Pierluigi Paganini April 07, 2017

Security experts at Palo Alto Networks have discovered a new Linux/IoT botnet dubbed Amnesia botnet that has been targeting digital video recorders (DVRs).

Amnesia exploited an unpatched remote code execution vulnerability that was disclosed more than one year ago by security researcher Rotem Kerner.

“fraudsters are adopting new tactics in order to attack retailers. This new attack vector is to compromise DVR boxes, which is the heart component of any CCTV system. This was allowing them to achieve two goals at once-

1. Verify a targeted host actually belongs to a retailer.
2. Get a foothold inside the local network, one step closer to the POS station.

” wrote Kerner.

Kerner reported the flaw in March 2016, but after a year opted to publicly reveal his discovery because the vendor ignored him.

According to Palo Alto Networks, the Amnesia is a variant of the Tsunami botnet that is a downloader/IRC Bot backdoor used in the criminal ecosystem to launch DDoS attacks. The Amnesia botnet targets embedded systems, particularly DVRs manufactured by the Chinese TVT Digital that is currently sold under more than 70 brands worldwide.

The security vulnerability discovered by the researcher is still unpatched and according to the results of an Internet scan conducted by Palo Alto Networks, there are roughly 227,000 vulnerable DVR devices in worldwide.

“Based on our scan data shown below in Figure 1, this vulnerability affects approximately 227,000 devices around the world with Taiwan, the United States, Israel, Turkey, and India being the most exposed.” states the analysis published by PaloAlto Networks.

The Amnesia botnet was built exploiting the remote code execution vulnerability that allowed the attackers to take complete control of the devices.

A different analysis conducted with the Censys search engine revealed more than 700,000 IP addresses.

“Additionally, by using the fingerprint of “Cross Web Server”, we discovered over 227,000 devices exposed on Internet that are likely produced by TVT Digital. We also searched the keyword on Shodan.io and on Censys.io. They reported about 50,000 and about 705,000 IP addresses respectively.” states PaloAlto Networks.

Experts believe the Amnesia malware is the first Linux malware to adopt virtual machine evasion techniques to elude malware analysis sandboxes.

“Virtual machine evasion techniques are more commonly associated with Microsoft Windows and Google Android malware. Similar to those, Amnesia tries to detect whether it’s running in a VirtualBox, VMware or QEMU based virtual machine, and if it detects those environments it will wipe the virtualized Linux system by deleting all the files in file system.” continues the analysis. “This affects not only Linux malware analysis sandboxes but also some QEMU based Linux servers on VPS or on public cloud.”

Experts at PaloAlto believe the Amnesia botnet has the potential to become one of the major botnets in the threat landscape and would be used for large-scale attacks.

For further information on Amnesia give a look at the technical report that also includes IoCs.

Pierluigi Paganini

(Security Affairs – Amnesia botnet, IoT)

[adrotate banner=”5″]

[adrotate banner=”13″]