A!Team!Cymru!EIS!Report:!Growing!Exploitation!of!Small! OfCice!Routers!Creating!Serious!Risks!

Transcription

1 ATeamCymruEISReport:GrowingExploitationofSmall OfCiceRoutersCreatingSeriousRisks PoweredbyTeamCymru sthreatintelligencegroup Page 1of 14www.team-cymru.com

2 Threat'Intelligence'Group EXECUTIVE SUMMARY Page2of14www.team-cymru.com

3 Summary' Thisreportdetailsourrecentanalysisofawidespreadcompromiseofconsumer-grade smallofcice/homeofcice(soho)routers.attackersarealteringthednsconcigurationon thesedevicesinordertoredirectvictimsdnsrequestsandsubsequentlyreplacethe intendedanswerswithipaddressesanddomainscontrolledbytheattackers,effectively conductingaman-in-the-middleattack. Asthebarisincreasinglyraisedforcompromisingendpointworkstations,cybercriminals areturningtonewmethodstoachievetheirdesiredgoals,withoutgainingaccessto victims machinesdirectly.thecampaigndetailedinthisreportisthelatestinagrowing trendteamcymruhasobservedofcybercriminalstargetingsohorouters. InJanuary2014,TeamCymru senterpriseintelligenceservicesbeganinvestigating asohopharmingcampaignthathadoverwrittenrouterdnssettingsincentral Europe.Todate,wehaveidentiCiedover300,000devices,predominantlyinEurope andasia,whichwebelievehavebeencompromisedaspartofthiscampaign,one whichdatesbacktoatleastmid-decemberof2013. AffecteddeviceshadtheirDNSsettingschangedtousetheIPaddresses and ouranalysisindicatedthatalargemajorityofaffectedrouters residedinvietnam.othertopcountriesaffectedincludedindia,italyandthailand. Analysisofthevictimdevicesaffectedrevealedthatthecompromiseisnotlimitedto asinglemanufacturer.arangeofroutermodelsfromseveralmanufacturersappears tobecompromised.aswiththednschangermalware,unwittingvictimsare vulnerabletoalossofserviceifthemaliciousserversaretakendown,asboth primaryandsecondarydnsipaddressesareoverwritten,complicatingmitigation. Theaffecteddevicesweobservedwerevulnerabletomultipleexploittechniques, includingarecentlydisclosedauthenticationbypassvulnerabilityinzyxel CirmwareandCross-SiteRequestForgery(CSRF)techniquessimilartothose reportedinlate Thislarge-scaleattackhassimilaritieswitharecent,highlytargetedattackagainst Polishconsumerbankcustomers,thoughsubtledifferencesintradecraftpointto thesebeingseparatecampaigns. 2Wealsobelievethatthisactivityisseparatefrom thelinksysmoonwormrecentlyreportedbythesansinstitute. 3 WeassessthatconsumerunfamiliaritywithconCiguringthesedevices,aswellas frequentlyinsecuredefaultsettings,backdoorsincirmware,andcommodity-level 1 Seehttp:// and Page 3of 14www.team-cymru.com

4 engineeringstandardsmakesoho-typewirelessroutersaveryattractivetargetfor cybercriminals.' Manycybercrimeparticipantshavebecomeusedtopurchasingbots,exploit servers,andotherinfrastructureasmanagedservicesfromothercriminals.we expectthatthesemarketforceswilldriveadvancesintheexploitationofembedded systemsastheyhavedonefortheexploitationofpcs. WehaveintegratedvictimIPaddressesandotherdatarelatedtoSOHOpharming attacksintoourno-costcommunitytoolsfornetworkproviders,aswellasour commercialthreatintelligencefeeds.formoredetails,visithttps:// Affected'router'distribution'heatmap'visualization Page 4of 14www.team-cymru.com

