Home Security New malware gives CCTV DVRs amnesia

Palo Alto’s Unit 42 has identified a new variant of the IoT/Linux botnet “Tsunami” dubbed “Amnesia” that targets commercial grade closed circuit TV DVR (digital video recorder) devices made by TVT Digital and branded by over 70 vendors worldwide. About 227,000 devices are affected.

A listing of brands can be found here. Amnesia exploits this remote code execution vulnerability by scanning for, locating, and attacking vulnerable systems. Successful attacks result in Amnesia gaining full control of the device. Attackers could potentially harness the Amnesia botnet to launch broad DDoS attacks like the Mirai botnet attacks

Amnesia is believed to be the first Linux malware to adopt virtual machine evasion techniques to defeat malware analysis sandboxes more commonly associated with Microsoft Windows and Google Android malware.

Amnesia tries to detect whether it is running in a VirtualBox, VMware or QEMU based virtual machine. If it detects those environments it will wipe the virtualised Linux system. This affects not only Linux malware analysis sandboxes but also some QEMU based Linux servers on VPS or on the public cloud.

Palo Alto Networks says that the aim is to make these machines part of a massive botnet that can be used for DDoS and other attacks. The only protection at present is to block access to the Command and Control Networks and use network protection that does this. No patch has been released by the maker TVT.

Palo Alto Networks adds that the malware reveals some interesting and notable trends of current IoT/Linux botnet threats:

  • IoT/Linux malware has begun to adopt classic techniques to evade and even wipe virtual machines.
  • IoT/Linux malware targets and attacks known remote code execution vulnerabilities in IoT devices. These are typically manufactured by smaller manufacturers and there may be no patch available so network security is the only solution.
  • IoT/Linux malware may also affect Linux servers deployed in VPS or in public cloud.


Did you know: Key business communication services may not work on the NBN?

Would your office survive without a phone, fax or email?

Avoid disruption and despair for your business.

Learn the NBN tricks and traps with your FREE 10-page NBN Business Survival Guide

The NBN Business Survival Guide answers your key questions:

· When can I get NBN?
· Will my business phones work?
· Will fax & EFTPOS be affected?
· How much will NBN cost?
· When should I start preparing?


Ray Shaw

joomla stats

Ray Shaw ray@im.com.au  has a passion for IT ever since building his first computer in 1980. He is a qualified journalist, hosted a consumer IT based radio program on ABC radio for 10 years, has developed world leading software for the events industry and is smart enough to no longer own a retail computer store!






Join the iTWire Community and be part of the latest news, invites to exclusive events, whitepapers and educational materials and oppertunities.
Why do I want to receive this daily update?
  • The latest features from iTWire
  • Free whitepaper downloads
  • Industry opportunities