. Linux/Moose endangered or extinct? An update on this atypical - - PowerPoint PPT Presentation

▶
linux moose endangered or extinct
SMART_READER_LITE
LIVE PREVIEW

. Linux/Moose endangered or extinct? An update on this atypical - - PowerPoint PPT Presentation

Mar 26, 2024 172 likes •729 views

. Linux/Moose endangered or extinct? An update on this atypical embedded Linux botnet by Olivier Bilodeau $ apropos Statically linked stripped ELF challenges Moose DNA (description) Moose Herding (the Operation) A Strange Animal Latest

slide-1
SLIDE 1

.

slide-2
SLIDE 2

Linux/Moose endangered

  • r extinct?

An update on this atypical embedded Linux botnet

by Olivier Bilodeau

slide-3
SLIDE 3

$ apropos

Statically linked stripped ELF challenges Moose DNA (description) Moose Herding (the Operation) A Strange Animal Latest Developments

slide-4
SLIDE 4

$ whoami

Malware Researcher at ESET Infosec lecturer at ETS University in Montreal Previously infosec developer, network admin, linux system admin Co-founder Montrehack (hands-on security workshops) Founder NorthSec Hacker Jeopardy

slide-5
SLIDE 5

Static/stripped ELF primer

No imports (library calls) present All the code bundled together down to kernel syscall Disassembler (if available for arch) doesn’t help much

slide-6
SLIDE 6

Linux/Moose binary in IDA

slide-7
SLIDE 7

printf family

slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11

Ecosystem makes it worst [for reversers]

GCC and GNU libc is always changing so compiled binaries always change Little IDA FLIRT signatures available (if any) µClibc, eglibc, glibc, musl, …

slide-12
SLIDE 12

A Failed Attempt

Map syscalls with IDA script But libc is too big it is still too much

slide-13
SLIDE 13

Better Solution

Reproduce environment (arch, libc/compiler versions) Build libraries w/ symbols under same conditions Use bindiff to map library functions Focus on malware code

slide-14
SLIDE 14
slide-15
SLIDE 15

Moose DNA

aka Malware description

Hang tight, this is a recap

slide-16
SLIDE 16

Linux/Moose…

Named after the string "elan" present in the malware executable

slide-17
SLIDE 17

Elan is French for

slide-18
SLIDE 18

The Lotus Elan

slide-19
SLIDE 19

Elán

The Slovak rock band (from 1969 and still active)

slide-20
SLIDE 20
slide-21
SLIDE 21

Network capabilities

Pivot through firewalls Home-made NAT traversal Custom-made Proxy service

  • nly available to a set of whitelisted IP addresses

Remotely configured generic network sniffer DNS Hijacking

slide-22
SLIDE 22

Worm-like behavior

Tries to replicate via aggressive scanning Will dedicate more resources to scan near current external IP Will also scan on LAN interfaces Will not reinfect an infected device Can replicate across architectures C&C is made aware of new compromises

slide-23
SLIDE 23
slide-24
SLIDE 24

Compromise Protocol

slide-25
SLIDE 25

Anti-Analysis

Statically linked binary stripped of its debugging symbols Hard to reproduce environment required for malware to operate Misleading strings (getcool.com)

slide-26
SLIDE 26
slide-27
SLIDE 27

Moose Herding

The Malware Operation

slide-28
SLIDE 28

Via C&C Configuration

Network sniffer was used to steal HTTP Cookies Twitter: twll, twid Facebook: c_user Instagram: ds_user_id Google: SAPISID, APISID Google Play / Android: LAY_ACTIVE_ACCOUNT Youtube: LOGIN_INFO

slide-29
SLIDE 29

Via Proxy Usage Analysis

Nature of traffic Protocol Targeted social networks

slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33

75%+ HTTPS but…

slide-34
SLIDE 34
slide-35
SLIDE 35

An Example

slide-36
SLIDE 36

An Example (cont.)

slide-37
SLIDE 37

An Example (cont.)

slide-38
SLIDE 38

An Example (cont.)

slide-39
SLIDE 39

Anti-Tracking

Whitelist means we can’t use the proxy service to evaluate malware population Blind because of HTTPS enforced on social networks DNS Hijacking’s Rogue DNS servers never revealed

slide-40
SLIDE 40
slide-41
SLIDE 41

A Strange Animal

slide-42
SLIDE 42

Different focus

not in the DDoS or bitcoin mining business no x86 variant found controlled by a single group of actors

slide-43
SLIDE 43

Missing "features"

No persistence mechanism No shell access for operators

slide-44
SLIDE 44

Thought big, realized little?

In social network fraud, network sniffer irrelevant DNS Hijacking possible but only for few devices No ad fraud, spam, DDoS, etc.

slide-45
SLIDE 45

Latest Developments

slide-46
SLIDE 46

Whitepaper Impact

Few weeks after the publication the C&C servers went dark After a reboot, all affected devices should be cleaned But victims compromised via weak credentials, so they can always reinfect

slide-47
SLIDE 47

Alive or dead?

slide-48
SLIDE 48

Alive or dead? (cont.)

On the lookout for Moose v2 Looked at over 150 new samples targeting embedded Linux platforms Linux/Aidra, Linux/Dofloo (AES.DDoS), Linux/DNSAmp (Mr.Black), Linux.Gafgyt and Linux/Tsunami Still no Moose update…

slide-49
SLIDE 49

Yay! except…

slide-50
SLIDE 50

Moose level-up

slide-51
SLIDE 51

Update

New sample this Saturday New proxy service port (20012) New C&C selection algorithm Lots of differences Still under scrutiny

slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54

Conclusion

Embedded malware Not yet complex Tools and processes need to catch up a low hanging fruit Prevention simple

slide-55
SLIDE 55

Questions?

Thank you! @obilodeau and special thanks to Thomas Dupuy (@nyx__o)