RondoDox Botnet Leverages TBK DVR and Four-Faith Router Vulnerabilities for DDoS Attacks

TL;DR

• RondoDox Botnet: Utilizes flaws in TBK DVRs and Four-Faith routers.
• Vulnerabilities: Includes CVE-2024-3721 and CVE-2024-12856.
• Impact: Devices are exploited to launch DDoS attacks.

RondoDox Botnet Exploits Flaws in TBK DVRs and Four-Faith Routers

Cybersecurity experts have identified a new malware campaign targeting security vulnerabilities in TBK digital video recorders (DVRs) and Four-Faith routers. This campaign aims to incorporate these devices into a newly discovered botnet known as RondoDox. The vulnerabilities being exploited include:

• CVE-2024-3721: A medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 DVRs.
• CVE-2024-12856: A critical flaw in Four-Faith routers.

These vulnerabilities allow the RondoDox botnet to take control of the affected devices and use them to launch distributed denial-of-service (DDoS) attacks.

Key Vulnerabilities and Their Impact

1. CVE-2024-3721:
   • Description: This vulnerability allows attackers to inject malicious commands into the DVRs, leading to unauthorized access and control.
   • Affected Devices: TBK DVR-4104 and DVR-4216.
   • Impact: Compromised DVRs can be used to flood targeted networks with excessive traffic, causing disruptions and potential data breaches.
2. CVE-2024-12856:
   • Description: This critical flaw in Four-Faith routers can be exploited to gain administrative access, allowing attackers to manipulate network traffic and compromise connected devices.
   • Affected Devices: Specific models of Four-Faith routers.
   • Impact: Routers can be used to amplify DDoS attacks, causing widespread network outages and service disruptions.

Mitigation Strategies

To protect against these vulnerabilities, organizations and individuals should:

• Update Firmware: Ensure that all TBK DVRs and Four-Faith routers are running the latest firmware versions.
• Implement Network Security: Use firewalls and intrusion detection systems to monitor and block suspicious activity.
• Regular Audits: Conduct regular security audits to identify and mitigate potential vulnerabilities.

Conclusion

The RondoDox botnet highlights the ongoing threat of cyberattacks targeting IoT devices. By exploiting vulnerabilities in TBK DVRs and Four-Faith routers, attackers can launch powerful DDoS attacks, causing significant disruptions. Staying vigilant and implementing robust security measures is crucial to mitigate these risks.

For further insights, check: The Hacker News