ATeamCymruEISReport:GrowingExploitationofSmall OfCiceRoutersCreatingSeriousRisks PoweredbyTeamCymru sthreatintelligencegroup Page 1of 14www.team-cymru.com www.team-cymru.com
Threat'Intelligence'Group EXECUTIVE SUMMARY Page2of14www.team-cymru.com
Summary' Thisreportdetailsourrecentanalysisofawidespreadcompromiseofconsumer-grade smallofcice/homeofcice(soho)routers.attackersarealteringthednsconcigurationon thesedevicesinordertoredirectvictimsdnsrequestsandsubsequentlyreplacethe intendedanswerswithipaddressesanddomainscontrolledbytheattackers,effectively conductingaman-in-the-middleattack. Asthebarisincreasinglyraisedforcompromisingendpointworkstations,cybercriminals areturningtonewmethodstoachievetheirdesiredgoals,withoutgainingaccessto victims machinesdirectly.thecampaigndetailedinthisreportisthelatestinagrowing trendteamcymruhasobservedofcybercriminalstargetingsohorouters. InJanuary2014,TeamCymru senterpriseintelligenceservicesbeganinvestigating asohopharmingcampaignthathadoverwrittenrouterdnssettingsincentral Europe.Todate,wehaveidentiCiedover300,000devices,predominantlyinEurope andasia,whichwebelievehavebeencompromisedaspartofthiscampaign,one whichdatesbacktoatleastmid-decemberof2013. AffecteddeviceshadtheirDNSsettingschangedtousetheIPaddresses5.45.75.11 and5.45.75.36.ouranalysisindicatedthatalargemajorityofaffectedrouters residedinvietnam.othertopcountriesaffectedincludedindia,italyandthailand. Analysisofthevictimdevicesaffectedrevealedthatthecompromiseisnotlimitedto asinglemanufacturer.arangeofroutermodelsfromseveralmanufacturersappears tobecompromised.aswiththednschangermalware,unwittingvictimsare vulnerabletoalossofserviceifthemaliciousserversaretakendown,asboth primaryandsecondarydnsipaddressesareoverwritten,complicatingmitigation. Theaffecteddevicesweobservedwerevulnerabletomultipleexploittechniques, includingarecentlydisclosedauthenticationbypassvulnerabilityinzyxel CirmwareandCross-SiteRequestForgery(CSRF)techniquessimilartothose reportedinlate2013. 1 Thislarge-scaleattackhassimilaritieswitharecent,highlytargetedattackagainst Polishconsumerbankcustomers,thoughsubtledifferencesintradecraftpointto thesebeingseparatecampaigns. 2Wealsobelievethatthisactivityisseparatefrom thelinksysmoonwormrecentlyreportedbythesansinstitute. 3 WeassessthatconsumerunfamiliaritywithconCiguringthesedevices,aswellas frequentlyinsecuredefaultsettings,backdoorsincirmware,andcommodity-level 1 Seehttp://www.jakoblell.com/blog/2013/10/30/real-world-csrf-attack-hijacks-dns-server-configuration-of-tplink-routers-2/ and http://rootatnasro.wordpress.com/2014/01/11/how-i-saved-your-a-from-the-zynos-rom-0-attackfull-disclosure 2 http://niebezpiecznik.pl/post/stracil-16-000-pln-bo-mial-dziurawy-router-prawie-12-miliona-polakow-moze-bycpodatnych-na-ten-atak/ 3 https://isc.sans.edu/diary/linksys+worm+%22themoon%22+summary%3a+what+we+know+so+far/17633 Page 3of 14www.team-cymru.com
