A new variant of the ELF Linux / Mirai botnet has appeared: it still targets connected objects to allow bitcoins to be mined. This raises many questions about the very merits of such a process.
Originally, the Mirai botnet has two purposes: to identify and compromise connected objects, and then launch distributed denial of service (DDoS) type attacks. But a new variant has been discovered. Called ELF Linux / Mirai, it adds to the botnet an integrated component whose purpose is to mine Bitcoins. As a reminder, "mining" is the process of securing transactions for which minors are rewarded in cryptocurrency.
In 2016 Mirai had been used to launch targeted attacks, against the particular Dyn DNS provider. This resulted in inaccessible websites like Twitter, PayPal or Spotify for a few hours. In concrete terms, the hacker (s) then used the power of the infected connected objects to launch attacks. And, schematically, this new ELF Linux / Mirai variant wants to do the same: use the combined power of IoT devices to mine Bitcoins.
Many outstanding issues
IBM X-Force security lab discovered the pot-aux-roses. Rightly, we read in a post that mining is "an intensive computing activity". By this, IBM researchers point out that the CPU power of connected objects is low, and that it would take a very large number for a mining activity to be profitable.
But do not forget that like any business, the "malware industry" usually looks for profitability. IBM researchers therefore make a hypothesis: they evoke a rapprochement between different hackers using Mirai to pool their striking power. A sort of "mining consortium" thanks to the botnet.
Finally, IBM calls both users and builders to seize this security problem on connected objects. Especially since variants are already spreading, like BrickerBot, which also uses IoT to launch PDoS attacks.