Researchers uncover a thriving underground economy for malware targeting IoT devices

Researchers have exposed a robust clandestine ecosystem focused on crafting malware for IoT device exploitation.

Researchers at Kaspersky have detected a flourishing underground marketplace on the dark web, featuring zero-day vulnerability exploits for IoT devices, along with IoT malware, infrastructure, and associated tools.

The service that stood out the most, sought after by hackers, was identified as Distributed Denial of Service (DDoS) attacks orchestrated through IoT botnets.

IoT devices, comprising non-standard computing hardware, serve to expand internet connectivity beyond conventional devices. These encompass sensors, actuators, and devices with internet-connecting capabilities, enabling remote monitoring and control. They find applications across various sectors, including industrial equipment, mobile devices, and medical equipment, catering to both industrial and consumer needs.

Although brute-forcing weak passwords remains the predominant method for infecting IoT devices, exploiting vulnerabilities in network services has also emerged as a popular approach for compromising their security.

Furthermore, vulnerabilities in IoT devices have been identified due to the exploitation of the services they rely on. These attacks typically involve the execution of malicious commands through the exploitation of vulnerabilities in the web interfaces of IoT devices, often leading to severe consequences such as the proliferation of malware.

The study found that service costs fluctuate based on factors like DDoS protection, CAPTCHA, and victim-side JavaScript verification, spanning from $20 per day to $10,000 per month.

Kaspersky reported that, on average, these services were available for $63.5 per day or $1350 per month through ads.

“Kaspersky emphasizes the importance of cybersecurity in both consumer and industrial IoT devices. We believe it should be compulsory for manufacturers to require password changes on IoT devices and regularly release patches to address vulnerabilities,” stated Yaroslav Shmelev, a security specialist at Kaspersky.