engineeringstandardsmakesoho-typewirelessroutersaveryattractivetargetfor cybercriminals.' Manycybercrimeparticipantshavebecomeusedtopurchasingbots,exploit servers,andotherinfrastructureasmanagedservicesfromothercriminals.we expectthatthesemarketforceswilldriveadvancesintheexploitationofembedded systemsastheyhavedonefortheexploitationofpcs. WehaveintegratedvictimIPaddressesandotherdatarelatedtoSOHOpharming attacksintoourno-costcommunitytoolsfornetworkproviders,aswellasour commercialthreatintelligencefeeds.formoredetails,visithttps://www.teamcymru.org/services/ Affected'router'distribution'heatmap'visualization Page 4of 14www.team-cymru.com
Threat'Intelligence'Group ANALYSIS Page5of14www.team-cymru.com
Analysis Observed'in'the'Wild' InJanuary2014,theEnterpriseIntelligenceServicesteamatTeamCymrubecameawareof severaltp-linkwi-firoutersthathadtheirdnssettingsmaliciouslyalteredtosenddns requeststotwonewipaddresses: 5.45.75.11 5.45.75.36 TherouterswerebothsmallofCice/homeofCice(SOHO)classdevicesthatprovidedWi-Fi connectivity,localdns,anddhcpservicestocustomers,andwerenotusingdefault passwords. Figure'1.'Three'phases'of'SOHO'router'DNS'exploitation'via'CSRF'vulnerability.' However,thesedeviceswererunningaCirmwareversionvulnerabletotheCross-Site RequestForgery(CSRF)techniqueillustratedinFigure1.Additionally,atleastoneofthese Page 6of 14www.team-cymru.com
modelswasrunningaversionofzyxelzynoscirmwarerecentlyexposedashavinga seriousclawthatallowsattackerstodownloadthesavedconcigurationcile,andthusthe administrativecredentials,fromanunauthenticatedurlinthewebinterface. 4 AnalysisofthesemaliciousDNSserversrevealedawiderangeofcompromiseddevices, includingmodelsfromd-link,micronet,tenda,tp-link,andothers.wehavemadeefforts tocontactthesemanufacturers,andwelookforwardtocooperatingwiththemgoing forward.victimrouterswereobservedglobally,withthelargestinfectionsinvietnam,italy, Thailand,Indonesia,Colombia,Turkey,Ukraine,BosniaandHerzegovina,andSerbia. Thescaleofthiscampaignisquitelarge.Figure2showsthedistributionofvictimsby countryoveraone-weekperiod.over300,000uniqueipaddressesattempteddns requeststothetwoservers.thetwoserversinvolvedrespondedtoanyexternaldns requestandactedasopenresolvers. Figure'2.'Victims'are'spread'globally,'likely'in'proportion'to'quantities'of'vulnerable'devices' supplied'by'isps' Inourtests,theSOHOpharmingDNSserversappearedtoforwardourDNSrequestsonto legitimateauthoritativeservers.attemptstologintolocalbankingwebsitesinaffected countries,andtodownloadsoftwareupdatesfromadobeandothersallappearedto functionnormally,thoughmanyrequestsresolvednoticeablyslowlyorfailedtocomplete. WebsiteswetestedalsoappearedtodisplaynormaladvertisingusingtheseDNSservers. 4 http://rootatnasro.wordpress.com/2014/01/11/how-i-saved-your-a-from-the-zynos-rom-0-attack-full-disclosure Page 7of 14www.team-cymru.com
OuranalysisdidreveallinksbetweenthetwoSOHOpharmingDNSserversandvarietyof othersuspiciousdevices.whilethismaysimplyresultfrommalware-relateddnsactivity onvictimhostcomputers,orquestionablebrowsingactivitiesbyusersbehindvictimsoho devices,wecontinuetoinvestigatethebehaviorof5.45.75.11and5.45.75.36.wehavealso informedlawenforcementaboutthecompromisedroutersbeingsettousetheseservers andreachedouttotheproviderinvolved,thoughnoresponsehasbeenreceivedthusfar. Figure'3.'A'sample'of'compromised'routers'linked'to'the'malicious'DNS'servers' mbank:'malicious'dns'redirection'coupled'with'social'engineering'attacks'' WhatkindsofattacksarepossibleonceaSOHOdevice sdnssettingshavebeenchanged? TheresearchersatNiebezpiecznik.plandCERTPolandrecentlyexposedahighlytargeted attack,usingdnsserversat: 95.211.241.94 95.211.205.5 Page 8of 14www.team-cymru.com
