Since its discovery early this year, the Hide and Seek IoT botnet has been increasing its infection capabilities with new vectors. The latest samples look for Android devices with the wireless debugging feature enabled.
While IoT botnets appear and go away on a daily basis, Hide and Seek first attracted attention through its rapid growth to over 90,000 devices in a just a few days.
The new infection mechanism observed in the latest version does not exploit a vulnerability, but a misconfiguration of the devices, which ship with an active Android Debug Bridge connection over WiFi.
By default, Android has this option turned off, but device makers enable it in production stage to customize the operating system for their products. Users have to activate it manually.
Full Article.
