Viruses/Worms News

First botnet to target routers in the wild

Thursday, March 26, 2009

Researchers have found a botnet worm that targets routers and DSL modems in the wild, which is reportedly the first of its kind.

The live botnet, which is being called Psyb0t, is impacting any MIPS-based Linux router that either has a weak username-password combination or an interface accessible from outside the LAN.

An estimated 100,000 devices have already been infected by Psyb0t, according to the security officials who first found the botnet.

The researchers said detecting the botnet has proven difficult and would have to monitor monitor traffic going in and out of the router, Zdnet.com reports. The botnet has the ability to scan for vulnerable PHPMyAdmin and MySQL installations as well as disable access to the control interfaces of a router.

Terry Baume, an independent researcher from Australia, was reportedly the first person to find the botnet after he discovered the worm impacting an ISP's router.

"It's the first time I've ever heard of anything infecting embedded devices," Baume told SCMagazineUS.com.

This news may be troubling for SMBs or for businesses that are now home-based because of the weakening economy who depending routers. As an added layer to computer network security, businesses may want to use email archiving to protect sensitive data.