{"id":562,"date":"2017-04-29T15:04:27","date_gmt":"2017-04-29T23:04:27","guid":{"rendered":"https:\/\/www.pnfsoftware.com\/blog\/?p=562"},"modified":"2017-05-01T09:23:24","modified_gmt":"2017-05-01T17:23:24","slug":"analyzing-mips-iot-malware-with-jeb","status":"publish","type":"post","link":"https:\/\/www.pnfsoftware.com\/blog\/analyzing-mips-iot-malware-with-jeb\/","title":{"rendered":"Analyzing a New MIPS IoT Malware With JEB"},"content":{"rendered":"

Over the last few months, several major vulnerabilities in a certain brand of IP cameras have been publicly released. One vulnerability allows remote code execution<\/a>, while another permits the retrieval of the administrator\u2019s credentials<\/a>. The situation is made worse by the fact that many of these cameras are reachable on the Internet (around 185,000 according to one of the researcher<\/a>). <\/span><\/p>\n

It did not take long for miscreants to abuse this discovery, and a novel malicious software 1<\/a><\/sup>\u00a0was recently propagated through the vulnerable cameras, as described in a 360.cn blog post<\/a>. <\/span><\/p>\n

This malicious software\u00a0comes with MIPS and ARM versions, so we decided to quickly analyze it using our brand new MIPS decompiler<\/a>. This blog post describes our findings.<\/span><\/p>\n

Note: JEB MIPS decompiler being in beta mode, the decompiled output presented in this blog post should be considered with caution; we provide it mainly to allow the reader to get an idea of JEB capabilities. As we are constantly refining the decompiler, the produced code will strongly evolve in the next few months.<\/span><\/i><\/p>\n

