Hacker exploits router zero-day vulnerability in efforts to build Mirai

Just like the original Mirai attacks, this version traces back to the notorious HackForums.

Hackers are attacking hundreds of thousands of Huawei routers with variants of Mirai malware in a bid to build a massive botnet like arsenal used in global cyberattacks in 2016, according to the Israeli cybersecurity firm Check Point.

A zero-day vulnerability in the Huawei home router HG532 is being exploited to deliver a payload called Satori (or Okiru) by an amateur identified as “Nexus Zeta,” Check Point says.

Mirai malware was first discovered in August 2016. By October of that year, it was behind the vast denial-of-service attacks against the Domain Name System provider Dyn. The offensive brought down a wide array of services, including Twitter, Reddit, CNN, Fox News, Visa and Slack. Earlier this month, three men pleaded guilty to their roles in creating, operating and selling access to the botnet.

Beginning in November 2017, Check Point detected global attacks against Huawei HG532 devices. One day later, the Chinese security firm Qihoo 360 Netlab spotted 100,000 IP addresses in Argentina tied to attacks from the new Mirai variant. Huawei, a Chinese hardware giant, confirmed the zero-day exploitation in a blog post released in late December.

Satori’s payload is simple in that it floods targets with manually crafted UDP or TCP packets, researchers explained.

“An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code,” Huawei’s security team wrote.

Check Point’s investigation into the perpetrator behind the attacks led to an amateur nicknamed “Nexus Zeta” operating on HackForums.net, a technical forum popular with generally low-skill, young males new to the hacking world. The website has a long history with cybercrime and in September 2016 it was the place where Mirai source code was publicly posted.

Courtesy of Check Point’s investigation, here’s Nexus Zeta’s post on that forum just before the attacks began:

“Indeed, he had recently been active in hacker forums seeking advice on how to build such an attack tool indicating that a combination of leaked malware code together with exploitable and poor IoT security, when used by unskilled hackers, can lead to dangerous results,” Check Point researchers wrote.

Huawei released updated intrusion prevention signatures on Dec. 1 to block exploitation. Further defense against these attacks is simple: Change the device’s default password and configure the built-in firewall.

Experts urge changing default credentials as a regular practice. Default usernames and passwords are almost always easily available on the public internet.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure