{"id":95751,"date":"2021-08-19T11:00:46","date_gmt":"2021-08-19T18:00:46","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=95751"},"modified":"2023-09-11T15:53:35","modified_gmt":"2023-09-11T22:53:35","slug":"how-to-proactively-defend-against-mozi-iot-botnet","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/19\/how-to-proactively-defend-against-mozi-iot-botnet\/","title":{"rendered":"How to proactively defend against Mozi IoT botnet"},"content":{"rendered":"
Mozi is a peer-to-peer (P2P) botnet that uses a BitTorrent-like network to infect IoT devices such as network gateways and digital video records (DVRs). It works by exploiting weak telnet passwords1<\/sup> and nearly a dozen unpatched IoT vulnerabilities2<\/sup> and it\u2019s been used to conduct distributed denial-of-service (DDoS) attacks, data exfiltration, and command or payload execution3<\/sup>.<\/p>\n While the botnet itself is not new, Microsoft\u2019s IoT security researchers recently discovered that Mozi has evolved to achieve persistence on network gateways manufactured by Netgear, Huawei, and ZTE. It does this using clever persistence techniques that are specifically adapted to each gateway\u2019s particular architecture.<\/p>\n Network gateways are a particularly juicy target for adversaries because they are ideal as initial access points to corporate networks. Adversaries can search the internet for vulnerable devices via scanning tools like Shodan, infect them, perform reconnaissance, and then move laterally to compromise higher value targets\u2014including information systems and critical industrial control system (ICS) devices in the operational technology (OT) networks.<\/p>\n By infecting routers, they can perform man-in-the-middle (MITM) attacks\u2014via HTTP hijacking and DNS spoofing\u2014to compromise endpoints and deploy ransomware or cause safety incidents in OT facilities. In the diagram below we show just one example of how the vulnerabilities and newly discovered persistence techniques could be used together. Of course, there are many more possibilities.<\/p>\n <\/p>\n Figure 1: Attack flow for Mozi botnet.<\/em><\/p>\n Businesses and individuals that are using impacted network gateways (Netgear, Huawei, and ZTE) should take the following steps immediately to ensure they are resistant to the attacks described in this blog:<\/p>\n Doing so will reduce the attack surfaces leveraged by the botnet and prevent attackers from getting into a position where they can use the newly discovered persistence and other exploit techniques described in more detail below.<\/p>\n The intelligence of our security cloud and all of our Microsoft Defender products, including Microsoft 365<\/a>\u00a0Defender<\/a> (XDR), Azure Sentinel<\/a> (cloud-native SIEM\/SOAR), as well as Azure Defender for IoT<\/a> also provide protection from this malware and are continuously updated with the latest threat intelligence as the threat landscape continues to evolve. The recent acquisition of ReFirm Labs<\/a> will further enhance Azure Defender for IoT\u2019s ability to protect customers with its upcoming deep firmware scanning, analysis capabilities which will be integrated with Device Update for Azure IoT Hub\u2019s<\/a> patching capabilities.<\/p>\n Apart from its known extensive P2P and DDoS abilities, we have recently observed several new and unique capabilities of the Mozi botnet.<\/p>\n Targeting Netgear, Huawei, and ZTE gateways, the malware now takes specific actions to increase its chances of survival upon reboot or any other attempt by other malware or responders to interfere with its operation. Here are some examples:<\/p>\n A specific check is conducted for the existence of the \/overlay<\/strong> folder, and whether the malware does not have write permissions to the folder \/etc<\/strong>. In this case, it will try to exploit CVE-2015-1328<\/a><\/strong>.<\/p>\n Successful exploitation of the vulnerability will grant the malware access to the following folders:<\/p>\n Then the following actions are taken:<\/p>\n A specific check is conducted for the existence of the \/usr\/local\/ct<\/strong> folder; this serves as an indicator of the device being a ZTE modem\/router device.<\/p>\n The following actions are taken:<\/p>\n Execution of the following commands changes the password and disables the management server for Huawei modem\/router devices. It also prevents others from gaining access to the device through the management server.<\/p>\n To provide an additional level of persistence it also creates the following files if needed and appends an instruction to run its copy from \/usr\/networks<\/strong>.<\/p>\n The malware blocks the following TCP ports:<\/p>\n These ports are used to gain remote access to the device. Shutting them increases the malware\u2019s chances of survival.<\/p>\n It scans for .sh<\/strong> files in the filesystem, excluding the following paths:<\/p>\n It also appends a line to each file. The line instructs the script to run a copy of the malware from \/usr\/networks<\/strong>. This increases its chances of survival on various devices.<\/p>\n The malware receives commands from its distributed hash table (DHT) network. The latter is a P2P protocol for decentralized communications. The commands are received and stored in a file, of which parts are encrypted. This module works only on devices capable of IPv4 forwarding. It checks whether \/proc\/sys\/net\/ipv4\/ip_forward<\/strong> is set to 1; such positive validation is characteristic of routers and gateways. This module works on ports UDP 53 (DNS) and TCP 80 (HTTP).<\/p>\n Apart from the previously documented commands in Table 1\u2014for more information, read A New Botnet Attack Just Mozied Into Town<\/a>\u2014we also discovered these commands:<\/p>\nGuidance: Proactive defense<\/h2>\n
\n
Technical description of new persistence capabilities<\/h2>\n
Achieving privileged persistence<\/h3>\n
\n
\n
ZTE devices<\/h3>\n
\n
sendcmd 1 DB set MgtServer 0 Tr069Enable 1 \r\nsendcmd 1 DB set PdtMiddleWare 0 Tr069Enable 0 \r\nsendcmd 1 DB set MgtServer 0 URL http:\/\/127.0.0.1 \r\nsendcmd 1 DB set MgtServer 0 UserName notitms \r\nsendcmd 1 DB set MgtServer 0 ConnectionRequestUsername notitms \r\nsendcmd 1 DB set MgtServer 0 PeriodicInformEnable 0 \r\nsendcmd 1 DB save<\/pre>\n
Huawei devices<\/h3>\n
cfgtool set \/mnt\/jffs2\/hw_ctree.xml \r\nInternetGatewayDevice.ManagementServer URL http:\/\/127.0.0.1\r\ncfgtool set \/mnt\/jffs2\/hw_ctree.xml \r\nInternetGatewayDevice.ManagementServer ConnectionRequestPassword acsMozi<\/pre>\n
\/mnt\/jffs2\/Equip.sh\r\n\/mnt\/jffs2\/wifi.sh\r\n\/mnt\/jffs2\/WifiPerformance.sh<\/pre>\n
Preventing remote access<\/h3>\n
\n
Script infector<\/h3>\n
\/tmp \/dev \/var \/lib \/haha \/proc \/sys<\/pre>\n
Traffic injection and DNS spoofing capabilities<\/h3>\n
Configuration commands<\/h3>\n
[hi] \u2013 Presence of the command indicates it needs to use the MiTM module.\r\n[set] \u2013 Contains encrypted portion which describes how to use the MiTM module.<\/pre>\n