Inthiscase,themaliciousDNSserverswereusedinasophisticatedtwo-stageattack againstcustomersofthepolishmbankandotherpolishretailbanks. 5TheCirststage involvedusingdnsredirectiontostealcredentialstoindividualaccounts.theattackers thenusedthesetologintovictimaccountsandusedsocially-engineeredsmsmessagesto thevictimtoinducethevictimtounknowinglyapproveatransferoffundsintothe attacker saccount. BetweenDecember2013andFebruary2014,weobservedapproximately80compromised routers.overhalfthevictimswereinpolandandmostothersinrussia,withsmall numbersinbelgium,china,italy,theuk,andtheu.s.whilewebelievetheactualnumberof compromisedroutersisverylikelyhigher,thesenumbersonlyreclectthedeviceswe identiciedascompromised. Figure'4.'The'DNS'servers'used'in'the'mBank'fraud'had'a'small'number'of'victims,' concentrated'in'poland'and'russia.' Same'Techniques,'Different'Tradecraft' WhiletheseattacksbothalteredtheDNSserverIPaddressesusedbyvictimrouters,subtle differencesinthetradecraftemployedmakesitlikelythatweareobservingeitherseparate campaignsbythesamegroup,ormultipleactorsutilizingthesametechniquefordifferent purposes. http://niebezpiecznik.pl/post/stracil-16-000-pln-bo-mial-dziurawy-router-prawie-12-miliona-polakow-moze-byc- 5 podatnych-na-ten-atak/ Page 9of 14www.team-cymru.com
InthecaseoftheattacksagainstPolishbankingcustomers,theattackerswhoused maliciousdnsservers95.211.241.94and95.211.205.5appearedtotargetasmallpoolof usersinamoreconcentratedgeographicareaandspecicicallyfocusonconnectionsto Polishbankingwebsites.ResearchbyCERTPolandshowedthatcustomersofCivePolish retailbankswerelikelytargeted. 6 TheseattackersappearedtohaveconCiguredtheirmaliciousDNSserverstopassnonbankingDNSrequestssolelytoOpenDNS sserversforlegitimateresolution. Incontrast,theattackerssettingdevicestotheIPs5.45.75.11and5.45.75.36had compromisedaverylargepoolofdevices,andcontrolledlargeblocksofdeviceswithin specicicisps,wherethehomogeneityofsohoroutermodels,concigurations,andcirmware versionslikelyallowedtheattacktoscaleeasily.thescaleofthisattacksuggestsamore traditionalcriminalintent,suchassearchresultredirection,replacingadvertisements,or installingdrive-bydownloads;allactivitiesthatneedtobedoneonalargescalefor procitability.themoremanually-intensivebankaccounttransfersseeninpolandwouldbe difciculttoconductagainstsuchalargeandgeographically-disparatevictimgroup. The5.45.75.11and5.45.75.36serversalsobehaveddifferentlyinthewaytheyresolved DNSqueries.WhilethemaliciousserversusedinthePolishbankingattackfunneledtrafCic toopendnsforresolution,theseserverssentrequestsouttotheauthoritativeserversfor thedomainsqueriedandthuscommunicatedwithafarlargernumberofnameservers. Atleastoneinstancehasbeenreportedwherecrossoveroccurredbetweenthesetwo groupsofipaddresses,withonedevicelistingprimaryandsecondaryresolversas 95.211.156.101and5.45.75.11,andsomehavesuggestedthatthisindicatestheworkofa singleactor. 