Recon<\/span><\/h1>\n

The sample we will be analyzing is the following:<\/span><\/p>\n

7A0485E52AA09F63D41E471FD736584C06C3DAB6: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped<\/pre>\n
After opening it in JEB, our disassembler found 526\u00a0routines. To give the reader an idea, here is what it looks like at the program entry point:<\/p>\n
\"\"<\/a><\/p>\n
We can see here the disassembled MIPS code, which can be a hard language to read to say the least. Hopefully JEB is able to decompile it, as shown below (names are our own): <\/span><\/p>\n
\"\"<\/a><\/p>\n
The <\/span>main()<\/span><\/em> routine is where the malware logic lies, and will be described below.<\/span><\/p>\n
The interested reader might have noticed the comments in the assembly code. Those comments are the result of what we call the \u201cadvanced analysis\u201d step, which can be roughly described as an emulation of the native code (based on JEB custom intermediate representation). This allows to find the actual values manipulated by the code, when those values are the result of previous computations. The advanced analysis will be properly described in a separate blog post.<\/span><\/em><\/p>\n
But before going on with the analysis, one might want to take a look at the strings used by the malware, to get a sense of its abilities:<\/span><\/p>\n
\"\"<\/a><\/p>\n
We can observe some likely C&C server information, and various strings related to the malware network abilities. Interestingly, an Arabic string clearly stands out\u00a0from the others; it can be translated to \u201cLoading Version 1\u201d<\/strong>.<\/span><\/p>\n
A final preparation step is to look at the system calls made by the malicious software, as it allows to easily understand some routines behavior. JEB automatically renames such syscalls — rather than just showing the system call number resulting from the advanced analysis phase, and displays them in a separate panel:<\/span><\/p>\n
\"\"<\/a><\/p>\n
The user can then jump to these syscall references, and rename them appropriately, as done in the following example:<\/span><\/p>\n
\"\"<\/a><\/p>\n
Through this process we renamed around 60 routines that are simply wrappers for syscalls.<\/span><\/p>\n
Our reconnaissance step being done, we can now dig into the malware core logic!<\/span><\/p>\n
Workflow <\/span><\/h1>\n
We start at the <\/span>main()<\/span><\/em> routine previously mentioned, and describe here the main steps of this malicious software. As we will see, part of this malware code is borrowed from the infamous Mirai malware, whose source code was made public<\/a> in September 2016.<\/span><\/p>\n
Initialization<\/span><\/h2>\n
At startup the malware does a few initialization steps, most of them being directly copy-pasted from Mirai. There is one original action though, which can be seen in the following image:<\/span><\/p>\n
\"\"<\/a><\/p>\n
The files <\/span>\/tmp\/ftpupdate.sh<\/span><\/em> and <\/span>\/tmp\/ftpupload.sh<\/span><\/em> are first removed, then linked to <\/span>\/dev\/null<\/span><\/em>. These two files are used by various exploits against these IP cameras, and hence the malware makes sure a newly infected device can not be infected again.<\/span><\/p>\n
C&C Commands<\/span><\/h2>\n
The malware then enters in a loop to fetch 1-byte commands from the C&C server (whose domain name is hardcoded). We counted 8 different commands, some of them having subcommands. We will now describe the most interesting ones.<\/span><\/p>\n
Infection<\/span><\/h3>\n
As previously explained, this malware propagates by infecting vulnerable IP cameras connected to the Internet. To do so, it first scans the Internet for these devices, by re-using the TCP SYN scanner of the Mirai malware. To illustrate that, here is the scanner initialization loop, as seen in the released Mirai source code<\/a><\/span>\u00a0and in the decompiled code of our malware:<\/span><\/p>\n
Scanner code, as seen in Mirai source code…<\/b>\"\"<\/a><\/p>\n
… versus the new malware code decompiled by JEB<\/b>\"\"<\/a><\/p>\n
The only major difference is that the TCP destination port is fixed to 81 in our malicious software, rather than alternate between port 23 and 2323 in Mirai. It is worth noting than even the loop counter has the same value (<\/span>SCANNER_RAW_PPS<\/span><\/em> is set to 160 in Mirai source code).<\/span><\/p>\n
If the malware finds a device with an opened port 81, it then launches the actual exploit, which is built from a combination of publicly known vulnerabilities in the IP camera web server:<\/span><\/p>\n
    \n
  1. Extract the device administrator\u2019s credentials by sending an HTTP request for the file <\/span>login.cgi<\/span><\/em> and then parsing the answer for the administrator login and password (documented here<\/a>).
    \n<\/span><\/li>\n
  2. Send two specially crafted HTTP requests to first plant a connect-back payload on the device, and then execute it (documented here<\/a>). The sending of this first request is shown below, as seen in JEB:
    \n    \"\"<\/a>
    \n<\/span><\/li>\n<\/ol>\n
    Once the connection has been established with the miscreants\u2019 server thanks to the connect-back payload, the newly infected device is asked to download and run the malicious software, as described in the 360.cn blog post<\/a>.<\/span><\/p>\n
    Attack Routers
    \n<\/span><\/h4>\n
    Another action possibly ordered by the C&C server is to scan for UPnP enabled devices, in order to add a port forwarding entry to them. Such UPnP devices typically include home routers.<\/span><\/p>\n
    To do so, the malicious software starts to repeatedly send UPnP discovery messages to random IP addresses:<\/span><\/p>\n
    \"\"<\/a><\/p>\n
    Once a UPnP enabled device has been found, a SOAP request is forged to add a new port forwarding entry in its configuration:<\/span><\/p>\n
    \"\"<\/a><\/p>\n
    As mentioned in another 360.cn blog post<\/a>, this code may be used to exploit the CVE-2014-8361<\/a>\u00a0vulnerability, which allows to execute system commands with root privileges through the <NewInternalClient><\/em> SOAP tag. Also, notice the <\/span><NewPortMappingDescription><\/span><\/em> tag set to <\/span>Skype <\/span><\/em>to attempt hiding\u00a0the request<\/span>. <\/span><\/p>\n
    UDP DDoS<\/span><\/h4>\n
    As documented in the 360.cn blog, the malicious software can launch a denial of service attack over UDP. The packets are built from the SSDP discovery message, which may also serve as a preparation step for a SSDP reflection attack<\/a>, though it appears the code for that is not present in the binary.<\/span><\/p>\n
    Interestingly, there is another denial of service attack implemented, using a 25-byte payload shown below:<\/span><\/p>\n
    \"\"<\/a><\/p>\n
    This payload is used in amplification attacks through Valve Source Engine servers<\/a>.<\/span><\/p>\n
    Conclusion <\/span><\/h1>\n
    We hope the readers enjoyed this quick analysis; feel free to ask questions in the comments section below. <\/span><\/p>\n
    JEB MIPS decompiler<\/a> is currently in beta mode, and a demo version can be downloaded on our website<\/a>.<\/span><\/i><\/p>\n
    <\/h1>\n
    \n
    <\/div>\n
      \n
    1.  This malware was named http81<\/em> by 360, Persirai<\/em> by ESET, or is simply recognized as a variant of Mirai<\/em> by other vendors. ↩<\/a><\/span><\/li>\n<\/ol>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
      Over the last few months, several major vulnerabilities in a certain brand of IP cameras have been publicly released. One vulnerability allows remote code execution, while another permits the retrieval of the administrator\u2019s credentials. The situation is made worse by the fact that many of these cameras are reachable on the Internet (around 185,000 according … Continue reading Analyzing a New MIPS IoT Malware With JEB<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,2],"tags":[],"class_list":["post-562","post","type-post","status-publish","format-standard","hentry","category-jeb2","category-malware"],"_links":{"self":[{"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/posts\/562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/comments?post=562"}],"version-history":[{"count":0,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/posts\/562\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/media?parent=562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/categories?post=562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/tags?post=562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}