5 Threat'Intelligence'Group ANALYSIS Page5of14www.team-cymru.com

6 Analysis Observed'in'the'Wild' InJanuary2014,theEnterpriseIntelligenceServicesteamatTeamCymrubecameawareof severaltp-linkwi-firoutersthathadtheirdnssettingsmaliciouslyalteredtosenddns requeststotwonewipaddresses: TherouterswerebothsmallofCice/homeofCice(SOHO)classdevicesthatprovidedWi-Fi connectivity,localdns,anddhcpservicestocustomers,andwerenotusingdefault passwords. Figure'1.'Three'phases'of'SOHO'router'DNS'exploitation'via'CSRF'vulnerability.' However,thesedeviceswererunningaCirmwareversionvulnerabletotheCross-Site RequestForgery(CSRF)techniqueillustratedinFigure1.Additionally,atleastoneofthese Page 6of 14www.team-cymru.com

7 modelswasrunningaversionofzyxelzynoscirmwarerecentlyexposedashavinga seriousclawthatallowsattackerstodownloadthesavedconcigurationcile,andthusthe administrativecredentials,fromanunauthenticatedurlinthewebinterface. 4 AnalysisofthesemaliciousDNSserversrevealedawiderangeofcompromiseddevices, includingmodelsfromd-link,micronet,tenda,tp-link,andothers.wehavemadeefforts tocontactthesemanufacturers,andwelookforwardtocooperatingwiththemgoing forward.victimrouterswereobservedglobally,withthelargestinfectionsinvietnam,italy, Thailand,Indonesia,Colombia,Turkey,Ukraine,BosniaandHerzegovina,andSerbia. Thescaleofthiscampaignisquitelarge.Figure2showsthedistributionofvictimsby countryoveraone-weekperiod.over300,000uniqueipaddressesattempteddns requeststothetwoservers.thetwoserversinvolvedrespondedtoanyexternaldns requestandactedasopenresolvers. Figure'2.'Victims'are'spread'globally,'likely'in'proportion'to'quantities'of'vulnerable'devices' supplied'by'isps' Inourtests,theSOHOpharmingDNSserversappearedtoforwardourDNSrequestsonto legitimateauthoritativeservers.attemptstologintolocalbankingwebsitesinaffected countries,andtodownloadsoftwareupdatesfromadobeandothersallappearedto functionnormally,thoughmanyrequestsresolvednoticeablyslowlyorfailedtocomplete. WebsiteswetestedalsoappearedtodisplaynormaladvertisingusingtheseDNSservers. 4 Page 7of 14www.team-cymru.com

8 OuranalysisdidreveallinksbetweenthetwoSOHOpharmingDNSserversandvarietyof othersuspiciousdevices.whilethismaysimplyresultfrommalware-relateddnsactivity onvictimhostcomputers,orquestionablebrowsingactivitiesbyusersbehindvictimsoho devices,wecontinuetoinvestigatethebehaviorof and wehavealso informedlawenforcementaboutthecompromisedroutersbeingsettousetheseservers andreachedouttotheproviderinvolved,thoughnoresponsehasbeenreceivedthusfar. Figure'3.'A'sample'of'compromised'routers'linked'to'the'malicious'DNS'servers' mbank:'malicious'dns'redirection'coupled'with'social'engineering'attacks'' WhatkindsofattacksarepossibleonceaSOHOdevice sdnssettingshavebeenchanged? TheresearchersatNiebezpiecznik.plandCERTPolandrecentlyexposedahighlytargeted attack,usingdnsserversat: Page 8of 14www.team-cymru.com

9 Inthiscase,themaliciousDNSserverswereusedinasophisticatedtwo-stageattack againstcustomersofthepolishmbankandotherpolishretailbanks. 5TheCirststage involvedusingdnsredirectiontostealcredentialstoindividualaccounts.theattackers thenusedthesetologintovictimaccountsandusedsocially-engineeredsmsmessagesto thevictimtoinducethevictimtounknowinglyapproveatransferoffundsintothe attacker saccount. BetweenDecember2013andFebruary2014,weobservedapproximately80compromised routers.overhalfthevictimswereinpolandandmostothersinrussia,withsmall numbersinbelgium,china,italy,theuk,andtheu.s.whilewebelievetheactualnumberof compromisedroutersisverylikelyhigher,thesenumbersonlyreclectthedeviceswe identiciedascompromised. Figure'4.'The'DNS'servers'used'in'the'mBank'fraud'had'a'small'number'of'victims,' concentrated'in'poland'and'russia.' Same'Techniques,'Different'Tradecraft' WhiletheseattacksbothalteredtheDNSserverIPaddressesusedbyvictimrouters,subtle differencesinthetradecraftemployedmakesitlikelythatweareobservingeitherseparate campaignsbythesamegroup,ormultipleactorsutilizingthesametechniquefordifferent purposes. 5 podatnych-na-ten-atak/ Page 9of 14www.team-cymru.com

10 InthecaseoftheattacksagainstPolishbankingcustomers,theattackerswhoused maliciousdnsservers and appearedtotargetasmallpoolof usersinamoreconcentratedgeographicareaandspecicicallyfocusonconnectionsto Polishbankingwebsites.ResearchbyCERTPolandshowedthatcustomersofCivePolish retailbankswerelikelytargeted. 6 TheseattackersappearedtohaveconCiguredtheirmaliciousDNSserverstopassnonbankingDNSrequestssolelytoOpenDNS sserversforlegitimateresolution. Incontrast,theattackerssettingdevicestotheIPs and had compromisedaverylargepoolofdevices,andcontrolledlargeblocksofdeviceswithin specicicisps,wherethehomogeneityofsohoroutermodels,concigurations,andcirmware versionslikelyallowedtheattacktoscaleeasily.thescaleofthisattacksuggestsamore traditionalcriminalintent,suchassearchresultredirection,replacingadvertisements,or installingdrive-bydownloads;allactivitiesthatneedtobedoneonalargescalefor procitability.themoremanually-intensivebankaccounttransfersseeninpolandwouldbe difciculttoconductagainstsuchalargeandgeographically-disparatevictimgroup. The and serversalsobehaveddifferentlyinthewaytheyresolved DNSqueries.WhilethemaliciousserversusedinthePolishbankingattackfunneledtrafCic toopendnsforresolution,theseserverssentrequestsouttotheauthoritativeserversfor thedomainsqueriedandthuscommunicatedwithafarlargernumberofnameservers. Atleastoneinstancehasbeenreportedwherecrossoveroccurredbetweenthesetwo groupsofipaddresses,withonedevicelistingprimaryandsecondaryresolversas and ,andsomehavesuggestedthatthisindicatestheworkofa singleactor. 7Wewereunabletodeterminewhetherthiswasactualevidenceofoverlap betweendifferentcampaigns,whetheroneactorisbehindallciveips,orwhetherone campaignmayhaveaddedanewdnsiptoarouterpreviouslycompromisedbyanother campaign.however,giventhedifferencesoutlinedabove,webelievethattheseareseparate campaigns. UnlikeearlierDNS-changingSOHOcampaigns,theattacksweobservedchangedboth primaryandsecondarydnsaddressestothe and addresses mentionedearlier. 8ThisrisksalossofservicetoISPcustomersshouldthisDNS infrastructurebeshutdowninthefuture.duringouranalysiswealsoidenticiedthatthese DNSserversonlyrespondedintermittently,likelycausingproblemstoaffectedusers Seehttp://security.stackexchange.com/questions/46966/dsl-modem-compromised,hxxp://in.answers.yahoo.com/ question/index?qid= aajri7v, and hxxp://sokosensei.wordpress.com/2014/02/06/massive-attack-onpolish-wi-fi-routers-pharming/#more routers-2/ Page 10of 14www.team-cymru.com

