{"id":1646,"date":"2017-04-21T06:41:47","date_gmt":"2017-04-21T06:41:47","guid":{"rendered":"https:\/\/antivirus.comodo.com\/blog\/?p=1646"},"modified":"2020-10-05T13:51:22","modified_gmt":"2020-10-05T08:21:22","slug":"iot-malware-wipes-data-infected-devices","status":"publish","type":"post","link":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/iot-malware-wipes-data-infected-devices\/","title":{"rendered":"IoT Malware that Wipes Data from Infected Devices"},"content":{"rendered":"

Security experts and researchers have recently observed certain malware attacks targeting IoT devices that lead to the wiping of data from the infected systems\/devices.<\/p>\n

Based on a couple of attacks that happened recently, it’s inferred that hackers are adding data-wiping routines to certain malware designed to infect IoT and embedded devices.<\/p>\n

\"IOT<\/p>\n

Amnesia, a malware which is basically a variation of an older IoT botnet client named Tsunami, has been found to infect digital video recorders making use of a year-old vulnerability. Amnesia is a malware that tries to detect if it’s running inside virtualized environment. Built basically for Linux-based environments, Amnesia performs checks to determine if the environment it’s running in is actually a virtualized one. It will then attempt to wipe critical directories from the file system, which it does by using the Linux “rm -rf” shell command.<\/p>\n

The other such malware, again targeting Linux-based IoT devices, is named BrickerBot and is launched from compromised routers and wireless access points. BrickerBot seeks to authenticate with common username and password combinations those devices that have the Telnet service running and which are exposed to the internet. Once the authentication is successfully done, the malware launches a series of destructive commands which intend to overwrite data from the IoT device’s mounted partitions. Moreover, BrickerBot also tries to kill the internet connection itself and thereby render the device itself unusable. Though devices with read-only partitions may survive the BrickerBot attack, most devices won’t and would consequently need a firmware reflash. Configurations would be lost; for routers with USB ports or network-attached storage devices, the data from external hard drives stand the chance of being wiped out. A notable aspect of BrickerBot malware is that it attacks not just embedded and IoT devices, but any Linux-based device or system which has weak credentials that can be cracked and which is accessible over Telnet.<\/p>\n