Published in IoT

Putin's hackers are using IoT drones

by on07 August 2019


All your lightbulbs are belong  us 

Hackers working for the Russian government have been using printers, video decoders, and other so-called Internet-of-things devices as a beachhead to penetrate targeted computer networks, Microsoft security experts warned.

Microsoft Threat Intelligence Centre wrote in its collective bog: "These devices became points of ingress from which the actor established a presence on the network and continued looking for further access.

"Once the actor had successfully established access to the network, a simple network scan to look for other insecure devices allowed them to discover and move across the network in search of higher-privileged accounts that would grant access to higher-value data."

Microsoft researchers discovered the attacks in April, when a voice-over-IP phone, an office printer, and a video decoder in multiple customer locations were communicating with servers belonging to "Strontium", a Russian government hacking group better known as Fancy Bear or APT28.

In two cases, the passwords for the devices were the easily guessable default ones they shipped with. In the third instance, the device was running an old firmware version with a known vulnerability. While Microsoft officials concluded that Strontium was behind the attacks, they said they weren't able to determine what the group's ultimate objectives were.

Microsoft said they have notified the makers of the targeted IoT devices so they can add new protections.

Monday's report also provided IP addresses and scripts organisations can use to detect if they have also been targeted or infected.

Last modified on 07 August 2019
Rate this item
(1 Vote)

Read more about: