Even seemingly insignificant Internet of Things (IoT) devices such as LED light control consoles can be abused to launch malicious attacks, Microsoft’s security researchers warn.
Proof of that comes from an incident uncovered in Taiwan, where such a device was used to spew malware as part of an operation that leveraged a botnet of IoT products to distribute malware and ransomware, send phishing emails, and launch distributed denial-of-service (DDoS) attacks.
Looking into suspicious activity that showed an increase in botnet signals of 100 times within a month, Microsoft’s security researchers identified a cluster of activity where as much as one terabyte (TB) of malicious content was being sent out over the course of a single week.
After mapping the malicious activity to over 400,000 publicly available IP addresses, the researchers were able to narrow the investigation to only 90 suspicious IPs, but found that one of them alone was responsible for a large amount of malicious activity.
“One particular IP was associated with dozens of activities related to the distribution of malware, phishing emails, ransomware, and DDoS attacks,” Microsoft says.
Microsoft alerted Taiwan’s Ministry of Justice Investigation Bureau (MJIB), which was able to identify the illegal VPN IP, along with hidden accounts that were leveraging the VPN to send malware attacks from inside an office building in rural northern Taiwan.
The source of the attacks, an LED light control console, was shut down to prevent the spreading of malware.
“This case marks a milestone. That’s because we were able to take down the IoT device and secure the breach to a limited range for those compromised computers in Taiwan, which is quite different from our previous global cooperation cases,” Director Fu-Mei Wu, who leads the MJIB’s Information and Communication Security Division, commented.
The large number of mobile and IoT devices connected to the Internet over the past several years has exposed users worldwide to a variety of new types of cybercrime.
Hackers leverage insecure IoT devices to steal users’ credentials and financial information, to perform cyber-espionage, knock servers offline via DDoS attacks, disrupt critical infrastructure systems, or encrypt victims’ data and hold it for ransom.
“The MJIB is busy with cases of computer intrusions and cyberattacks, with the trend increasing over the last two years. These hackers are targeting the government and the technology industry, trying to steal and leak confidential information and launch full information warfare campaigns,” Microsoft notes.
Related: Potent ‘dark_nexus’ IoT Botnet Emerges
Related: Tech Companies Partner to Securely Connect IoT to Cloud
Related: IoT Devices at Major Manufacturers Infected With Malware via Supply Chain Attack