Table of Contents
An ingenious botnet derived from Mirai, known as Tengu, poses new challenges to cybersecurity specialists. By exploiting an embedded hardware mechanism of Linux devices, Tengu restarts infected systems to ensure its longevity, even after being interrupted. This complex tactic complicates the task of defenders and highlights the constant evolution of digital threats.
Imagine you are a network administrator, thinking you have finally neutralized a heavy threat, when suddenly, the system restarts and the threat reappears. This is exactly the nightmare you might experience with Tengu, a persistent botnet that does not easily give up. Its ability to restart after each removal attempt makes it all the more formidable. Let’s dive into the workings of this cunning botnet and discover how it uses rebooting as a secret weapon.
Key takeaways
Tengu stands out for its ability to maintain itself even after its main process is stopped. This resilience relies on exploiting the hardware watchdog, an essential component in many connected devices. Normally, this device restarts a machine that no longer responds by regularly receiving operating signals. Tengu hijacks this function by using a secondary process that sends these signals, ensuring the system restarts if the main process is disrupted.
To further complicate the task of administrators, Tengu disguises itself under the name of a system component and multiplies entry points to restart. Whether through systemd services, startup scripts, or commands inserted into shells, each removal attempt can lead to a restart and the return of the botnet.
Detected by Nozomi Networks Labs, Tengu primarily targets vulnerable Linux and IoT devices. The botnet uses brute force attacks on exposed Telnet services to penetrate systems. Once inside, it can launch DDoS attacks, transform into a SOCKS5 proxy, and execute remote commands, exploiting the weaknesses of under-protected devices.
Specialists recommend disabling unnecessary interfaces and adopting complex passwords to counter these assaults. Regular firmware updates and isolating connected objects from the main network are also crucial to strengthening security.
In case of suspected infection by Tengu, it is not enough to stop the process. Administrators must check various system elements, such as systemd services, init and RC scripts, and cron tasks, to ensure no trace of the malware remains. If the system’s integrity is compromised, a complete reset may be necessary. After this operation, it is essential to reinstall clean firmware, change credentials, and ensure the device is no longer accessible from the Internet.
Botnets like Tengu illustrate the rapid evolution of online threats and the need for cybersecurity professionals to remain constantly vigilant. The ability of these botnets to adapt and restart after each removal attempt highlights the growing challenges companies face. Investing in advanced security solutions and educating users on best practices are essential strategies to counter these threats.
In a context where brute force attacks are common, using strong passwords becomes an absolute necessity. Companies must encourage the adoption of complex and unique passwords, combined with multi-factor authentication, to effectively protect their systems. Tech giants like Microsoft have already implemented strict password management policies to mitigate security risks.
What is Tengu’s main survival mechanism?
Tengu exploits the hardware watchdog of Linux devices to automatically restart systems when its main process is interrupted, allowing it to restart after each removal attempt.
How does Tengu penetrate systems?
The Tengu botnet uses brute force attacks on exposed Telnet services to infiltrate vulnerable systems, primarily those of poorly protected Linux and IoT devices.
What measures can be taken to protect against Tengu?
To guard against Tengu, it is recommended to disable Telnet and unnecessary administration interfaces, regularly update firmware, and use strong and unique passwords.
What to do in case of suspected infection by Tengu?
It is crucial to check systemd services, init and RC scripts, and cron tasks to eliminate any trace of the malware. If necessary, a complete system reset can be performed to restore system integrity.