Dear Sir/Madam,
Greetings from MTNL, Mumbai.
As per the analysis received from
Computer Emergency Response Team - India (CERT-In), under the Ministry of Electronics and Information Technology, it is suggested to check for any malware/botnet infection on single/multiple communicating device/s connected on MTNL, Mumbai broadband network with the broadband number ****123*** since possible suspicious communication was observed due to malware/botnet infection.
Malware (CNC) is unsolicited software that is installed in the users' system without users' knowledge and consent while the user is surfing/browsing on the Internet. The attacker or cyber-criminal can remotely send commands to such systems that are compromised by the malware. The malware is capable of compromising IoT systems, create a botnet of compromised devices, use compromise devices to launch DDoS attacks & make a compromised network connection to receive commands for further attacks.
When the malware runs, it turns the infected system into a bot connecting to a C&C server on specific ports and listens for commands from remote attackers. As a result, huge/abnormal outbound traffic is observed as it scans for vulnerable devices and becomes part of DDoS attacks. In view of the high damage potential of botnet infected machines, you are requested to take appropriate countermeasures suggested below to prevent such unsolicited incidents.
Countermeasures for securing the communicating devices:
- Restrict web management interface access of IoT devices to authorized users only and change default username/passwords. Always change default login credentials and ensure that passwords meet the minimum complexity. If a device comes with an open Wi-Fi connection, change the password and only allow it to operate on a home network with a secured Wi-Fi router. Moreover, control access to the devices with Access List.
- Identify systems such as routers, switches, web applications & administrative web interfaces, ICS systems, Telnet, SSH interfaces with default passwords and implement the above-mentioned measures.
- Disable Universal Plug and Play (UPnP) on IoT devices unless absolutely required. Implement account lockout policies to reduce the risk of brute-forcing attacks.
- Telnet and SSH should be disabled on the device if there is no requirement of remote management. Configure VPN and SSH to access device if remote access is required.
- Implement Egress and Ingress filtering at the router level. Unnecessary port and services should be stopped and closed. Logging must be enabled on the device to log all the activities.
- Keep antivirus on the computer system up to date. Also, keep up-to-date on patches and fixes on the IoT devices, operating system, and applications.
For more information on malware/botnets and the countermeasures kindly visit Cyber Swachhta Kendra: Home. To download Free Botnet Removal Tool, please click here.
For protection against the latest threats and vulnerabilities, users may regularly visit the website, Indian - Computer Emergency Response Team and check for the advisories published under the ADVISORIES section.
Thanks & Warm Regards,
MTNL, Mumbai