The Raspberry Pi project has sold just over 12 million units. From miniature servers to arcade replicas, there is a huge number of applications for the computer, but in most cases they are connected to the web without proper security settings. A new malware called Linux.MulDrop.14 takes advantage of the absence of those settings to hijack a Raspberry Pi and turn it into a remote slave whose only task is to mine low-difficulty cryptocurrencies.
If we have learned anything from the recent large-scale botnet attacks, it is that together we are definitely stronger. Millions of cameras, routers, switches, mini servers, media players, and many more can be turned into zombie soldiers, attacking a specific point and taking it out of action very quickly. The "Insecure Internet of Things" is a problem that must be solved as soon as possible, and the last thing we need is a way to make it bigger. That brings us to the Raspberry Pi. There are more than twelve million units out there, and although not all of them remain connected, most depend on it to function properly. If we add to this a relaxed security and very spaced-out updates... the situation doesn't sound so good.
Anyone not convinced should just look at the latest entry from the Russian company Dr. Web, which tells us about a malware called Linux.MulDrop.14. This bug uses a Bash script to look for Raspberry Pi devices that accept external SSH connections, and then applies the factory credentials, which are "pi" (user) and "raspberry" (password) respectively. Once inside the mini computer, Linux.MulDrop.14 replaces the password of the pi user with a long string of characters to complete the hijack, tries to spread to other nodes with port 22 open, and executes a mining program.
Due to difficulty and raw processing power, Linux.MulDrop.14 does not try to mine bitcoins, but focuses on less well-known cryptocurrencies, such as Monero, which is gaining a lot of traction (its market capitalization already exceeds 800 million dollars).
Fortunately, it is easy to protect yourself. Updating Raspbian, changing the pi user's password, and limiting SSH access should be enough.