7Wewereunabletodeterminewhetherthiswasactualevidenceofoverlap betweendifferentcampaigns,whetheroneactorisbehindallciveips,orwhetherone campaignmayhaveaddedanewdnsiptoarouterpreviouslycompromisedbyanother campaign.however,giventhedifferencesoutlinedabove,webelievethattheseareseparate campaigns. UnlikeearlierDNS-changingSOHOcampaigns,theattacksweobservedchangedboth primaryandsecondarydnsaddressestothe5.45.75.11and5.45.75.36addresses mentionedearlier. 8ThisrisksalossofservicetoISPcustomersshouldthisDNS infrastructurebeshutdowninthefuture.duringouranalysiswealsoidenticiedthatthese DNSserversonlyrespondedintermittently,likelycausingproblemstoaffectedusers. 6 http://www.cert.pl/news/8019/ 7 Seehttp://security.stackexchange.com/questions/46966/dsl-modem-compromised,hxxp://in.answers.yahoo.com/ question/index?qid=20140117064445aajri7v, and hxxp://sokosensei.wordpress.com/2014/02/06/massive-attack-onpolish-wi-fi-routers-pharming/#more-732 http://www.jakoblell.com/blog/2013/10/30/real-world-csrf-attack-hijacks-dns-server-configuration-of-tp-link- 8 routers-2/ Page 10of 14www.team-cymru.com
How'is'it'Done?' BecauseoftheubiquityoffactorydefaultsettingsonSOHOdevices,somearevulnerableto simplepasswordguessing.weobservedmanyofthedevicescommunicatingwiththe suspiciousdnsservershadgraphicaluserinterfacesthatwasaccessiblefromtheinternet, andthusvulnerabletosimplebruteforcelog-onattempts.aconsiderablenumberofthe remotelyaccessibledevicesalsoappearedvulnerabletothe ROM-0 vulnerability publishedinearlyjanuary. 9ThisvulnerabilityinZyXEL szynosallowsattackersto downloadtherouter sconcigurationcilefromtheunauthenticatedguiurlhttp://[ip address]/rom-0.whiletheresultingrom-0cilestillhastobedecompressed,thisprocessis trivialwithavailabletools,andautomatedattackscriptsareavailableonlinewhich explicitlycallouttheabilitytochangednssettings. 10 InthecaseoftheTP-Linkdeviceswestartedwith,thesewerenotusingdefaultpasswords, andwhilesomemodelswererunningavulnerableversionofzynos,somevictimswere likelycompromisedbeforetherom-0techniquewaspublished.itiscertainlypossiblethat morethanonepartycouldhavediscoveredtherom-0technique,andwasexploitingthis vulnerabilitybeforeitbecamepublic.anotherpossibilityisthatthesedeviceswere compromisedusingapubliclyknowncross-siterequestforgery(csrf)technique. 11 This techniquewouldenableattackerstoinjectanullpasswordinthedevice swebinterface.in ourexamples,itworkedagainstcirmwareversion3.0.0build120531forthetp-link TD-8840t,oneofourinitialvictimsystems. URLused:http://192.168.1.1/Forms/tools_admin_1 ACSRFattackpublishedonthe30 th ofoctober2013appearedtoleveragestoredtp-link routerlogincredentialsinthebrowsertochangeroutersdnssettings. 12Devices vulnerabletothistechniqueincludedtp-linkwr1043nd,tl-mr3020,andtl-wdr3600. TheTP-LINKCSRFURLreportedinOctober2013showedtheinsertionofnewDNSIPs: http://admin:admin@192.168.1.1/userrpm/landhcpserverrpm.htm? dhcpserver=1&ip1=$localip_start_range&ip2= $LOCALIP_END_RANGE&Lease=120&gateway=0.0.0.0&domain=&dnsserver= $DNSIP&dnsserver2=$DNSIP2&Save= PreviousSOHOmodelshavebeenvulnerabletoCSRFtechniquesthatallowedwireless WPA/WPA2passwordstobechanged,alongwithothermaliciouschanges.Webelievethat acombinationofthesetechniqueswouldallowanattackertogaincontrolofthedeviceand changethednsconcigurationremotely. 