New P2PInfect Botnet MIPS Variant Targeting Routers and IoT Devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-0543 | Lua Sandbox Escape in Debian-packaged Redis Enables Unauthenticated RCE CVE-2022-0543 is a Debian-specific Lua sandbox escape in the Redis key-value database, caused by a packaging issue in how the Debian-distributed redis-server build ships its embedded Lua interpreter (tracked as CWE-862). A remote, unauthenticated attacker can send a crafted Lua script through Redis' scripting interface (EVAL) to escape the Lua sandbox that normally limits scripts to safe operations. Successful exploitation yields remote code execution on the server in the context of the Redis process, giving the attacker control over stored data and the ability to run arbitrary system commands. Only Redis servers installed from Debian's (and derivative distributions') packages are affected; upstream Redis builds are not impacted. The flaw is actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-28, EPSS puts the 30-day exploitation probability at 99.4% (100th percentile), and botnet/worm activity against exposed Redis servers has been widely reported. Do: Apply the updated redis-server packages published through Debian security updates (and equivalent updates in derivative distributions) per vendor instructions, restarting the Redis service after patching. As interim mitigation, restrict Redis exposure by binding to trusted interfaces only, enabling authentication, and firewalling port 6379 from untrusted networks. Check affected hosts for signs of compromise, such as unexpected Lua EVAL activity, unfamiliar child processes, or connections consistent with botnet/worm traffic. | 10.0 | 99% | KEV PoC |
| masson the order of 100,000+ internet-exposed Redis servers, with Debian/Ubuntu-packaged installs a significant and plausibly large subset |
Full article403 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 04, 2023Malware / Botnet
Cybersecurity researchers have discovered a new variant of an emerging botnet called P2PInfect that's capable of targeting routers and IoT devices.
The latest version, per Cado Security Labs, is compiled for Microprocessor without Interlocked Pipelined Stages (MIPS) architecture, broadening its capabilities and reach.
"It's highly likely that by targeting MIPS, the P2PInfect developers intend to infect routers and IoT devices with the malware," security researcher Matt Muir said in a report shared with The Hacker News.
P2PInfect, a Rust-based malware, was first disclosed back in July 2023, targeting unpatched Redis instances by exploiting a critical Lua sandbox escape vulnerability (CVE-2022-0543, CVSS score: 10.0) for initial access.
A subsequent analysis from the cloud security firm in September revealed a surge in P2PInfect activity, coinciding with the release of iterative variants of the malware.
The new artifacts, besides attempting to conduct SSH brute-force attacks on devices embedded with 32-bit MIPS processors, pack in updated evasion and anti-analysis techniques to fly under the radar.
The brute-force attempts against SSH servers identified during the scanning phase are carried out using common username and password pairs present within the ELF binary itself.
It's suspected that both SSH and Redis servers are propagation vectors for the MIPS variant owing to the fact that it's possible to run a Redis server on MIPS using an OpenWrt package known as redis-server.
One of the notable evasion methods used is a check to determine if it's being analyzed and, if so, terminate itself, as well as an attempt to disable Linux core dumps, which are files automatically generated by the kernel after a process crashes unexpectedly.
The MIPS variant also includes an embedded 64-bit Windows DLL module for Redis that allows for the execution of shell commands on a compromised system.
"Not only is this an interesting development in that it demonstrates a widening of scope for the developers behind P2PInfect (more supported processor architectures equals more nodes in the botnet itself), but the MIPS32 sample includes some notable defense evasion techniques," Cado said.
"This, combined with the malware's utilization of Rust (aiding cross-platform development) and rapid growth of the botnet itself, reinforces previous suggestions that this campaign is being conducted by a sophisticated threat actor."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/12/new-p2pinfect-botnet-mips-variant.html