11 How'is'it'Done?' BecauseoftheubiquityoffactorydefaultsettingsonSOHOdevices,somearevulnerableto simplepasswordguessing.weobservedmanyofthedevicescommunicatingwiththe suspiciousdnsservershadgraphicaluserinterfacesthatwasaccessiblefromtheinternet, andthusvulnerabletosimplebruteforcelog-onattempts.aconsiderablenumberofthe remotelyaccessibledevicesalsoappearedvulnerabletothe ROM-0 vulnerability publishedinearlyjanuary. 9ThisvulnerabilityinZyXEL szynosallowsattackersto downloadtherouter sconcigurationcilefromtheunauthenticatedguiurlhttp://[ip address]/rom-0.whiletheresultingrom-0cilestillhastobedecompressed,thisprocessis trivialwithavailabletools,andautomatedattackscriptsareavailableonlinewhich explicitlycallouttheabilitytochangednssettings. 10 InthecaseoftheTP-Linkdeviceswestartedwith,thesewerenotusingdefaultpasswords, andwhilesomemodelswererunningavulnerableversionofzynos,somevictimswere likelycompromisedbeforetherom-0techniquewaspublished.itiscertainlypossiblethat morethanonepartycouldhavediscoveredtherom-0technique,andwasexploitingthis vulnerabilitybeforeitbecamepublic.anotherpossibilityisthatthesedeviceswere compromisedusingapubliclyknowncross-siterequestforgery(csrf)technique. 11 This techniquewouldenableattackerstoinjectanullpasswordinthedevice swebinterface.in ourexamples,itworkedagainstcirmwareversion3.0.0build120531forthetp-link TD-8840t,oneofourinitialvictimsystems. URLused: ACSRFattackpublishedonthe30 th ofoctober2013appearedtoleveragestoredtp-link routerlogincredentialsinthebrowsertochangeroutersdnssettings. 12Devices vulnerabletothistechniqueincludedtp-linkwr1043nd,tl-mr3020,andtl-wdr3600. TheTP-LINKCSRFURLreportedinOctober2013showedtheinsertionofnewDNSIPs: dhcpserver=1&ip1=$localip_start_range&ip2= $LOCALIP_END_RANGE&Lease=120&gateway= &domain=&dnsserver= $DNSIP&dnsserver2=$DNSIP2&Save= PreviousSOHOmodelshavebeenvulnerabletoCSRFtechniquesthatallowedwireless WPA/WPA2passwordstobechanged,alongwithothermaliciouschanges.Webelievethat acombinationofthesetechniqueswouldallowanattackertogaincontrolofthedeviceand changethednsconcigurationremotely https://github.com/MrNasro/zynos-attacker 11 See and <img src=" Page 11of 14www.team-cymru.com

12 Mitigation'Strategies Organizationsconcernedthattheircustomersandexternalpartnerscouldbevictimsof thistypeofattackshouldurgethemtoreviewtheirlocalroutersettingsandsecurity policiesandcontacttheirupstreamserviceproviderforassistanceifnecessary.soho devicesshouldhaveremoteuser-modeadministrationfeaturesandguisdisabledor,ata minimum,restrictedthroughaclstoonlythoseipsrequiredforregularadministration. ManagementinterfacesopentotheInternetcreateaneasilydetectableandexploitable vulnerabilityandshouldbedisabledimmediatelyiffound. CommandlineconCigurationofdevices,wherepossible,ispreferredtowebGUIinterface methods,asmanyofthevulnerabilitiesreportedinvolvecsrfattacksagainstuserslogged intotheconcigurationgui.administratorsshouldalsoensuredevicecirmwareiskeptupto date. Forlargercorporatenetworks,securityprofessionalscouldalsodeployHTMLcodetotheir externallyfacingserverstoattempttodetectremoteusers DNSsettings,andpotentially blockuserswithcompromiseddnssettings,byusingahtmltagwithauniquehostname thatlinksvisitors DNSrequeststotheirpagevisits.Notethatthiscouldaddunwanted overheadforlargeorganizations. Intheexampleabove,theuser sbrowserisforcedtodoadnsqueryforaunique hostname,linkingthednsservertoauniquehostnamelookup.theclientdoesahttpget requestonthis unique_string_detectdns.corporate-domain hostnameandcanthenbe identiciedasusingmaliciousdnssettings.thistypeofdnsdetectiondoeshaveits limitationshowever,asitdoesnotworkwhenmaliciousdnsserversforwardtherequests tothird-partyserviceslikeopendns. Internaltocorporatenetworks,thesecompromisesareagoodreminderthatDNScanbe abusedformalwarecommandandcontrolanddataexciltrationaswellastheman-in-themiddletechniquesobservedhere.dnssettingsshouldbecorporatelycontrolledand potentiallysetatthehostlevelaspartofasecure,baselineconciguration.individualusers shouldnothavetheprivilegestochoosetheirowndnssettings. Finally,werecommendseverelyrestrictingormonitoringthedeploymentofSOHOWi-Fi devicesoncorporatenetworks,andsecurityauditsshouldincludeeffortstocindand removeunauthorizedwi-fiaccesspoints,aswellasscanningcorporatenetworksfor devicesrunningsohoserviceslikehomenetworkadministrationprotocol(hnap). 13 Forendusers,orthosewhouseaSOHOdeviceastheirlocalDNSserver,wesuggest reviewingthednssettingsoflocaldevices,andcheckingthattheipaddresseslisted belongstoyourisp snameservers.whilenotaffectedbythisattack,areviewofhost computerdnssettingsisalsorecommended.wheninquestion,dnssettingscanalwaysbe settousegoogle snameservers( and )orthoseofopendns( and ) Page of