9 http://rootatnasro.wordpress.com/2014/01/11/how-i-saved-your-a-from-the-zynos-rom-0-attack-full-disclosure 10https://github.com/MrNasro/zynos-attacker 11 See http://www.exploit-db.com/exploits/29924/ and http://cxsecurity.com/issue/wlb-2012100027 <img src="http://192.168.1.1/forms/tools_admin_1"/> 12 http://www.jakoblell.com/blog/2013/10/30/real-world-csrf-attack-hijacks-dns-server-configuration-of-tp-linkrouters-2/ Page 11of 14www.team-cymru.com
Mitigation'Strategies Organizationsconcernedthattheircustomersandexternalpartnerscouldbevictimsof thistypeofattackshouldurgethemtoreviewtheirlocalroutersettingsandsecurity policiesandcontacttheirupstreamserviceproviderforassistanceifnecessary.soho devicesshouldhaveremoteuser-modeadministrationfeaturesandguisdisabledor,ata minimum,restrictedthroughaclstoonlythoseipsrequiredforregularadministration. ManagementinterfacesopentotheInternetcreateaneasilydetectableandexploitable vulnerabilityandshouldbedisabledimmediatelyiffound. CommandlineconCigurationofdevices,wherepossible,ispreferredtowebGUIinterface methods,asmanyofthevulnerabilitiesreportedinvolvecsrfattacksagainstuserslogged intotheconcigurationgui.administratorsshouldalsoensuredevicecirmwareiskeptupto date. Forlargercorporatenetworks,securityprofessionalscouldalsodeployHTMLcodetotheir externallyfacingserverstoattempttodetectremoteusers DNSsettings,andpotentially blockuserswithcompromiseddnssettings,byusingahtmltagwithauniquehostname thatlinksvisitors DNSrequeststotheirpagevisits.Notethatthiscouldaddunwanted overheadforlargeorganizations. Intheexampleabove,theuser sbrowserisforcedtodoadnsqueryforaunique hostname,linkingthednsservertoauniquehostnamelookup.theclientdoesahttpget requestonthis unique_string_detectdns.corporate-domain hostnameandcanthenbe identiciedasusingmaliciousdnssettings.thistypeofdnsdetectiondoeshaveits limitationshowever,asitdoesnotworkwhenmaliciousdnsserversforwardtherequests tothird-partyserviceslikeopendns. Internaltocorporatenetworks,thesecompromisesareagoodreminderthatDNScanbe abusedformalwarecommandandcontrolanddataexciltrationaswellastheman-in-themiddletechniquesobservedhere.dnssettingsshouldbecorporatelycontrolledand potentiallysetatthehostlevelaspartofasecure,baselineconciguration.individualusers shouldnothavetheprivilegestochoosetheirowndnssettings. Finally,werecommendseverelyrestrictingormonitoringthedeploymentofSOHOWi-Fi devicesoncorporatenetworks,andsecurityauditsshouldincludeeffortstocindand removeunauthorizedwi-fiaccesspoints,aswellasscanningcorporatenetworksfor devicesrunningsohoserviceslikehomenetworkadministrationprotocol(hnap). 13 Forendusers,orthosewhouseaSOHOdeviceastheirlocalDNSserver,wesuggest reviewingthednssettingsoflocaldevices,andcheckingthattheipaddresseslisted belongstoyourisp snameservers.whilenotaffectedbythisattack,areviewofhost computerdnssettingsisalsorecommended.wheninquestion,dnssettingscanalwaysbe settousegoogle snameservers(8.8.8.8and8.8.4.4)orthoseofopendns(208.67.222.222 and208.67.220.220) Page of www.team-cymru.com 12 14 http://www.tenable.com/blog/hnap-protocol-vulnerabilities-pushing-the-easy-button 13
