In a brief interview to Security Affairs @unixfreakjp of MalwareMustDie group explains which are the main characteristics in order to be able to fight against this new malware with a proper security awareness.
After Mirai escalation it has become clear that the new landscape and very remunerative environment of the DDoS attacks will be more and more populated in the near future by IoT devices, “things” that normally are delivered without adequate quality control and are compromised by flaws that can be easily exploited.
Nevertheless, in the recent times, we have learned that IoT has been often rooted by using a brute force attack, succeeding also because IoT devices are deployed, as we said elsewhere, without changing the default credentials.
This was exactly the scheme of Mirai, as we have described in the past articles.
However, what we have here it’s something new and magnificently described by the last post of the by now worldwide famous whitehat researcher that has discovered and reverse engineered Mirai malware, @unixfreaxjp of the MalwareMustDie group.
In his post, he specifies, in fact, that the new IRC botnet ELF malware is yes having the specification of Tsunami/Kaiten protocol, but is recorded “in a different way adding some more features in messaging and malicious/attack vectors used”.
An explosive mix of new and classic features in this made in Italy new IRC botnet ELF malware
Here a syntactical outline of key points of this new Linux/IRCTelnet malware (the bot client) which has the following characteristics and conceptual schemes:
1) designed to attack IoT using telnet protocol, yes by now IoT is the new Eldorado, we know,
2) using the telnet scanner as in the past done by GayFgt/Torlus/Lizkebab/Bashdoor/Bashlite of which we report a reconstructed C code snapshot:
Figure 1 The telnet scanner.
3) using the Mirai leaked credential list and brute force passwords dictionary hardcoded in the binary code like represented below:
Figure 2. The bruteforce password dictionary
4) using a combined concept of Kaiten (IRC protocol used) by sending commands from a malicious C&C IRC server. Below we report the log made by @unixfreakjp using a PoC implemented for decoding the values and behavior of the malware.
Figure 3. The IRC C&C Server log
5) it is made in Italy: among some other evidence, there are some Italian strings found inside the binary code, containing Italian words as shown in the next figure. We know that he attack to infect this botnet was started on October 25th, 2016.
Figure 4. The Italian messages inside the binary code of the new Linux/IRCTelnet malware.
We want to underline the noble position of MalwareMustDie post who publicly stated in his Blog, that he didn’t want to include in the codename of this new malware nothing related to the Italian country.
But let’s analyze quickly the new features of the malware because there are something utterly new and certainly scaring.
The first time of IPv6 use to aims IoT (and IP spoofing of the bots)
During the reverse phase, inside the new malware has been discovered a generator of “TCP6” and “UDP6” packets that can be associated with the option “spoof6” coded.
It seems to be the first time that IPv6 has been used to aims IoT and since now is possible to generate DDoS attacks spoofed where is impossible to recognize the IP of the infected bot.
The reconstructed code related to the flooding looks bad and it seems that a lot of “DoS attack combination is planned”.
Figure 5. The DDoS attack sequence of the Linux/IRCTelnet malware
The comment of @unixfreaxjp of MawareMustDie to the new IPv6 capability is that “this botnet is supported attacks(DDoS) of IPv4 and IPv6 packets through the attack generator sending functions called sendV4() and sendV6().” And during the attack, there is another capability that is the “spoofing IP address also be done in the IPv4 or IPv6 form” that is really scaring.
Below is reported the flooding generating function on IPV6:
Figure 6. Reverse of the flooding generating function on IPv6
Then we can say that the focus of this new feature is the flooding based on IPv6 and the Author of the MMD Post ask to himself, and to all the Security Researcher Community: “Are we ready to dealing with IoT IPv6 DDoS now”?
Figure 7. Reddit discussion on IPv6
This is the big deal of the moment and the challenge of the future: but let’s go to the interview that @unixfreakjp of MalwareMustDie has released a few hours ago to Security Affairs.
This Linux/IRCTelnet , if being ignored as per what happened in Mirai, can be a dangerous threat too. This is the first malware run in IRC cnc that is using telnet scanner to infect other IoT, and it is aiming IoT, due to the vulnerable vectors in that vector.
So, I don’t say Linux/IRCTelnet is more dangerous than Mirai. Each of them has its own dangerous vector, it will depend on us on how to respond to handle this threat
And this spoofing and also the attack is supported to IPv6. This is important since there is no DDOS botnet that is coded and designed to hit services in IPv6 yet.
This is the log of the IRC Server, as you see 3486 “users” were connected at that time.
About the Author: Odisseus
Independent Security Researcher involved in Italy and worldwide in topics related to hacking, penetration testing, and development.
Edited by Pierluigi Paganini