Mirai botnet

PowerPoint Presentation

Mirai botnetIntro to discussion

[email protected] @slawekja OWASP Krakw, 15.11.2016

We have all heard about it...

Mirai intro to discussion, OWASP Krakw 2016.11.15@slawekja

Most often pointed manufacturer


No, its not us, its the users!

http://www.xiongmaitech.com/index.php/news/info/12/76(only Chinese, I used Google translator)



My story...The best-priced IP camera with PoE and ONVIF Management standard (was supposed to) assure painless integration of the video in my installation.





Malware embedded...

http://artfulhacker.com/post/142519805054/beware-even-things-on-amazon-comehttps://ipcamtalk.com/threads/brenz-pl-malware-in-ip-cameras-what-now.12851/http://forums.whirlpool.net.au/forum-replies.cfm?t=2362073&p=11r211


Path traversal


Auth bypass...


cloud service


The cloud service# tcpdump host camera.local18:48:41.290938 IP camera.local.49030 > ec2-54-72-86-70.eu-west-1.compute.amazonaws.com.8000: UDP, length 25



Device login no pass, static captcha, id=MAC ;)


FAQ


Telnet


Nmap root@kali:~# nmap 10.5.5.20Starting Nmap 7.25BETA2 ( https://nmap.org ) at 2016-11-06 10:59 ESTNmap scan report for 10.5.5.20Host is up (0.019s latency).Not shown: 996 closed portsPORT STATE SERVICE23/tcp open telnet80/tcp open http554/tcp open rtsp8899/tcp open ospf-lite


Mirai credentials for brute-forcehttps://github.com/securing/mirai_credentials


Now go and brute the telnetroot@kali:~# hydra -C mirai_creds.txt telnet://10.5.5.20


few seconds later...


The telnet passwordI did not have the credentials few years ago...But the password was already known then.

No need to hack, search password and the name of device in Russian


Wait...But we have changed the default password, didnt we?


https://www.us-cert.gov/ncas/alerts/TA16-288A


So, where is the password?# cat /etc/passwdroot:$1$RYIwEiRA$d5iRRVQ5ZeRTrJwGjRy.B0:0:0:root:/:/bin/sh# mount/dev/root on / type cramfs (ro,relatime)


Can we change it?# passwd-sh: passwd: not found# echo "better etc passwd" > /etc/passwd-sh: can't create /etc/passwd: Read-only file system# mount -o remount,rw /# mount/dev/root on / type cramfs (ro,relatime)


So, it looks like we have to reflash...The DVR (10.5.5.30) has telnet disabled.Firmware versions starting mid-2015.But for many models the upgrade is not available ;)... and the DVR still has telnet on 9527 ;) not to mention other vulns


How to upgrade firmware?


Lets imagine you are a regular camera user...You have bought a camera in the nearest shop with cameras.You know your camera is vulnerable and should be upgraded.Try to find out how to do it, and where to find the firmware.


How do you think will regular user do?


Device Supply chain


Various vendors same device


Supply chainBoard Support Package - drivers, bootloader, kernel-level SDKBroadcom, Texas Instruments, HiSilicon, WindRiver...Original Device Manufacturer web interface, SDK, cloud...usually unknown from China, Taiwan etc.Original Equipment Manufacturer composing, branding ODMs+ support, license, warranty...Value Added Reseller / DistributorEnd user

Fabless manufacturing




Features, Price!

Features, Price!

Features, Price!

Features, Price!




Security?

?

?

?


Mirai


Back in 2012Internet Census Projecthttp://internetcensus2012.bitbucket.org/paper.html


2012 vs 2016

https://www.malwaretech.com/2016/10/mapping-mirai-a-botnet-case-study.htmlhttp://internetcensus2012.bitbucket.org/paper.html


Mirai sourcehttps://github.com/jgamblin/Mirai-Source-Code/

Warning:The zip file for the is repo is being identified by some AV programs as malware.


Worth readingThe original post with source code :Mirai-Source-Code-master/ForumPost.txt


How does it spread?mirai/bot/scanner.c


Scans for random IPs with several exclusions ;)


Next, tries to hit the telnetAnd once per ten also on 2323


Password list


Resolve C&C IP with DNS


Catching mirai


https://twitter.com/MiraiAttacks/Live feed of commands sent to 500 infected machines


How about dynamic analysis?We will expose the cameras telnet service directly to the Internet.... and see what happens.

https://asciinema.org/a/1tynlhzfs0lmw6t3bn5k40cu7


Our setupDevices: 2 cameras + 1 DVRRouter VPNs to public IP, exposes devices telnetDump all traffic to/from devices for analysis


Wireshark analysishttp://10.5.5.5/mirai.pcapRight click ->Follow->TCP Stream


Telnet session

Hello, my name is ...


Check processor version


Download payload into upnp


CNC connection establishement dns query


C&C DNS

Thanks: Josh Pyorre, OpenDNS



DNS domain taken by FBI



Registrant ID: C4853993-CLUBRegistrant Name: Zee GateRegistrant Street: 666 antichrist laneRegistrant City: San DiegoRegistrant State/Province: CARegistrant Postal Code: 92050Registrant Country: USRegistrant Phone: +1.7603014069Registrant Fax: +1.7603014069Registrant Email: [email protected] ID: C4853996-CLUBAdmin Name: Zee GateAdmin Street: 666 antichrist lane

whois hightechcrime.club


CNC


Scanning for new targets


Other variants DONGS ?


Other variants DONGS ?

https://asciinema.org/a/eqayq785gwz5qqnbhnfrmwdkg (about 13:00)


What can we do?


Set your DNS to 127.0.0.1?


Not everyone can afford that ;)


Protocols?P2P? We have seen it already...Proprietary management protocol? It can reset the camera remotely to default if you forgot pass. Seriously ;)And there was also auth bypass in similar (same?) one:https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117


OUR LAB


3 devices:Black one: 10.5.5.20White one: 10.5.5.25DVR: 10.5.5.30admin/WIFI: owasp/ApplicationSecurity


Bot wars?Will the blackmarket regulate itself? ;)Write a better bot, vigilante hack? Remember Linux.wifatch?Find vuln in botnet?https://www.invincealabs.com/blog/2016/10/killing-mirai


What can we do about it?ISP? Block telnet, inform users?Device callout? User awareness?Regulatory?


Open source?DD-WRT / openWRT is a great success.Maybe we should write similar soft for cameras?


Features at low cost compromising on security is just obscene ;) Lets do it better!


Many other vulns...


9527 debug Telnet

telnet 10.5.5.30 9527Console log of the device (including user passwords for RTSP)Remote control of the device (if you know user pass)


nmap -sS -sV -p 1-65535 10.5.5.20PORT STATE SERVICE VERSION23/tcp open telnet Busybox telnetd80/tcp open tcpwrapped554/tcp open rtsp?8899/tcp open soap gSOAP soap 2.79527/tcp open unknown34561/tcp open unknown34567/tcp open unknown34599/tcp open unknown

Proprietary protodebug/telnet

