• Search for:
    11Oct, 2023
    IZ1H9 Botnet Targets IoT Devices With New Exploits

    FortiGuard Labs, the research arm of security firm Fortinet, has uncovered a significant evolution in the IZ1H9 Mirai-based DDoS campaign. 

    Discovered in September and described in an advisory published on Monday, the new campaign has reportedly rapidly updated its arsenal of exploits, incorporating 13 distinct payloads, targeting various vulnerabilities across different Internet of Things (IoT) devices.

    Peak exploitation was recorded on September 6, with trigger counts reaching the tens of thousands. This highlights the campaign’s ability to infect vulnerable devices and expand its botnet swiftly through newly released exploit codes, encompassing multiple CVEs.

    The exploit payloads focus on vulnerabilities in D-Link, Netis, Sunhillo SureLine, Geutebruck, Yealink Device Management, Zyxel, TP-Link Archer, Korenix JetWave and TOTOLINK devices. Each payload is tailored to exploit specific vulnerabilities, ranging from command injection to remote code execution (RCE).

    The injected payload initiates a shell script downloader, “l.sh,” from a specific URL. It proceeds to delete logs, download and execute various bot clients for Linux architectures and obstruct network connections on multiple ports.

    IZ1H9, a Mirai variant, infects Linux-based IoT devices, rendering them remote-controlled bots for large-scale network attacks. Its configuration is decoded with an XOR key, revealing additional payload downloader URLs, along with pre-set login credentials for brute-force attacks.

    Read more on IZ1H9: New Mirai Variant Campaigns are Targeting IoT Devices

    Command-and-control (C2) communication between compromised devices and the command server is detailed, demonstrating the campaign’s sophistication in launching DDoS attacks with specific parameters.

    Fortinet researcher Cara Lin said the research underscored the persistent threat posed by RCE attacks on IoT devices. 

    “Despite the availability of patches for these vulnerabilities, the number of exploit triggers remains alarmingly high, often numbering in the thousands,” she wrote.

    “What amplifies the impact of the IZ1H9 Campaign are the rapid updates to the vulnerabilities it exploits. Once an attacker gains control of a vulnerable device, they can incorporate these newly compromised devices into their botnet, enabling them to launch further attacks like DDoS attacks and brute-force,” Lin added.

    To mitigate this threat, organizations are urged to apply patches promptly and alter default login credentials for their devices.

    Resource : https://www.infosecurity-magazine.com/news/iz1h9-botnet-targets-iot-devices/

    25May, 2023
    Mirai Variant V3G4 Targets 13 Vulnerabilities to Infect IoT Devices

    During the second half of 2022, a variant of the Mirai malware called V3G4 was seen targeting 13 vulnerabilities to ensnare Internet of Things (IoT) devices into a botnet, Palo Alto Networks reports.

    Following the successful exploitation of the targeted security flaws, the malware takes full control of the vulnerable devices and then abuses them to conduct various types of malicious activities, including distributed denial-of-service (DDoS) attacks.

    Starting July 2022, Mirai variant V3G4 was used in multiple attack campaigns, likely by the same threat actor, based on the used hardcoded command-and-control (C&C) domains, malware downloaders, XOR decryption key, identical functions, and a ‘stop list’.

    To compromise devices, the threat actor targets 13 remote code execution vulnerabilities that allow them to run specific utilities to download and execute the Mirai malware on the target devices.

    The targeted vulnerabilities impact FreePBX Elastix (CVE-2012-4869), Gitorious, FRITZ!Box webcams (CVE-2014-9727), Mitel AWC, Geutebruck IP cameras (CVE-2017-5173), Webmin (CVE-2019-15107), Spree Commerce, FLIR Thermal cameras, DrayTek Vigor (CVE-2020-8515 and CVE-2020-15415), Airspan AirSpot (CVE-2022-36267), Atlassian Confluence (CVE-2022-26134), and C-Data Web Management System (CVE-2022-4257).

    Following successful execution on a vulnerable device, the Mirai variant makes sure that only one instance of the malware runs, then attempts to terminate processes included in the hardcoded ‘stop list’.

    Malware samples collected over the course of three different campaigns showed slight changes in the code. While some Mirai samples spread by brute-forcing weak credentials, others also use embedded exploits, but samples seen between September and December 2022 contain none of these capabilities.