Conclusion BycompromisingoneSOHOrouter,anattackercanredirecttrafCicforeverydeviceinthat network.asthecompromiseofmbankuseraccountsdemonstrates,securitydoesnotstop atthehostlevel,butextendstoalldevicesinthenetwork.asembeddedsystemsbeginto proliferateinbothcorporateandconsumernetworks,greaterattentionneedstobegiven towhatvulnerabilitiesthesedevicesintroduce.securityforthesedevicesistypicallya secondaryconcerntocostandusabilityandhastraditionallybeenoverlookedbyboth manufacturersandconsumers.aswesawinthe2012discoveryof4millioncompromised BrazilianSOHOdevices,thisisparticularlyproblematicwhenoutdatedhardwareisleftin placeorlacksongoingsupportorcirmwareupdates. 14 WiththereleaseoftheexploitcodefortheMoonwormavailableonline,andthemBank campaigngainingmoreattentioneveryday,weexpecttoseemoreandmoremalicious activitytargetingsohodevicesandotherembeddedsystems.whiletodatetheattackswe haveobservedhavebeenlimitedtochanginguser-accessiblesettings,moonshowsthatthe nextlikelystepwillbethedevelopmentoftoolstosubvertoroverwritedevicecirmware andgiveattackersbetterstealthandpersistenceonconsumerdevices. Ourresearchintothiscampaigndidnotuncovernew,unknownvulnerabilities. Indeed,someofthetechniquesandvulnerabilitiesweobservedhavebeenpublicfor welloverayear.however,westillreachedouttotheequipmentvendorsaffectedby thiscampaignfortheirfeedbackandadvice.wewillupdatethispaperwithany recommendationsandresponseswereceivefromthesevendors. WehavealsonotiCiedseverallawenforcementagenciesabouttheissuesdescribed inthispaper,andreachedouttotheownersofthe5.45.75.11and5.45.75.36ip addresses.ourcommunicationstotheownersofthesedevices,perhapsnot surprisingly,wentunanswered. Weareworkingtodevelopnewtechniquestodetectthesetypesofcampaignsinthewild, andwillcontinuetopopulatebothourno-costandcommercialtoolswiththisdata.for moreinformation,pleasevisit: TCConsole-Free:https://www.team-cymru.org/Services/TCConsole/ CSIRTAssistanceProgram-Free:https://www.team-cymru.org/Services/CAP/ ThreatIntelligenceFeeds:https://www.team-cymru.com/Services/Intel/ 14 http://www.securelist.com/en/blog/208193852/the_tale_of_one_thousand_and_one_dsl_modems Page 13of 14www.team-cymru.com
Notable SOHO Security Issues Sercomm)backdoor)affecting) multiple)vendors)revealed)by)eloi) Vanderbeken) ActionTec)routers)deployed)for) Verizon s)fios)service)found) vulnerable)to)cve>2013>0126) Code)published)for)ZynOS)ROM>0) exploit.) /DEV/TTYS0)publishes)D>Link) Joel s) Backdoor )user)agent)backdoor) Exploit)code)published)for)0>day) used)in)moon)worm.)sans)reports) that)moon)exploits)hnap)scanning) to)find)vulnerable)devices) 2013 Jan..Feb. Mar. Apr. May Jun. July Aug. Sept. Oct. Nov. Dec. Jan. Feb. Mar. Apr. Team)Cymru)uncovers)SOHO) Pharming)activity)with)over) Rapid7)reports)on)vulnerabilities)in) 300,000)active)victims)) Universal)Plug)and)Play)(UPnP))protocol) that)affects)millions)of)devices) 2014 Carna)botnet)/) Internet)Census)2012 ) reveals)extent)of)insecure)soho)devices) and)potential)for)abuse) CVE>2013>3098)CSRF)vulnerability) reported)to)affect)trendnet)routers)) CERT)Poland)reports)campaign) targeting)banking)customers) Page14of14www.team.cymru.com