LED Light Control Console Abused to Spew Malware


Level 83
Thread author
Top poster
Content Creator
Malware Hunter
Aug 17, 2014
Even seemingly insignificant Internet of Things (IoT) devices such as LED light control consoles can be abused to launch malicious attacks, Microsoft’s security researchers warn.

Proof of that comes from an incident uncovered in Taiwan, where such a device was used to spew malware as part of an operation that leveraged a botnet of IoT products to distribute malware and ransomware, send phishing emails, and launch distributed denial-of-service (DDoS) attacks.

Looking into suspicious activity that showed an increase in botnet signals of 100 times within a month, Microsoft’s security researchers identified a cluster of activity where as much as one terabyte (TB) of malicious content was being sent out over the course of a single week.

After mapping the malicious activity to over 400,000 publicly available IP addresses, the researchers were able to narrow the investigation to only 90 suspicious IPs, but found that one of them alone was responsible for a large amount of malicious activity.

“One particular IP was associated with dozens of activities related to the distribution of malware, phishing emails, ransomware, and DDoS attacks,” Microsoft says.

Microsoft alerted Taiwan’s Ministry of Justice Investigation Bureau (MJIB), which was able to identify the illegal VPN IP, along with hidden accounts that were leveraging the VPN to send malware attacks from inside an office building in rural northern Taiwan.

The source of the attacks, an LED light control console, was shut down to prevent the spreading of malware.

“This case marks a milestone. That’s because we were able to take down the IoT device and secure the breach to a limited range for those compromised computers in Taiwan, which is quite different from our previous global cooperation cases,” Director Fu-Mei Wu, who leads the MJIB’s Information and Communication Security Division, commented.