13 Conclusion BycompromisingoneSOHOrouter,anattackercanredirecttrafCicforeverydeviceinthat network.asthecompromiseofmbankuseraccountsdemonstrates,securitydoesnotstop atthehostlevel,butextendstoalldevicesinthenetwork.asembeddedsystemsbeginto proliferateinbothcorporateandconsumernetworks,greaterattentionneedstobegiven towhatvulnerabilitiesthesedevicesintroduce.securityforthesedevicesistypicallya secondaryconcerntocostandusabilityandhastraditionallybeenoverlookedbyboth manufacturersandconsumers.aswesawinthe2012discoveryof4millioncompromised BrazilianSOHOdevices,thisisparticularlyproblematicwhenoutdatedhardwareisleftin placeorlacksongoingsupportorcirmwareupdates. 14 WiththereleaseoftheexploitcodefortheMoonwormavailableonline,andthemBank campaigngainingmoreattentioneveryday,weexpecttoseemoreandmoremalicious activitytargetingsohodevicesandotherembeddedsystems.whiletodatetheattackswe haveobservedhavebeenlimitedtochanginguser-accessiblesettings,moonshowsthatthe nextlikelystepwillbethedevelopmentoftoolstosubvertoroverwritedevicecirmware andgiveattackersbetterstealthandpersistenceonconsumerdevices. Ourresearchintothiscampaigndidnotuncovernew,unknownvulnerabilities. Indeed,someofthetechniquesandvulnerabilitiesweobservedhavebeenpublicfor welloverayear.however,westillreachedouttotheequipmentvendorsaffectedby thiscampaignfortheirfeedbackandadvice.wewillupdatethispaperwithany recommendationsandresponseswereceivefromthesevendors. WehavealsonotiCiedseverallawenforcementagenciesabouttheissuesdescribed inthispaper,andreachedouttotheownersofthe and ip addresses.ourcommunicationstotheownersofthesedevices,perhapsnot surprisingly,wentunanswered. Weareworkingtodevelopnewtechniquestodetectthesetypesofcampaignsinthewild, andwillcontinuetopopulatebothourno-costandcommercialtoolswiththisdata.for moreinformation,pleasevisit: TCConsole-Free: CSIRTAssistanceProgram-Free: ThreatIntelligenceFeeds: Page 13of 14www.team-cymru.com

14 Notable SOHO Security Issues Sercomm)backdoor)affecting) multiple)vendors)revealed)by)eloi) Vanderbeken) ActionTec)routers)deployed)for) Verizon s)fios)service)found) vulnerable)to)cve>2013>0126) Code)published)for)ZynOS)ROM>0) exploit.) /DEV/TTYS0)publishes)D>Link) Joel s) Backdoor )user)agent)backdoor) Exploit)code)published)for)0>day) used)in)moon)worm.)sans)reports) that)moon)exploits)hnap)scanning) to)find)vulnerable)devices) 2013 Jan..Feb. Mar. Apr. May Jun. July Aug. Sept. Oct. Nov. Dec. Jan. Feb. Mar. Apr. Team)Cymru)uncovers)SOHO) Pharming)activity)with)over) Rapid7)reports)on)vulnerabilities)in) 300,000)active)victims)) Universal)Plug)and)Play)(UPnP))protocol) that)affects)millions)of)devices) 2014 Carna)botnet)/) Internet)Census)2012 ) reveals)extent)of)insecure)soho)devices) and)potential)for)abuse) CVE>2013>3098)CSRF)vulnerability) reported)to)affect)trendnet)routers)) CERT)Poland)reports)campaign) targeting)banking)customers) Page14of14www.team.cymru.com