You may have seen media reports based on research by Proofpoint that hundreds of home devices such as entertainment systems and even a refrigerator had been sending spam. We refer to this collection of networked devices as the Internet of Things (IoT). Originally, the reports didn’t provide any evidence so we were unable to validate the claim. However, additional details have now been made available and we can confirm that your IoT devices, including your refrigerator, are not the source of this recent spam run.
From the information that was publicly provided, we have been able to determine that this specific spam run is being sent by a typical botnet resulting from a Windows computer infection. Symantec receives telemetry from a wide variety of sources including our endpoint security products, spam receiving honeypots, and botnet honeypots that await spam-initiating commands. All of these sources traced the spam to multiple Windows computers, some of which were verified to be infected with W32.Waledac (Kelihos). We have not seen this spam originate from any non-Windows computer systems and do not see any unaccounted volume of spam that may originate from other sources.
Even though the refrigerator was innocent, having IoT devices send spam isn’t impossible. Recently, we uncovered one of the first and most interesting IoT threats, Linux.Darlloz, which infects Linux-based IoT devices such as routers, cameras, and entertainment systems. Beyond its ability to infect IoT devices, what makes Darlloz interesting is that it is involved in a worm war with another threat known as Linux.Aidra. Darlloz checks if a device is infected with Aidra and if found, removes it from the device.
This is the first time we’ve seen worm writers fight an IoT turf war and is reminiscent of the 2004 worm wars. Considering these devices have limited processing power and memory, we’d expect to see similar turf battles in the future.
While malware for IoT devices is still in its infancy, IoT devices are susceptible to a wide range of security concerns. So don’t be surprised if, in the near future, your refrigerator actually does start sending spam. As with any computer system, keep the software on IoT devices up-to-date, place them securely behind a router, and change all default passwords to something more secure.
So, how did others incorrectly come to the conclusion that our refrigerators had gone rogue and started to send spam?
Unfortunately, confirming the make and model of an actual physical device on the Internet isn’t that easy. Many home devices sit behind a home router and use Network Address Translation (NAT). From the view point of an outsider, all the devices behind that router share the same IP address. This makes it difficult to determine whether a device behind the router or the router itself was the original source of the network traffic. Furthermore, if you probe the router for open ports the router may employ port forwarding, exposing one or more devices behind the router. You may have enabled port forwarding on your router to allow remote access to a home device, for example, to access a digital video recorder over the Internet while you're on the road so that you can record a TV show. You could be fooled into not even realizing a router is there and think that the exposed device is the sole device using that IP address.
Figure. What you see is not what you have
In this particular case, you have computers infected with malware sitting behind a home router along with a variety of other home devices, like an entertainment system or even a refrigerator. When the infected computer receives a new spam template from the bot controller, the spam will travel through the router and appear from a particular IP address. If you probe that IP address, instead of reaching the infected computer you will reach the router.
In addition, if your refrigerator uses a feature known as port forwarding and someone contacts the IP address on port 80, that traffic is allowed to reach your smart refrigerator. Viewed from outside, all you will see is the refrigerator and you may not even realize there is a router with potentially many other devices behind it, such as an infected computer. This misunderstanding was what led to reports of refrigerators sending spam. The truth is that those refrigerators just happened to be on the same network as an infected computer.
To validate how someone might be misled, we probed the public IP address of a Waledac infected computer. As expected, in many cases we ended up reaching entertainment systems and other home devices that happened to be exposed through the router and were just sharing the same network as a Waledac-infected computer.
So while IoT devices weren’t to blame this time, we expect they probably will be to blame in the future.