulnerability target port 52869.

Initial feedback from Trend Micro’s telemetry revealed over 170,000 Satori-related detections in December 2017. The Satori-related attacks were prominent in Europe (Italy, France), North Africa and Middle East (Tunisia, Egypt), and South America (Colombia, Ecuador), as well as the U.S. and Japan.

[READ: Securing Your Routers Against Mirai and Other Home Network Attacks]

Satori is a credible threat given the increasing popularity of IoT devices in homes and workplaces, and the adverse impact they can cause when compromised. Distributed denial-of-service (DDoS) attacks, Domain Name System (DNS)-changing malware, and cryptocurrency-mining malware are just some of the threats users and businesses can be exposed to. IoT devices can also suffer from significant performance slowdowns.

Here are some best practices for making routers and networks more resistant to attacks:

• Update and/or strengthen their credentials to deter hackers from hijacking them
• Keep the router or IoT device’s firmware and software updated to prevent attackers from exploiting security gaps
• Use encryption to thwart attackers from snooping in on their network traffic, especially if the device is used in the workplace
• Enable the built-in firewall
• Disable unnecessary or outdated components that can be abused by attackers and used as doorways into the device or systems that may be connected to it
• Deploy additional layers of security such as intrusion detection and prevention systems