A Moose Once Bit My Honeypot A Story of an Embedded Linux Botnet - - PowerPoint PPT Presentation

▶
a moose once bit my honeypot
SMART_READER_LITE
LIVE PREVIEW

A Moose Once Bit My Honeypot A Story of an Embedded Linux Botnet - - PowerPoint PPT Presentation

Feb 01, 2023 209 likes •1.2k views

A Moose Once Bit My Honeypot A Story of an Embedded Linux Botnet by Olivier Bilodeau ( @obilodeau ) $ apropos Embedded Linux Malware Moose DNA (description) Moose Herding (the Operation) Whats New? Take Aways $ whoami Malware

slide-1
SLIDE 1

A Moose Once Bit My Honeypot

A Story of an Embedded Linux Botnet

by Olivier Bilodeau ( ) @obilodeau

slide-2
SLIDE 2

$ apropos

Embedded Linux Malware Moose DNA (description) Moose Herding (the Operation) What’s New? Take Aways

slide-3
SLIDE 3

$ whoami

Malware Researcher at ESET Infosec lecturer at ETS University in Montreal Previously infosec developer, network admin, linux system admin Co-founder Montrehack (hands-on security workshops) Founder NorthSec Hacker Jeopardy

slide-4
SLIDE 4

Embedded Linux Malware

What marketing likes to call "Internet of Things Malware"

slide-5
SLIDE 5

Malware Running On An Embedded Linux System

slide-6
SLIDE 6

Like

consumer routers consumer routers DVR Smart TVs IP Camera monitoring systems …

slide-7
SLIDE 7

Caracteristics of Embedded Linux Systems

Small amount of memory Small amount of flash Non x86 architectures: ARM, MIPS Wide-variety of libc implementations / versions Same ABI-compatible Linux kernel (2.4 < x < 4.3) Support ELF binaries Rarely an integrated UI Networked

slide-8
SLIDE 8

Why Threats On These Systems Matters?

Hard to detect Hard to remediate Hard to fix Low hanging fruit for bad guys

slide-9
SLIDE 9

It’s Real

Several cases disclosed in the last two years A lot of same-old background noise (DDoSer) Things are only getting worse

slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13
slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16

Wait, is IoT malware really about things?

slide-17
SLIDE 17
  • No. Not yet.
  • No. Not yet.
slide-18
SLIDE 18
slide-19
SLIDE 19
slide-20
SLIDE 20

So what kind of malware can we find on such insecure devices?

Linux/Aidra Linux/Bassobo ChinaZ family (XOR.DDoS, … ) Linux/Dofloo Linux/DNSAmp (Mr Black, BillGates) Linux/Gafgyt (LizardStresser) Linux/Hydra Linux/Tsunami …

slide-21
SLIDE 21

Lesson Learned #0 Lesson Learned #0

Statically-linked stripped binaries

slide-22
SLIDE 22

Static/stripped ELF primer

No imports (library calls) present All the code bundled together down to kernel syscall Disassembler (if available for arch) doesn’t help much

slide-23
SLIDE 23

Linux/Moose binary in IDA

slide-24
SLIDE 24

printf family

slide-25
SLIDE 25
slide-26
SLIDE 26
slide-27
SLIDE 27
slide-28
SLIDE 28

Ecosystem makes it worst [for reversers]

GCC and GNU libc are always changing so compiled binaries always change Little IDA FLIRT signatures available (if any) Various C libraries: µClibc, eglibc, glibc, musl, …

slide-29
SLIDE 29

A Failed Attempt

Map syscalls with IDA script But libc is too big Still too much code to RE Provided tool: https://github.com/eset/malware- research/blob/master/moose/ida/mips_identify_syscalls.py

slide-30
SLIDE 30

Better Solution

Reproduce environment (arch, libc/compiler versions) Build libraries w/ symbols under same conditions Use bindiff to map library functions Focus on malware code

slide-31
SLIDE 31
slide-32
SLIDE 32

Lesson #0 Lesson #0

Going down to syscalls is too long in large binaries Find a close match of C library Build with symbols Bindiff it (or maybe FLIRT it)

slide-33
SLIDE 33

Lesson Learned #1 Lesson Learned #1

Be careful of strings and AV variant names

slide-34
SLIDE 34

Anti-Virus Variants

slide-35
SLIDE 35
slide-36
SLIDE 36
slide-37
SLIDE 37

and Strings

$ strings moose_mips.elf [...] cat /proc/cpuinfo GET /xx/rnde.php?p=%d&f=%d&m=%d HTTP/1.1 Host: www.getcool.com Connection: Keep-Alive 127.0.0.1 [...]

slide-38
SLIDE 38

Lesson #1 Lesson #1

Be careful with detection names Don’t request domain take down based on output of strings and don’t do so for other people’s research!

