Hide n Seek. An Adaptive Peer-to-Peer Botnet. Adrian Șendroiu Vladimir Diaconescu

Transcription

1 Hide n Seek An Adaptive Peer-to-Peer Botnet Adrian Șendroiu Vladimir Diaconescu

2 Context IoT Botnets increasing in impact and diversity Tried and tested models (Mirai) Central C2 Server (Different) Infecting machine (Different) Reporting machine Dictionary and CVE extensions Main objective: DDoS

3 Analysis - Overview A new idea: Peer-to-Peer botnet Also seen in Hajime Custom protocol Modular Authenticated Different goals

4 Functionality Two main components Scanner

5 Functionality Two main components Scanner P2P protocol

6 Scanning for victims Pick a random IP and a port 23, 2323 (telnet) - try default credentials 80, 8080 (http) - try known IoT exploits ADB Others (2480, 5984)

7 Analysis - Infection process

8 Analysis - Infection process: Scan TCP SYN :23 ACK SCAN

9 Analysis - Infection process: Connect Get login prompt login: SCAN CONN

10 Analysis - Infection process: Dictionary user k :password k user@host:/~ SCAN CONN DICT

11 Analysis - Infection process: Sysinfo cat /proc/cpuinfo ARM SCAN CONN DICT INFO

12 Analysis - Infection process: Probing wget curl base64 wget: not found curl: not found SCAN CONN DICT INFO PROB

13 Analysis - Infection process: Dropping echo -e \x7felf > abc chmod +x abc SCAN CONN DICT INFO PROB DROP

14 Analysis - Infection process: Dropping./abc a :5678 k23 l4444 e :80 SCAN CONN DICT INFO PROB DROP

15 Analysis - Infection process: Dropping./abc a :5678 k23 l4444 e :80 Initial starting peers SCAN CONN DICT INFO PROB DROP

16 Analysis - Infection process: Dropping./abc a :5678 k23 l4444 e :80 Initial starting peers Kill port SCAN CONN DICT INFO PROB DROP

17 Analysis - Infection process: Dropping./abc a :5678 k23 l4444 e :80 Initial starting peers Kill port P2P listening port (UDP) SCAN CONN DICT INFO PROB DROP

18 Analysis - Infection process: Dropping./abc a :5678 k23 l4444 e :80 Initial starting peers Kill port P2P listening port (UDP) Additional scan targets SCAN CONN DICT INFO PROB DROP

19 P2P protocol Custom UDP protocol Data structures Messages

20 Data structures - Peer table IP port

21 Data structures - Caches payload id -> hash hash -> data 0x15 0x13 -> 1af3 -> 3f f14 -> \x7felf... 1af3... -> \x7felf config cache data cache

22

23 $ cat /proc/cpuinfo

24 $ cat /proc/cpuinfo... model name : ARMv7 Processor rev 1... What to download?

25 $ cat /proc/cpuinfo... model name : ARMv7 Processor rev 1... payload id -> hash hash -> data 0x15 0x13 -> 1af3 -> 3f f14 -> \x7felf... 1af3... -> \x7felf config cache data cache

26 $ cat /proc/cpuinfo... model name : ARMv7 Processor rev 1... payload id -> hash hash -> data 0x15 0x13 -> 1af3 -> 3f f14 -> \x7felf... 1af3... -> \x7felf config cache data cache

27 $ cat /proc/cpuinfo... model name : ARMv7 Processor rev 1... payload id -> hash hash -> data 0x15 0x13 -> 1af3 -> 3f f14 -> \x7felf... 1af3... -> \x7felf config cache data cache

28 $ cat /proc/cpuinfo... model name : ARMv7 Processor rev 1... payload id -> hash hash -> data 0x15 0x13 -> 1af3 -> 3f f14 -> \x7felf... 1af3... -> \x7felf config cache data cache

29 $ cat /proc/cpuinfo... model name : ARMv7 Processor rev 1... payload id -> hash hash -> data 0x15 0x13 -> 1af3 -> 3f f14 -> \x7felf... 1af3... -> \x7felf config cache data cache

30 $ echo -e \x7felf > abc;./abc payload id -> hash hash -> data 0x15 0x13 -> 1af3 -> 3f f14 -> \x7felf... 1af3... -> \x7felf config cache data cache

31 P2P protocol messages Config cache update Peer management Target reporting 1 byte id message data

32 Config cache update payload id -> hash

33 Config cache update payload id -> hash 0x15 0x13 -> 1af3 -> 3f14...

34 Config cache update h 0 h 0 h 0 h - config cache version report

35 Config cache update H 5 H 8 H 5 H - config cache version reply

36 Config cache update y 0 Y 0 data y - chunk request Y - chunk reply check signature

37 $ cat /proc/cpuinfo... model name : ARMv7 Processor rev 1... payload id -> hash hash -> data 0x15 0x13 -> 1af3 -> 3f f14 -> \x7felf... 1af3... -> \x7felf config cache data cache

38 Config cache update y 0 Y 0 data y - chunk request Y - chunk reply check signature

39 Data cache update hash -> data 3f14 -> \x7felf... 1af3... -> \x7felf

40 Peer update ~ ~ ~ - peer request ~

41 Peer update ^ ^ ^ ^ - peer reply

42 Target device reporting GET /some/exploit

43 Target device reporting HTTP/ Not Found GET /some/exploit

44 Target device reporting z

45 Target device reporting GET /some/exploit

46 Target device reporting GET /some/exploit HTTP/ OK

47 Hide n Seek - Summary Infects many kinds of IoT systems Decentralized P2P architecture Network controlled by the author

48 Updates

49 Updates ~30 samples Code refactoring New functionality

50 Updates ~30 samples Code refactoring New functionality Persistency (copy itself to /etc/init.d/s99abcd)

51 Updates ~30 samples Code refactoring New functionality Persistency (copy itself to /etc/init.d/s99abcd) Dropping other binaries cpuminer

52 Updates HTTP-based exploits for more IoT vendors

53 Updates HTTP-based exploits for more IoT vendors RCE via OrientDB and CouchDB

54 Updates HTTP-based exploits for more IoT vendors RCE via OrientDB and CouchDB Hijacking devices via ADB

55 Monitoring

56 Monitoring ~ ~ ^ ^ ~ ^

57 Monitoring ~300,000 peers

58 Conclusions A new trend in the IoT landscape Qbot, Mirai

59 Conclusions A new trend in the IoT landscape Qbot, Mirai Hajime

60 Conclusions A new trend in the IoT landscape Qbot, Mirai Hajime, Satori

61 Conclusions A new trend in the IoT landscape Qbot, Mirai Hajime, Satori, Reaper

62 Conclusions A new trend in the IoT landscape Qbot, Mirai Hajime, Satori, Reaper, VPNFilter

63 Conclusions A new trend in the IoT landscape Qbot, Mirai Hajime, Satori, Reaper, VPNFilter, HNS

64 Conclusions A new trend in the IoT landscape Qbot, Mirai Hajime, Satori, Reaper, VPNFilter, HNS More threats to come

65 Q&A