Akamai Observes that ‘Spike’ DDoS Botnet Targets Computers and IoT Devices

Security firm Akamai's Prolexic Security Engineering & Response Team (PLXsert) says that a new malware kit known as Spike can contaminate not only conventional desktops but can also infect smart thermostats, routers, smart dryers and a swarm of other IoT (Internet of Things) devices to drive them into massive botnets.

According to Akamai, the malware is capable to generate a surge of conventional UDP, SYN and GET traffic along with a DNS floods and had already been responsible for many large botnet-driven attacks including one in Asia which peaked at an alarming 215Gbps across its 'scrubbing' centers.

Akamai discovered that the attack was carried out on an online entertainment company. Traffic at this stratum is something which would have been found by alleviation providers although the target apparently had no clue about its scale.

"This DDoS kit is designed to construct botnets from devices and platforms which administrators of system might not have considered to be at risk for botnet contamination in the past. Enterprises need hardening of systems to stop initial contagion and DDoS shield to prevent DDoS attacks from the Spike bots."

Akamai suggested that binaries of Spike were apparently detected by security firms like Dr. Web in August.

Networkworld.com published a report on 22nd September, 2014 quoting David Fernandez, Head of PLXsert Team of Akamai, as saying "PLXsert and Russian AV company Dr. Web say that between them they have witnessed the tainted Spike payload ported to Linux and Windows desktops and servers together with ARM-based Linux devices particularly routers of patrons installed by ISPs. But ARM malware could be employed to taint other gadgets like smart appliances."

Fernandez says that the malware kit interface is written in Mandarin Chinese and till now, it has not been found in underground marketplaces.

Infosecurity-magazine.com reported on 24th September, 2014 quoting the security firm as 'Unless there are momentous cleanup efforts by community, this bot invasion is likely to increase. There may be an increase in the quantity of fresh Spike DDoS toolkit iterations which integrate new payloads and signatures. System administrators require checking thoroughly and hardening devices which may not have been beleaguered or considered to be at threat of botnet infection in the past."

» SPAMfighter News - 10/6/2014