slide-39
SLIDE 39

Misleading Strings

slide-40
SLIDE 40

Moose DNA Moose DNA

aka Malware description

Hang tight, this is a recap

slide-41
SLIDE 41

Linux/Moose

Discovered in November 2014 Thoroughly analyzed in early 2015 Published a report in late May 2015

slide-42
SLIDE 42

Linux/Moose…

Named after the string "elan" present in the malware executable

slide-43
SLIDE 43

Elan is French for

slide-44
SLIDE 44

The Lotus Elan

slide-45
SLIDE 45

Elán

The Slovak rock band (from 1969 and still active)

slide-46
SLIDE 46
slide-47
SLIDE 47

Sample

Statically linked stripped ELF binary ARM (GNU EABI and EABI 5) MIPS (little and big endian) No x86 sample found C&C IP in integer form buried in all this code

slide-48
SLIDE 48

MIPS/ARM + statically linked + stripped + no x86

slide-49
SLIDE 49

Strings not obfuscated

slide-50
SLIDE 50

Network capabilities

Pivot through firewalls Home-made NAT traversal Custom-made Proxy service

  • nly available to a set of authorized IP addresses

Remotely configured generic network sniffer DNS Hijacking

slide-51
SLIDE 51

Lesson Learned #2 Lesson Learned #2

Don’t assume it’s custom when it can be a standard protocol

slide-52
SLIDE 52
slide-53
SLIDE 53

Proxy with access from C&C authorized IPs only

slide-54
SLIDE 54

C&C IP is hardcoded

No fallback domains or DGA

slide-55
SLIDE 55
slide-56
SLIDE 56

Attack Vector

Telnet credentials bruteforce Wordlist of 304 user/pass entries sent by server

slide-57
SLIDE 57

Compromise Protocol

slide-58
SLIDE 58

Can perform cross-arch infections

slide-59
SLIDE 59

No further spreading if C&C is down

slide-60
SLIDE 60

Missing: Persistence

slide-61
SLIDE 61

Literally kills competition

slide-62
SLIDE 62
slide-63
SLIDE 63

Lesson Learned #3 Lesson Learned #3

Less RE, more honeypot!

slide-64
SLIDE 64

Stuck

slide-65
SLIDE 65

Solution

Launch the binary in a debian MIPS qemu image Reachable from the Internet Watch it behave Firewall it

slide-66
SLIDE 66

Hints

Aurel images: Qemu command: https://people.debian.org/~aurel32/qemu/mips/

qemu-system-mips -M malta \

  • no-reboot -nographic \
  • kernel vmlinux-3.2.0-4-4kc-malta \
  • hda debian_wheezy_mips_standard.qcow2 \
  • append "root=/dev/sda1 console=ttyS0" \
  • redir tcp:10073::10073 -redir tcp:22::22 -redir tcp:23::23
slide-67
SLIDE 67

Lesson #3 Lesson #3

We were too careful Everything we learned operationally was because of infected host

slide-68
SLIDE 68

Hard to track malware

slide-69
SLIDE 69

Moose Herding

The Malware Operation

slide-70
SLIDE 70

Via C&C Configuration

Network sniffer was used to steal HTTP Cookies Twitter: twll, twid Facebook: c_user Instagram: ds_user_id Google: SAPISID, APISID Google Play / Android: LAY_ACTIVE_ACCOUNT Youtube: LOGIN_INFO

slide-71
SLIDE 71

Sniffing HTTPS Cookies

slide-72
SLIDE 72

Via Proxy Usage Analysis

Nature of traffic Protocol Targeted social networks

slide-73
SLIDE 73
slide-74
SLIDE 74
slide-75
SLIDE 75
slide-76
SLIDE 76

75%+ HTTPS but…

slide-77
SLIDE 77
slide-78
SLIDE 78

An Example

slide-79
SLIDE 79

An Example (cont.)

slide-80
SLIDE 80

An Example (cont.)

slide-81
SLIDE 81

An Example (cont.)

slide-82
SLIDE 82

Fraud hidden in HTTPS

slide-83
SLIDE 83

Except Instagram first hit

slide-84
SLIDE 84
slide-85
SLIDE 85

Latest Developments Latest Developments

slide-86
SLIDE 86

Whitepaper Impact

Few weeks after the publication the C&C servers went dark After a reboot, all affected devices should be cleaned But victims compromised via weak credentials, so they can always reinfect

slide-87
SLIDE 87

Alive or dead?

slide-88
SLIDE 88

Alive or dead? (cont.)

On the lookout for Moose v2 Looked at over 150 new samples targeting embedded Linux platforms

slide-89
SLIDE 89

Found Update

New proxy service port (20012) C&C selection on CLI C&C server returns 404 on unknown bots Still under analysis Still trying to get infected

slide-90
SLIDE 90

Reading research papers and adapting

slide-91
SLIDE 91
slide-92
SLIDE 92
slide-93
SLIDE 93

Take Aways Take Aways

slide-94
SLIDE 94

Research artifacts released

Python and Shell Scripts Protocol dissectors, fake servers, tshark wrappers Yara rules IOCs https://github.com/eset/malware- research/tree/master/moose

slide-95
SLIDE 95

Embedded malware

Not yet complex Tools and processes need to catch up a low hanging fruit Prevention simple

slide-96
SLIDE 96

Questions? Questions?

slide-97
SLIDE 97

Questions?

Thank you! and special thanks to Thomas Dupuy (@nyx__o) @obilodeau