“`html

Botnet Exploits GeoVision Zero-Day to Install Mirai Malware

A recently seen botnet is exploiting a zero-day vulnerability in end-of-life GeoVision devices to compromise and recruit them into a malicious network, presumably for Distributed Denial of Service (DDoS) or cryptomining attacks.

The botnet in question aptly employs the notorious Mirai malware known for large-scale network disruptions.

Vulnerability Exploitation

The botnet relies on a particular exploit against GeoVision devices, namely IP cameras and recording systems that have reached their end-of-life cycle.

Identified as CVE-2020-3928, the vulnerability is a zero-day, implying that it was hitherto unknown to GeoVision or the public, until the attackers started using it.

To exploit the vulnerability, the botnet sends specifically crafted requests to the target GeoVision devices.

Upon successful exploitation, the botnet installs the Mirai malware, forcing the compromised devices into the botnet, ready to execute commands from the threat actors.

The Dangers of Mirai

Mirai malware is notorious in the cybersecurity landscape.

It was responsible for a significant DDoS attack in 2016, disrupting services like Twitter, Netflix, and Reddit.

Jwt, part of the Mirai famiy, has recently been seen targeting various IoT devices, showing its viability and threat to outdated and unpatched systems.

Protective Measures

The leading way to safeguard vulnerable devices from this and similar attacks is to implement rigorous security standards, ensuring equipment is up-to-date and patched.

Physical security should not be neglected, as direct access to devices can allow compromise even without network-based vulnerabilities.

For the users of GeoVision devices, it’s crucial to transition to supported hardware and keep software up-to-date with the manufacturer’s latest releases.

Companies should also recognize and practice the principle of least privilege, allowing only necessary access levels to devices and software to restrict potential avenues of exploitation.

Continued Vigilance

Botnets and malware, like that seen in this latest attack with the GeoVision zero-day and the Mirai botnet, continue to exemplify the evolving cybersecurity landscape.

Businesses, governments, and individuals must remain vigilant and proactive to combat these threats and maintain the security of their vital systems.

Follow-Up Reading

• Massive Botnet Chews Through 20,000 WordPress Sites (Dark Reading)
• Mirai Botnet Exploits TV Broadcasting Company (ZDNet)
• Newly Discovered Vulnerability Puts IoT Devices at Risk (WeLiveSecurity)

“`