Pierluigi Paganini March 23, 2020

Experts observed multiple botnets exploiting zero-day vulnerabilities in DVRs for surveillance systems manufactured by Taiwan-based LILIN.

Botnet operators are exploiting several zero-day vulnerabilities in digital video recorders (DVRs) for surveillance systems manufactured by Taiwan-based LILIN-

According to the Chinese security firm Qihoo 360’s Netlab team, operators of several botnets, including Chalubo, FBot, and Moobot, targeting LILIN DVRs at least since August 30, 2019.

“Starting from August 30, 2019, 360Netlab Threat Detection System has flagged multiple attack groups using LILIN DVR 0-day vulnerabilities to spread Chalubo[1], FBot[2], Moobot[3] botnets.” reads the advisory published by Netlab.

Netlab shared its findings with LILIN on January 19, 2020, and the vendor addressed the issues with the release of the firmware update (version 2.0b60_20200207).

The LILIN zero-day vulnerability is the chain of parts issues:

• hardcoded login credentials (root/icatch99, report/8Jg0SR8K50);
• /z/zbin/dvr_box command injection vulnerabilities and /z/zbin/net_html.cgi arbitrary file reading vulnerabilities;
• /z/zbin/dvr_box provides Web services, and its web interface /dvr/cmd and /cn/cmd have a command injection vulnerability.

The zero-day flaw could allow attackers to modify a DVR’s configuration file and inject backdoor commands when the FTP or NTP server configurations are synchronized. Below the attack chain described by the experts.

• Device configuration /zconf/service.xml, can be obtained through hard-coded login account password and /z/zbin/net_html.cgi arbitrary file reading;
• By modifying the Server field of the FTP or NTP parameters in the /zconf/service.xml, backdoor command can be injected;
• Remotely access the /dvr/cmd interface through hard-coded account passwords, then use the SetConfiguration function to upload the modified XML entity, now the configuration files can be written to the target device;
• The device periodically synchronizes the FTP or NTP configuration, which triggers the command execution.

According to Netlab, NTP time synchronization (NTPUpdate) process doesn’t check for special characters in the server passed as input, allowing attackers to inject and run commands.

The new firmware released by the vendors validated the hostname passed as input to prevent command execution.

“LILIN users should check and update their device firmwares in a timely fashion, and strong login credentials for the device should be enforced.” Netlab concludes.

“The relevant malicious IPs, URLs and domains should be blocked and investigated on users’network.”

Netlab researchers also included the Indicators of Compromise (IoCs) in their report.

Pierluigi Paganini

(SecurityAffairs – hacking, LILIN)

[adrotate banner=”5″]

[adrotate banner=”13″]