Pierluigi Paganini March 21, 2020

A new variant of the infamous Mirai malware, tracked as Mukashi, targets Zyxel network-attached storage (NAS) devices exploiting recently patched CVE-2020-9054 issue.

Security experts have discovered a new variant of the infamous Mirai malware, tracked as Mukashi, was employed in attacks against network-attached storage (NAS) devices manufactured by Zyxel.

According to Palo Alto researchers, threat actors exploited the recently patched CVE-2020-9054 vulnerability in Zyxel NAS.

“As soon as the proof-of-concept (PoC) for CVE-2020-9054 was made publicly available last month, this vulnerability was promptly abused to infect vulnerable versions of Zyxel network-attached storage (NAS) devices with a new Mirai variant – Mukashi.” reads the analysis published by Palo Alto Network.

“Mukashi brute forces the logins using different combinations of default credentials, while informing its command and control (C2) server of the successful login attempts. Multiple, if not all, Zyxel NAS products running firmware versions up to 5.21 are vulnerable to this pre-authentication command injection vulnerability. The vendor advisory is also available.“

You can test to see if a Zyxel NAS device is vulnerable here.”

In February, Zyxel released security patches to address the CVE-2020-9054 critical remote code execution vulnerability that affects several NAS devices. The flaw can be exploited by an unauthenticated attacker, it resides in the weblogin.cgi CGI executable that doesn’t correctly sanitize the username parameter passed to it. 

An attacker could include certain characters in the username passed the executable to trigger the vulnerability and carry out command injection with the privileges of the webserver.

“Multiple ZyXEL network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device.” reads the advisory published by CERT/CC.

“ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device.”

Experts explained that ZyXEL NAS devices include a setuid utility that can be used to run any command with root privileges.

CERT/CC warned of the availability online of working exploit code for this issue, for this reason, they have created a PoC exploit that power down affected ZyXEL devices.

Palo Alto Networks first spotted the Mukashi’s activity on March 12, when the threat actor attempted to download a shell script to the tmp directory, execute the downloaded script, and remove the evidence on a vulnerable device.

“Upon execution, the zi script downloads different architectures of Mirai bot, runs the downloaded binaries, and removes the binaries. All these binaries were not available on VirusTotal at the time of discovery — 4 out of 8 are in VirusTotal at the time of writing.” continues the analysis.

Once it has infected a device, the Mukashi bot performs brute-force attacks in the attempt to compromise other IoT devices on the network and contacts the C&C server if a login attempt has been successful.

Mukashi searches open TCP port 23 and uses combinations of default credentials to access other systems. The bot supports various commands, like Mirai, such as launching DDoS attacks.

“Mukashi is a bot that scans the TCP port 23 of random hosts, brute forces the logins using different combinations of default credentials, and reports the successful login attempt to its C2 server. Like other Mirai variants, Mukashi is also capable of receiving C2 commands and launching DDoS attacks.”

“When it’s executed, Mukashi prints the message “Protecting your device from further infections.” to the console. The malware then proceeds to change its process name to dvrhelper, suggesting Mukashi may inherit certain traits from its predecessor.” concludes the analysis.

“Prior to carrying out its intended operation, Mukashi binds to the TCP port 23448 in order to ensure only a single instance is running on the infected system.”

Pierluigi Paganini

(SecurityAffairs – Mirai botnet, Mukashi)

[adrotate banner=”5″]

[adrotate banner=”13″]