    “The vulnerabilities mentioned above have less attack complexity than previously observed variants, but they maintain a critical security impact that can lead to remote code execution. Once the attacker gains control of a vulnerable device in this manner, they could take advantage by including the newly compromised devices in their botnet to conduct further attacks such as DDoS,” Palo Alto Networks notes.

    Organizations are advised to ensure that all devices in their environments are patched against known vulnerabilities, that they are protected using strong, unique passwords, and that unused ports and services, which are often targeted by cybercriminals, are either blocked or not accessible from the internet.

    Resource : https://www.securityweek.com/mirai-variant-v3g4-targets-13-vulnerabilities-to-infect-iot-devices/

    12Sep, 2022
    New Stealthy Linux Malware Targeting Endpoints & IoT Devices

    At AT&T Alien Labs researchers have discovered a new stealthy Linux malware called Shikitega that can infect Linux systems in a stealthy manner. With additional payloads, the primary target of this Linux malware is the Linux-based systems and IoT devices.

    In addition to exploiting vulnerabilities, the malware adds persistence to the host through crontab by exploiting exploits to elevate privileges. Later a cryptocurrency miner is installed on an infected device as a result of the infection.

    It is quite easy for Shikitega to escape detection by anti-virus software since it is a stealthy malware. This malware uses a polymorphic encoder to evade detection, which means that it is impossible for any static, signature-based analysis to be performed on it.

    Infection chain

    This malware is spread through the use of a very small file called ELF that acts as a main or primary dropper. In total, the code takes up about 300 bytes while the total size is about 370 bytes, so the program is quite small.

    At this point, we don’t know the exact method by which the infection spread for the first time. There are multiple steps in the malware infection process in which each layer only delivers a few hundred bytes to the target. 

    In order to activate a module, one must activate a simple module, then move on to the next module. There is a shell code encoded in the ELF file, which is the dropper file.

    An additive feedback encoder called Shikata Ga Nai is used for the encoding process. In order to decode the data, the malware runs through several decoding loops using the encoder.

    A dynamic substitution of instructions and a dynamic block ordering is used in order to generate the encoder stud. A dynamic selection of registers is also carried out in addition to this.

    A shellcode is executed following the decryption to intercommunicate with C2 of the malware. After receiving the shellcode (commands), they are used for running from memory additional shell code.

    A Metasploit Meterpreter payload known as “Mettle” is downloaded and executed via one of these commands. A host can then be remotely controlled and code executed by an attacker.

    The Mettle program is configured to fetch a smaller ELF file, and it exploits the following vulnerabilities:-

    • CVE-2021-4034 (aka PwnKit)
    • CVE-2021-3493

    As a result of these flaws, the following exploits have been carried out:- 

    • Elevate privileges
    • The payload for the final stage is downloaded here
    • Deploy a cryptocurrency miner as a root

    Scripts Used

    Here below we have mentioned all the scripts that are used to achieve persistence:-

    • unix.sh: Check if “crontab” commands exist in the system, if not install it and start the crontab service.
    • brict.sh: Adds crontab for the current user to execute crypto miner.
    • politrict.sh: Adds root crontab to execute cryptominer.
    • truct.sh: Adds crontab for current user to download cryptominer and config from C&C.
    • restrict.sh: Adds root crontab to download crypto miner and config from C&C.

    Recommendations

    Here below we have mentioned all the recommendations recommended by the cybersecurity analysts:-

    • Make sure that the software is updated with the latest security patches.
    • Make sure all endpoints have anti-virus software installed as well as EDR software.
    • To make sure that your server files are backed up, you should use a backup system.
    • Make sure to have a robust security strategy

    Resource : https://cybersecuritynews.com/new-stealthy-linux-malware-targeting-endpoints-iot-devices/

    22Oct, 2021
    Top 5 Attack Vectors to Look Out For in 2022

    Threat actors are continually looking for better ways to target organizations, here are the top five attack vectors to look out for in 2022.

    Malicious actors are continually looking for better ways to carry out successful cyber attacks. Whether motivated by a potential payday or the ability to access confidential information, cybercriminals have plenty of incentive to focus on what works best in achieving their goals. This article focuses on the top five attack vectors organizations should look out for and defend against in 2022.

