Hundreds of thousands of routers exposed to Eternal Silence campaign via UPnP
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0144 | Remote Code Execution in Microsoft SMBv1 (EternalBlue) affecting Windows and Siemens devices CVE-2017-0144 is a remote code execution flaw in the SMBv1 server component of Microsoft Windows, commonly known as EternalBlue, and one of the SMB flaws fixed by Microsoft in the March 2017 MS17-010 bulletin. An attacker who can reach the SMB service over the network sends specially crafted packets that trigger memory corruption in the SMBv1 implementation, gaining the ability to execute arbitrary code on the target without user interaction. Successful exploitation yields full system compromise and has been heavily weaponized for wormable spread and ransomware delivery, notably via the leaked NSA exploit and in the WannaCry/NotPetya-era outbreaks, and the flaw has repeatedly been bundled into botnets and ransomware tooling since. Anyone running unpatched Windows Vista SP2 through Windows 10 1607 / Windows Server 2016 with SMBv1 enabled is affected, as are Siemens medical and laboratory devices (ACUSON ultrasound, syngo SC2000, Tissue Preparation System, VERSANT kPCR systems) whose firmware depends on SMBv1. Exploitation is actively ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with known ransomware use, carries a 99.2% EPSS exploitation probability (100th percentile), and multiple public exploits and PoCs are available. Do: Apply the Microsoft MS17-010 (March 2017) security updates on every listed Windows version and the corresponding Siemens firmware updates for ACUSON, syngo SC2000, Tissue Preparation System, and VERSANT kPCR devices, per CISA's required action to apply vendor updates. Where patching is not yet possible, disable SMBv1 or block inbound TCP 445 (and UDP 137/138) at network boundaries and isolate legacy/medical systems from the internet. Sweep exposed and legacy hosts for compromise indicators, including DOUBLEPULSAR implants delivered over SMB, as public tooling for detecting and neutralizing this implant is available. | 8.8 | 99% | KEV ransomware PoC ×6 |
| massorder of hundreds of thousands of internet-exposed SMB endpoints, and millions of unpatched Windows systems when internal enterprise and medical-device… | |
| CVE-2017-7494 | Unauthenticated RCE in Samba via malicious shared library upload (SambaCry) CVE-2017-7494, widely known as "SambaCry," is a remote code execution vulnerability (CWE-94, code injection) in Samba versions since 3.5.0, fixed in 4.6.4, 4.5.10, and 4.4.14. A malicious client with write access to a share uploads a shared library to a writable share and then causes the Samba server to load and execute it, giving the attacker code execution on the host with the privileges of the Samba service. Because Samba is bundled with most Linux distributions and with NAS and other embedded devices, both enterprise Linux servers and consumer/small-business NAS appliances are affected; Debian also ships affected Samba packages. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30) with known ransomware use, and public reporting ties it to the SambaCry, CowerSnail, ETERNALSILENCE, and SHELLBIND malware campaigns. EPSS assigns a 99.4% probability of exploitation within 30 days (100th percentile). Do: Upgrade Samba to 4.6.4 or later (4.6.x), 4.5.10 or later (4.5.x), or 4.4.14 or later (4.4.x/earlier), or install updated samba packages from your distribution (e.g., Debian) per vendor instructions, as required by the CISA KEV catalog. Until patched, remove or restrict write access on shares reachable by untrusted clients, and audit writable shares for unexpected shared-library (.so) files that may have been planted by attackers. Prioritize internet-facing Samba servers and NAS devices, given confirmed ransomware and IoT/NAS malware exploitation of this flaw. | 9.8 | 99% | KEV ransomware |
| massOn the order of hundreds of thousands of internet-exposed Samba/SMB servers and NAS devices; millions of installations in total |
Full article805 words · extracted from securityaffairs.com · click to collapse
A hacking campaign, tracked as Eternal Silence, is abusing UPnP to compromise routers and use them to carry out malicious activities.
Researchers from Akamai have spotted a malicious campaign, tracked as ‘Eternal Silence,’ that is abusing Universal Plug and Play (UPnP) to turn routers into a proxy server used to carry out a broad range of malicious activities anonymously.
Universal Plug and Play (UPnP) is a set of networking protocols that allows networked devices to seamlessly discover each other’s presence on the network and establish functional network services.
