Hello and welcome to the Tuesday, February 13th,

2004 edition of the Sandton and Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Well, we got an interesting new variety of the Mirai Baud that has been hitting some of our honeypots lately, it does appear to add a new

vulnerability that at least based on my Googling appears to be affecting routers made by

byte value. Byte value is a Chinese manufacturer. There is always a chance that these

routers are being sold under different names as well and that similar vulnerabilities can be found in other routers that are not sort of obviously recognizable as made by byte value.

The underlying software development kit, the real tech software development kit that I believe is being used here based on the URL, had a number of similar vulnerabilities in the past. The vulnerability being exploited here is a simple code injection vulnerability that then downloads the actual Miribot that will then go out and

probe random IP addresses for various exploits. As I submitted the particular sample,

a two virus total. It was not already characterized binary. However, many antivirus

tools immediately recognized it as Mirai. And dark reading is quoting a proof point in

stating that they're observing an ongoing Asia cloud compromise that does target senior executives.

So it's not the Asia cloud that's so much compromised, but individual corporate accounts

that are being compromised here by exposing senior executives to fishing emails.

That has always been a little bit sort of a weakness here,

where senior executives are often not very technically savvy

or generally knowledgeable in order to recognize these fishing emails,

but sometimes do have excessive rights to some of these cloud environments.

So compromising their accounts is always an interesting target.

This particular wave of compromise apparently started back in November.

Two-factor authentication, if you ever heard of that, appears to be something that's really

useful in particular for people like vice president's CFOs, presidents, and CEOs that are

...