    1. Phishing

    Phishing techniques use social engineering to trick victims into taking an action that helps an attacker compromise your network or access your sensitive information assets. Fraudulent emails purporting to be from authoritative company sources are the main phishing attacks that employees fall victim to. These emails persuade employees to reveal passwords for important applications or download malicious files to their devices.

    Some threat actors carry out phishing attacks using social media and networking platforms, such as Twitter or LinkedIn. Phishing scams remain such a widely used attack vector because of their efficiency. The potential rewards for very little effort make phishing scams highly attractive attack vectors requiring minimal technical knowledge.

    Some phishing scams target particular individuals because of their close proximity to sensitive information or because those individuals are likely to have administrative access to network resources. Some phishing scams are so convincing that they can fool even seasoned security professionals. A solid defense against phishing requires a dual approach of employee awareness and an anti-phishing email filtering solution.

    2. Stolen Credentials

    Stolen credentials continue to cause problems for businesses of all sizes. A 2021 report on data breaches found that stolen credentials were the initial attack vector used in 61 percent of breaches. Using stolen passwords is an easy way to masquerade as a genuine user and access sensitive information or infiltrate deeper into your network.

    It’s straightforward for threat actors to purchase bulk lists of stolen username-password credentials on the dark web. Other attack vectors such as phishing emails can be used to trick employees into disclosing their passwords, which cybercriminals then use to access your network.

    The problems posed by stolen credentials stem from a perfect storm of poor password hygiene and weak identity and access management controls. Employees regularly reuse their passwords across multiple applications and services, which means that a single stolen password could provide an easy entry route into your network. Many organizations provide excessive access privileges to users, which worsens the impact of a credential compromise by giving hackers access to administrative functions or critical systems.

    3. API Exploits

    Organizations can create new opportunities for growth through the use of APIs, which integrate their applications and service with other resources in the wider digital ecosystem. APIs facilitate communication between different apps and services. The use of APIs has become so widespread that many technologists say we’re living in an API economy.

    Ever on the lookout for new opportunities to get their hands on sensitive data, many threat actors realize that the proliferation of APIs may work to their advantage. Traditional security tactics cannot detect API attacks, so many organizations remain open to a breach or data exfiltration via APIs. This API security checklist provides best practices and considerations for closing off your APIs as an attack vector.

    4. Remote Technology

    The speed at which cyber attacks exploiting remote technology increased during the Covid-19 pandemic serves as a telling example of how threat actors dynamically adapt the attack vectors they use in response to changing conditions. A 2020 report found that 20 percent of organizations experienced a security breach due to remote work.

    The technologies used by organizations to facilitate remote work include virtual private network (VPN) connections and remote desktop protocol (RDP). These technologies let employees access business applications and resources from outside the physical location of their place of work.

    While the use of remote technology will likely reduce over time compared to at the height of the pandemic, it’s clear that remote work is here to stay in some capacity. Opportunistic threat actors know that with remote work not going away, there will be chances to gain entry to corporate networks by exploiting RDP and VPN connections.

    An actionable way to defend against remote access threats is to require multi factor authentication (MFA) for these connections. MFA requires users to provide another category of evidence that verifies their identity in addition to the standard username-password combination they use to log in. These distinct pieces of evidence can include a one-time password or a fingerprint scan.

    5. IoT Devices

    IoT devices include wearable devices, coffee makers, sensors, and cameras, all of which connect to the Internet. Many organizations don’t have visibility into all of their IoT devices. Furthermore, it’s common for IoT devices to use default credentials that hackers can easily guess.

    IoT devices are veritable storehouses of data about the environment they are in and the people that use them. A cyber attack on an IoT device could also be the initial entry point from which a hacker accesses your wider network and installs ransomware that locks down key systems.

    Organizations need a serious approach to secure their IoT infrastructures, including:

    • Full device visibility
    • Changing default usernames and passwords
    • Using strong passwords
    • Segmenting the network so that an IoT compromise can’t spread to key IT systems and assets
    • Update IoT devices on time

    Conclusion

    As we come into 2022, get your organization ready to combat these top five cyber attack vectors. Each of them calls for its own defense strategy to limit the chances of malicious threat actors successfully leveraging them to access or disrupt your valuable data and services.

    Source : https://securityaffairs.co/wordpress/123636/security/top-5-attack-vectors-2022.html