Home Security New malware gives CCTV DVRs amnesia

New malware gives CCTV DVRs amnesia

Palo Alto’s Unit 42 has identified a new variant of the IoT/Linux botnet “Tsunami” dubbed “Amnesia” that targets commercial grade closed circuit TV DVR (digital video recorder) devices made by TVT Digital and branded by over 70 vendors worldwide. About 227,000 devices are affected.

A listing of brands can be found here. Amnesia exploits this remote code execution vulnerability by scanning for, locating, and attacking vulnerable systems. Successful attacks result in Amnesia gaining full control of the device. Attackers could potentially harness the Amnesia botnet to launch broad DDoS attacks like the Mirai botnet attacks

Amnesia is believed to be the first Linux malware to adopt virtual machine evasion techniques to defeat malware analysis sandboxes more commonly associated with Microsoft Windows and Google Android malware.

Amnesia tries to detect whether it is running in a VirtualBox, VMware or QEMU based virtual machine. If it detects those environments it will wipe the virtualised Linux system. This affects not only Linux malware analysis sandboxes but also some QEMU based Linux servers on VPS or on the public cloud.

Palo Alto Networks says that the aim is to make these machines part of a massive botnet that can be used for DDoS and other attacks. The only protection at present is to block access to the Command and Control Networks and use network protection that does this. No patch has been released by the maker TVT.

Palo Alto Networks adds that the malware reveals some interesting and notable trends of current IoT/Linux botnet threats:

  • IoT/Linux malware has begun to adopt classic techniques to evade and even wipe virtual machines.
  • IoT/Linux malware targets and attacks known remote code execution vulnerabilities in IoT devices. These are typically manufactured by smaller manufacturers and there may be no patch available so network security is the only solution.
  • IoT/Linux malware may also affect Linux servers deployed in VPS or in public cloud.


Did you know: 1 in 10 mobile services in Australia use an MVNO, as more consumers are turning away from the big 3 providers?

The Australian mobile landscape is changing, and you can take advantage of it.

Any business can grow its brand (and revenue) by adding mobile services to their product range.

From telcos to supermarkets, see who’s found success and learn how they did it in the free report ‘Rise of the MVNOs’.

This free report shows you how to become a successful MVNO:

· Track recent MVNO market trends
· See who’s found success with mobile
· Find out the secret to how they did it
· Learn how to launch your own MVNO service


Ray Shaw

joomla stats

Ray Shaw ray@im.com.au  has a passion for IT ever since building his first computer in 1980. He is a qualified journalist, hosted a consumer IT based radio program on ABC radio for 10 years, has developed world leading software for the events industry and is smart enough to no longer own a retail computer store!