In April 2018, Akamai reported that threat actors compromised 65,000 home routers by exploiting vulnerabilities in Universal Plug’N’Play (UPnP), experts tracked the botnet as UPnProxy. In December 2018, the company provided an update to its initial analysis revealing a disconcerting scenario, UPnProxy was still up and running.
The UPnP communication protocol is widely adopted even if it is known to be vulnerable. In early 2013, researchers at Rapid7 published an interesting whitepaper entitled “Security Flaws in Universal Plug and Play” that evaluated the global exposure of UPnP-enabled network devices.
The report highlighted that over 23 million IPs related to Portable UPnP SDK were vulnerable to remote code execution just through a single UDP packet, over 6,900 product versions from over 1,500 vendors were vulnerable through UPnP due to the exposure of UPnP SOAP service to the internet.
Abusing the protocol attackers can control the traffic in and out of the networks, UPnP allows the automated negotiation and configuration of port opening/forwarding within a NATed networking environment. The malicious botnet uncovered by Akamai was composed of vulnerable devices, including malicious NAT injections, it turns routers into proxies, for this reason, the experts called the injected devices UPnProxy.
Experts recommend users installing routers update and patched firmware to mitigate the threat. According to Akamai, many UPnP vulnerabilities are still unpatched, the experts found that out of a pool of 3.5 million potentially vulnerable routers, 277,000 were still open to UPnProxy, and 45,000 have been compromised.
Recently Akamai experts discovered a new family of injections, which they’ve dubbed Eternal Silence. The name EternalSilence comes from port mapping descriptions left by the attackers.
The experts believe that threat actors behind the campaign leveraged EternalBlue (CVE-2017-0144) and EternalRed (CVE-2017-7494) exploits on unpatched Windows and Linux systems, respectively.
The researchers discovered new rulesets, affecting over 45,000 routers, all containing ‘galleta silenciosa’ or ‘silent cookie/cracker’ in Spanish. These sets of injections were used to expose the TCP ports 139 and 445 on devices behind the router.
{"NewProtocol": "TCP", "NewInternalPort": "445", "NewInternalClient": "192.168.10.212",
"NewPortMappingDescription": "galleta silenciosa", "NewExternalPort": "47669"}“Currently, the 45,113 routers with confirmed injections expose a total of 1.7 million unique machines to the attackers. We’ve reached this conclusion by logging the number of unique IPs exposed per router, and then added them up. It is difficult to tell if these attempts led to a successful exposure as we don’t know if a machine was assigned that IP at the time of the injection.” reads the analysis published by Akamai. “Additionally, there is no way to tell if EternalBlue or EternalRed was used to successfully compromise the exposed machine. However, if only a fraction of the potentially exposed systems were successfully compromised and fell into the hands of the attackers, the situation would quickly turn from bad to worse.”
The attackers could exploit the above vulnerabilities to carry out crypto-mining campaigns, ransomware attacks, or worm-like attacks that rapidly spread to entire corporate networks.
“This shotgun approach may be working too, because there is a decent possibility that machines unaffected by the first round of EternalBlue and EternalRed attacks (that may have remained unpatched) were safe only because they weren’t exposed directly to the internet. They were in a relatively safe harbor living behind the NAT.” continues Akamai. “The EternalSilence attacks remove this implied protection granted by the NAT from the equation entirely, possibly exposing a whole new set of victims to the same old exploits.”
Experts pointed out that it is quite difficult to detect ‘Eternal Silence’ attacks.
It is not easy for administrators to detect malicious NAT injections, because of the lack of visibility into them on an injected router. The UPnP protocol itself is designed to let machines automatically request NAT/port forwarding capabilities from the Internet Gateway Device (IGD) operated by the router. Researchers recommend carefully inspecting these rules requires the use of UPnP tool sets, device scanning, and manual rule inspection to achieve some level of detection.
Akamai released the following bash script that administrators can allow to dump UPnP NAT entries.
Owners of devices compromised with Eternal Silence need to reset or flash the device. Experts explained that disabling UPnP might not clear existing NAT injections.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Eternal Silence)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/127435/hacking/eternal-silence-upnproxy-attacks.html