Satori botnet is back again, experts observed a surge in port scan activity associated with it

This week, security experts observed a surge in port 8000 scan activity, researchers at Qihoo 360 Netlab determined that the unusual activity was associated with Satori IoT botnet.

Experts from Qihoo 360 Netlab discovered that the author of the Satori botnet have integrated a the proof-of-concept (PoC) code for the XionMai web server software package after it was published on June 8.

The code recently included in the Satori botnet exploits a buffer overflow vulnerability, tracked as CVE-2018-10088, in XionMai uc-httpd 1.0.0. The exploit could be used by remote attackers to execute arbitrary code by sending a malformed package via ports 80 or 8000.

“Two days ago, on 2018-06-14, we noticed that an updated Satori botnet began to perform network wide scan looking for uc–httpd 1.0.0 devices.” reads the report published by Qihoo 360 Netlab.

“Most likely for the vulnerability of XiongMai uc–httpd 1.0.0 (CVE-2018-10088). The scanning activities led to a surge in scanning traffic on ports 80 and 8000.”

The lightweight web server package XionMai is often included in the firmware of many IoT devices from Chinese vendors.

Data collected by honeypots used by Qihoo 360 Netlab and SANS ISC confirms the Satori authors also included a second exploit, it allows the bot to target D-Link DSL-2750B devices.

The experts observed port 8000 scans drop down on June 15, the attackers started exploiting the PoC code against D-Link DSL-2750B routers exploited via ports 80 and 8080.

The experts started seeing a surge in scans for the above ports, instead of port 8000 associated with XionMai.

Data collected by security experts demonstrate the evolution of the Satori botnet, its author continues to include new exploit to make the botnet resilient to the takedown of law enforcement and security firm.

Further details, including Indicators of compromise (IoCs) for the Satori botnet are available in Qihoo 360 Netlab report.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Satori botnet, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.