Mirai – the software that has hijacked hundreds of thousands of internet-connected devices to launch massive DDoS attacks – now goes beyond recruiting just IoT products; it also includes code that seeks to exploit a vulnerability in corporate SD-WAN gear. That specific equipment – VMware’s SDX line of SD-WAN appliances – now has an updated software version that fixes the vulnerability, but by targeting it Mirai’s authors show that they now look beyond enlisting security cameras and set-top boxes and seek out any vulnerable connected devices, including enterprise networking gear. “I assume we’re going to see Mirai just collecting as many devices as it can,” said Jen Miller-Osborn, deputy director of threat research at Palo Alto Networks’ Unit 42, which recently issued a report about Mirai. Exploiting SD-WAN gear is new While the exploit against the SD-WAN appliances was a departure for Mirai, it doesn’t represent a sea-change in the way its authors are approaching their work, according Miller-Osborn. The idea, she said, is simply to add any devices to the botnet, regardless of what they are. The fact that SD-WAN devices were targeted is more about those particular devices having a vulnerability than anything to do with their SD-WAN capabilities. Responsible disclosure headed off execution of exploits The vulnerability itself was discovered last year by independent researchers who responsibly disclosed it to VMware, which then fixed it in a later software version. But the means to exploit the weakness nevertheless is included in a recently discovered new variant of Mirai, according to the Unit 42 report. The authors behind Mirai periodically update the software to add new targets to the list, according to Unit 42, and the botherders’ original tactic of simply targeting devices running default credentials has given way to a strategy that also exploits vulnerabilities in a wide range of different devices. The updated variant of the malicious software includes a total of eight new-to-Mirai exploits. The remediated version of the VMware SD-WAN is SD-WAN Edge 3.1.2. The vulnerability still affects SD-WAN Edge 3.1.1 and earlier, according to a VMware security advisory. After the Unit 42 report came out VMware posted a blog that says it is conducting its own investigation into the matter. Detecting whether a given SD-WAN implementation has been compromised depends heavily on the degree of monitoring in place on the network. Any products that give IT staff the ability to notice unusual traffic to or from an affected appliance could flag that activity. Otherwise, it could be difficult to tell if anything’s wrong, Miller-Osborne said. “You honestly might not notice it unless you start seeing a hit in performance or an outside actor notifies you about it.” Related content news HPE Aruba looks to fight AI threats with AI weapons HPE Aruba Networking Central gains AI-powered security observability and monitoring features. By Michael Cooney May 07, 2024 4 mins IoT Security Network Security news AI features boost Cisco's Panoptica application security software Cisco pads cloud-native security platform Panoptica with features that help customers protect containerized, microservice applications. By Michael Cooney May 07, 2024 5 mins Network Security Cloud Computing news analysis Red Hat extends Lightspeed generative AI tool to OpenShift and Enterprise Linux Red Hat's Lightspeed, a gen AI-powered assistant, will be extended to RHEL and OpenShift to help enterprises that want to use Linux, automation, and hybrid clouds but may not have the skills in house. By Maria Korolov May 07, 2024 4 mins Linux Network Management Software Servers news analysis Red Hat introduces 'policy as code' for Ansible New 'policy as code' capability for the Red Hat Ansible automation platform is aimed at reducing human error and the cost of implementing compliance directives. By Maria Korolov May 07, 2024 5 mins Linux Network Management Software PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe