elasticsearch Vuln Abuse on Amazon Cloud and More for DDoS and Profit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-0196 | Race Condition in Linux Kernel TTY (n_tty_write) Allows Local Privilege Escalation CVE-2014-0196 is a race condition (CWE-362) in the n_tty_write function of the Linux kernel's TTY line discipline, where concurrent read and write operations involving long strings can corrupt memory. A local user triggers it by running a crafted program that performs simultaneous reads and writes of long data strings against a terminal (TTY) device, such as a PTY. Successful exploitation can crash the system (denial of service) or, in favorable memory layouts, let the local user execute code with elevated privileges; because it requires local access, a remote attacker would first need a foothold on the machine. Any Linux deployment running a vulnerable, unpatched kernel is affected, with the greatest risk on legacy or end-of-life systems that never received the 2014 fixes and on multi-user machines where untrusted users can open TTYs. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-05-12, indicating exploitation in the wild; ransomware use is unknown, no public proof-of-concept is catalogued here, and EPSS estimates roughly a 22.5% chance of exploitation in the next 30 days (98th percentile). Do: Patch kernels on all affected hosts with a kernel containing the May 2014 n_tty_write race fix (upstream 3.14.4 or later, or your distribution's backport). Because CISA states the impacted product is end-of-life, prioritize legacy appliances, embedded devices and OS builds that no longer receive kernel updates, and disconnect or replace any EOL system that cannot be patched. In the interim, restrict untrusted local shell access, since exploitation requires the ability to read and write long strings to a TTY. | — | 22% | KEV |
| mass≈ millions of legacy/unpatched Linux systems (kernel ships in billions of devices; realistic residual exposure concentrated in end-of-life 2014-era installs) | |
| CVE-2014-3120 | Remote Code Execution via Dynamic Scripting in Elasticsearch (CVE-2014-3120) CVE-2014-3120 is a remote code execution flaw in Elasticsearch that arises when dynamic scripting is enabled, allowing remote attackers to submit arbitrary MVEL expressions and Java code that the cluster evaluates. It is triggered by sending crafted requests to the Elasticsearch API of a cluster where dynamic scripts are permitted, which is the default configuration in legacy releases. An attacker gains arbitrary Java code execution on the server, which public reporting shows being used for cryptojacking, DDoS botnets, and worm-like propagation. Any Elastic Elasticsearch deployment with dynamic scripting enabled is affected. The flaw is listed in CISA KEV (added 2022-03-25), carries an 88.6% EPSS score, and recent honeypot and botnet reporting indicates multiple threat actors are actively exploiting exposed Elasticsearch clusters. Do: Apply updates per vendor instructions (the CISA KEV required action); current Elasticsearch releases no longer enable dynamic scripting by default, so upgrading removes the exposure. If upgrading is not immediately possible, disable dynamic scripting or restrict script execution, and limit exposure of the Elasticsearch API to trusted networks. Hunt for signs of compromise such as unexpected miner processes, outbound DDoS traffic, or worm-like lateral activity, since Talos honeypot data and WatchDog botnet reporting show this flaw being abused by multiple threat actors. | — | 89% | KEV |
| large≈ tens of thousands of exposed/legacy Elasticsearch clusters |
Full article695 words · extracted from securelist.com · click to collapse
A couple weeks ago, my colleague Mikhail K posted on the “Versatile DDoS Trojan for Linux“, with analysis of several bots, including a bot implementing some extraordinary DNS amplification DDoS functionality. Operators of these bots are currently active, and we observe new variants of the trojan building bigger botnets.
Let’s explore some additional offensive details of this crew’s activity, and details of the overall situation, in the past week. In general, the DDoS trojans are being distributed to fire on victim profiles that seem to indicate purely cybercrime activity. The compromised hosts used to run the bots we observed have been running Amazon EC2 instances, but of course, this platform is not the only one being attacked and mis-used. It’s also interesting that operators of this botnet apparently have no problem working with CN sites, as demonstrated by their use of the site hosting their tools since late 2013. Seven of their eight tools hosted here were uploaded in the past couple of weeks, coinciding with their updated attack activity. Their repository includes recent (cve-2014-0196) and older (cve-2012-0056) Linux escalation of privilege exploit source code, likely compiled on the compromised hosts only when higher privileges are necessary, along with compiled offensive sql tools (Backdoor.Linux.Ganiw.a), multiple webshell (Backdoor.Perl.RShell.c and Backdoor.Java.JSP.k) and two new variants of the “versatile bots” (Backdoor.Linux.Mayday.g), the udp-only “xudp” code being the newer of the two:
But first, how are they getting in to EC2 instances and running their linux DDoS bots from the cloud? They are actively exploiting a known, recent elasticsearch vulnerability in all versions 1.1.x (cve-2014-3120), which happens to still be in active commercial deployment for some organizations. If you are still running 1.1.x, upgrade to the latest 1.2 or 1.3 release, which was released a couple of days ago. Dynamic scripting is disabled by default, and other features added to help ease the migration. From a couple of incidents on Amazon EC2 customers whose instances were compromised by these attackers, we were able to capture very early stages of the attacks. The attackers re-purpose known cve-2014-3120 proof-of-concept exploit code to deliver a perl webshell that Kaspersky products detect as Backdoor.Perl.RShell.c. Linux admins can scan for these malicious components with our server product.
Gaining this foothold presents the attacker with bash shell access on the server. The script “pack.pl” is fetched with wget and saved from the web host above to /tmp/zerl and run from there, providing the bash shell access to the attacker. Events in your index logs may suggest your server has fallen to this attack:
Hosted on the same remote server and fetched via the perl webshell are the DDoS bots maintaining new encrypted c2 strings, detected as Backdoor.Linux.Mayday.g. One of the variants includes the DNS amplification functionality described in Mikhail’s previous post. But the one in use on compromised EC2 instances oddly enough were flooding sites with UDP traffic only. The flow is strong enough that the DDoS’d victims were forced to move from their normal hosting operations ip addresses to those of an anti-DDoS solution. The flow is also strong enough that Amazon is now notifying their customers, probably because of potential for unexpected accumulation of excessive resource charges for their customers. The situation is probably similar at other cloud providers. The list of the DDoS victims include a large regional US bank and a large electronics maker and service provider in Japan, indicating the perpetrators are likely your standard financially driven cybercrime ilk.
Latest Webinars
Reports
Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.
Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.
Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/elasticsearch-vuln-abuse-on-amazon-cloud-and-more-for-ddos-and-profit/65192/