FICORA and Kaiten Botnets Exploit Old D
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-2051 | Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router The D-Link DIR-645 wired/wireless router is vulnerable to OS command injection (CWE-77) in its HNAP interface: input supplied to the GetDeviceSettings action is not properly neutralized, so a remote attacker who sends a crafted HTTP request to the router's HNAP endpoint can have arbitrary operating-system commands executed on the device. Successful exploitation gives the attacker control of the router at the system level, enabling reconfiguration or abuse of the device, traffic interception or redirection, and recruitment into IoT botnets, as reflected in recent Moobot/MooBot botnet campaigns. Any site or household still running a DIR-645, especially one whose web/HNAP management interface is reachable from the internet, is affected; the product is end-of-life. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-02-10, and EPSS assigns a 97.1% probability of exploitation within 30 days (100th percentile). CISA's required action reflects the risk: disconnect the impacted product if it is still in use because it has reached end-of-life. Do: Because the DIR-645 is end-of-life, CISA's required action is to disconnect it; replace the device where possible, or at minimum apply the latest available D-Link firmware for the DIR-645 and ensure the management/HNAP interface is not reachable from the internet (block or restrict remote administration on the WAN side). Check the device for signs of botnet infection, such as unexpected outbound traffic or unexpected HNAP POST/SOAP requests, and prioritize this fix given the 97.1% EPSS score and known in-the-wild exploitation. | — | 97% | KEV |
| largetens of thousands of internet-exposed devices (est.; far more DIR-645 units exist behind NAT given the product's broad consumer/SOHO distribution) | |
| CVE-2019-10891 | An issue was discovered in D-Link DIR-806 devices. An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls system() without checking the parameter that can be controlled by user, and finally allows remote attackers to execute arbitrary shell commands with a special HTTP header. NVD description · AI analysis pending | 9.8 | 19% | PoC |
| — | |
| CVE-2022-37056 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main, D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main, NVD description · AI analysis pending | 9.8 | 10% | PoC |
| — | |
| CVE-2024-33112 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func. D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func. NVD description · AI analysis pending | 7.5 | 6% | PoC |
| — |
Full article634 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 27, 2024Botnet / DDoS Attack
Cybersecurity researchers are warning about a spike in malicious activity that involves roping vulnerable D-Link routers into two different botnets, a Mirai variant dubbed FICORA and a Kaiten (aka Tsunami) variant called CAPSAICIN.
"These botnets are frequently spread through documented D-Link vulnerabilities that allow remote attackers to execute malicious commands via a GetDeviceSettings action on the HNAP (Home Network Administration Protocol) interface," Fortinet FortiGuard Labs researcher Vincent Li said in a Thursday analysis.
"This HNAP weakness was first exposed almost a decade ago, with numerous devices affected by a variety of CVE numbers, including CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112."
According to the cybersecurity company's telemetry data, attacks involving FICORA have targeted various countries globally, whereas those related to CAPSAICIN primarily singled out East Asian territories like Japan and Taiwan. The CAPSAICIN activity is also said to have been "intensely" active only between October 21 and 22, 2024.
FICORA botnet attacks lead to the deployment of a downloader shell script ("multi") from a remote server ("103.149.87[.]69"), which then proceeds to download the main payload for different Linux architectures separately using wget, ftpget, curl, and tftp commands.
Present within the botnet malware is a brute-force attack function containing a hard-coded list of usernames and passwords. The Mirai derivative also packs in features to conduct distributed denial-of-service (DDoS) attacks using UDP, TCP, and DNS protocols.
The downloader script ("bins.sh") for CAPSAICIN leverages a different IP address ("87.10.220[.]221"), and follows the same approach to fetch the botnet for various Linux architectures to ensure maximum compatibility.
"The malware kills known botnet processes to ensure it is the only botnet executing on the victim host," Li said. "'CAPSAICIN' establishes a connection socket with its C2 server, '192.110.247[.]46,' and sends the victim host's OS information and the nickname given by the malware back to the C2 server."
CAPSAICIN then awaits for further commands to be executed on the compromised devices, including "PRIVMSG," a command that could be used to perform various malicious operations such as follows -
- GETIP - Get the IP address from an interface
- CLEARHISTORY - Remove command history
- FASTFLUX - Start a proxy to a port on another IP to an interface
- RNDNICK - Randomize the victim hosts' nickname
- NICK - Change the nickname of the victim host
- SERVER - Change command-and-control server
- ENABLE - Enable the bot
- KILL - Kill the session
- GET - Download a file
- VERSION - Requests version of the victim host
- IRC - Forward a message to the server
- SH - Execute shell commands
- ISH - Interact with victim host's shell
- SHD - Execute shell command and ignore signals
- INSTALL - Download and install a binary to "/var/bin"
- BASH - Execute commands using bash
- BINUPDATE - Update a binary to "/var/bin" via get
- LOCKUP - Kill Telnet backdoor and execute the malware instead
- HELP - Display help information about the malware
- STD - Flooding attack with random hard-coded strings for the port number and target specified by the attacker
- UNKNOWN - UDP flooding attack with random characters for the port number and target specified by the attacker
- HTTP - HTTP flooding attack.
- HOLD - TCP connection flooding attack.
- JUNK - TCP flooding attack.
- BLACKNURSE - BlackNurse attack, which is based on the ICMP packet flooding attack
- DNS - DNS amplification flooding attack
- KILLALL - Stop all DDoS attacks
- KILLMYEYEPEEUSINGHOIC - Terminate the original malware
"Although the weaknesses exploited in this attack had been exposed and patched nearly a decade ago, these attacks have remained continuously active worldwide," Li said. "It is crucial for every enterprise to regularly update the kernel of their devices and maintain comprehensive monitoring."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/12/ficora-and-kaiten-botnets-exploit-old-d.html