New IoT botnet offers DDoSes of once-unimaginable sizes for $20

Organizers of a new botnet made up of infected home and small office routers are brazenly selling denial-of-service attacks of once unimaginable volumes for just $20 per target.

Calling itself Los Calvos de San Calvicie, the group is advertising several services on this site. Among the services are distributed denial-of-service attacks of 290 to 300 gigabits per second for $20 each. While a third the size of some of the biggest recorded attacks, 290Gbps is still enough to bring most sites down unless they seek DDoS mitigation services, which in many cases cost considerable amounts of money. Just five years ago, 300Gbps was considered enough volume to shut down the Internet’s core infrastructure.

Credit: Radware

Los Calvos de San Calvicie members have been spotted assembling a botnet in recent days that very possibly has the firepower required to deliver the potent attacks promised. According to Pascal Geenens, a researcher at security firm Radware, the group is building the botnet by exploiting two vulnerabilities: one in RealTek routers running out-of-date firmware and the other in the Huawei HG532 router, where a patch released in December has yet to be installed by many users. Both vulnerabilities are also exploited by a different Internet-of-things botnet known as Satori.

Unlike most of the IoT botnets seen so far, the one tracked by Geenens, which he’s calling JenX, uses a handful on non-IoT servers to scan the Internet for vulnerable devices and, once found, to exploit them. That makes it much harder to estimate the number of infected devices that make up JenX, because the simulated vulnerable routers Geenens uses in his laboratory to track the botnet see the same limited number of attack servers.

By contrast, Mirai, Satori, Reaper, and other IoT botnets rely on infected devices to locate and infect vulnerable devices. That allows honeypots such as Geenens’ to estimate the size of the botnet based on the number of IPs doing the scanning. JenX gets its name from “Jennifer,” the name the malware developers gave to the binary that infects vulnerable devices.

Devine Stream

Geenens said the main purpose of the botnet is to attack people playing the online game Grand Theft Auto on certain fee-charging servers. That in turn can increase demand for game hosting by sancalvicie.com. That’s the same domain hosting the JenX command-and-control server. It advertises itself as being resistant to the types of attacks Mirai and JenX use to bring down rival game hosts. It’s also the same domain advertising the DDoS-for-hire services, which appear to be a side business to the game hosting.

The Spanish-speaking group has dubbed its DDoS service Corriente Divina, which translates to “divine stream.” A rough English translation of the service tag line is “God’s wrath will be employed against the IP that you provide us.”

The group offers source query engine floods and 32-byte floods, which are types of DDoS attacks that are particularly effective at bringing down many types of multiplayer gaming services. The DDoS service also includes a “Down OVH” option, a likely reference to the France-based hosting provider that’s known for hosting servers for multi-player games, including Minecraft. OVH was a target in the 2016 attacks waged by botnets including Mirai, which pummeled the cloud provider with 1.1 terabits per second of junk traffic, a record at the time. Ironically, over the past few days, the Jennifer binary delivered to exploited routers was hosted on an IP address belonging to OVH, Geenens said.

JenX is an example of the second generation of IoT botnets. Like Mirai, it preys on the vast number of unsecured routers, cameras, and other network-enabled devices populating the Internet. That supply gives the botnets formidable amounts of distributed bandwidth that have the collective ability to cripple large swaths of the Internet. One weakness in Mirai, however, was its reliance on default passwords to take control of devices. Once the passwords are changed—either by manufacturers or device owners—Mirai becomes ineffective.