{"id":13568,"date":"2018-10-12T08:10:11","date_gmt":"2018-10-12T16:10:11","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/10\/12\/news-7335\/"},"modified":"2018-10-12T08:10:11","modified_gmt":"2018-10-12T16:10:11","slug":"news-7335","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2018\/10\/12\/news-7335\/","title":{"rendered":"Fake browser update seeks to compromise more MikroTik routers"},"content":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Fri, 12 Oct 2018 15:00:06 +0000<\/strong><\/p>\n

This blog post was authored by\u00a0@hasherezade<\/a>\u00a0and\u00a0J\u00e9r\u00f4me Segura<\/a>.<\/em><\/p>\n

MikroTik, a Latvian company that makes routers and ISP wireless systems, has been dealing with several vulnerabilities affecting its products’ operating system over the past few months. Ever since a critical flaw in\u00a0RouterOS was\u00a0identified<\/a>\u00a0in late April 2018, attacks have been going on at an alarming rate, made worse when a\u00a0newly-found exploitation technique for\u00a0CVE-2018-14847<\/a>\u00a0was identified.<\/p>\n

Part of the problem is that a large number of MikroTik routers remain unpatched and are prey for automated attacks, despite security fixes made available by the vendor. Criminals were quick to leverage Proof of Concept code to compromise hundreds of thousands of devices in a short time frame. Last summer, researchers at SpiderLabs discovered<\/a>\u00a0what was\u00a0perhaps the biggest malicious Coinhive campaign via hacked MikroTik devices, which has evolved into a much wider problem now.<\/p>\n

With this latest trick, users behind compromised routers are served a fake browser update page.\u00a0When they run this malicious update, it unpacks code onto their computer that scans the Internet for other vulnerable routers and tries to exploit them.<\/p>\n

Suspicious browser update<\/h3>\n

Security researcher @VriesHd<\/a>\u00a0first spotted a new campaign<\/a> attempting to further compromise vulnerable routers using a typical social engineering technique. Internet providers that operate infected MikroTik routers will serve this malicious redirect about an “old version of the browser” to their end users:<\/p>\n

\"\"<\/a><\/p>\n

According to a search via Censys<\/a>, there are about 11,000 compromised MikroTik devices hosting this fake download page:<\/p>\n

\"\"<\/a><\/p>\n

The alleged browser update is suspiciously downloaded from an FTP server, as seen below:<\/p>\n

\"\"<\/a><\/p>\n

Interestingly, this IP address is also listed as a free and open web proxy. Proxies are often used by those who wish to bypass certain country limitations (i.e. watching the American version of Netflix if you are not in the US) or simply as a way to mask their IP address.<\/p>\n

\"\"<\/a><\/p>\n

Payload analysis<\/h3>\n

Behavioral analysis<\/strong><\/p>\n

The payload follows the theme of pretending to be an installer named upd_browser<\/em>.<\/p>\n

\"\"<\/p>\n

When we deploy it, it pops up an error:<\/p>\n

\"\"<\/a><\/p>\n

However, if we capture the network traffic, we can see that in the background it scans various IP addresses, trying to connect on port 8291 (a default port for managing MicroTik routers via Winbox application<\/a>):<\/p>\n

\"\"<\/a><\/p>\n

Unpacking<\/strong><\/p>\n

The dropped payload is a relatively big executable (7.25 MB) with a huge overlay. The sections’ headers and their visualizations are given below:<\/p>\n

\"\"<\/a><\/p>\n

As we can recognize by looking at the sections names, it comes packed by a popular, simple packer: UPX<\/a>. The size of overlay suggests that there is something more to be extracted. After further examination, we find out that it unpacks a Python DLL and other related files into the %TEMP% folder, and then loads them. At this point, it is easy to guess that this EXE is in reality a wrapped Python script. We can unpack it following the same procedure as the one described here<\/a>.<\/p>\n

\"\"<\/a><\/p>\n

The Entry Point is in the script named upd_browser<\/em>. After decompiling and following the scripts, we find out that the malware’s core consists of two Python scripts: upd_browser.py<\/a> and ups.py<\/a>.<\/p>\n

Inside the scripts<\/strong><\/p>\n

The main function of the module<\/a> is pretty simple:<\/p>\n

\"\"<\/a><\/p>\n

As we can see, the error pop-up is hardcoded<\/a>: It does not alert about any actual error, but is used as a decoy.<\/p>\n

After that, the malware logs the IP address of the victim by querying a hardcoded address of a tracker made using a legitimate service, IP Logger. The tracker takes the form of a one pixel\u2013sized image:<\/p>\n

\"\"<\/a><\/p>\n

Later, this address is queried repeatedly in a defined time interval.<\/p>\n

The most important actions are performed in the function named “scan<\/a>” that is deployed in several parallel threads (the maximum number of threads is defined as thmax =<\/span> 600). The function “scan<\/a>” generates pseudo-random IP addresses and tries to connect to each of them on the aforementioned port 8291. When the attempt of connecting is successful, it tries another connection, this time on a random port from a range of 56778 to 56887. When this one fails, it proceeds with the exploitation:
<\/span><\/p>\n

\"\"<\/a><\/p>\n

The function “poc<\/a>” is meant to infect the router using known vulnerabilities. It starts by attempting to retrieve credentials leveraging the path traversal vulnerability (CVE-2018-14847):<\/p>\n

\"\"<\/a><\/p>\n

The user.dat file is expected to be in M2 format, so the script comes with a built-in parser (function load_file<\/a>):<\/p>\n

\"\"<\/a><\/p>\n

If retrieving the password from user.dat file is successful, it decodes the credentials and uses them to create a backdoor: an account with a randomly-generated password. It also sets a scheduled task to be executed by the router.<\/p>\n

The script that is set in the scheduler is generated from a hardcoded template<\/a> (cleaned version available here<\/a>). Its role is to manipulate the router’s settings and set up an error page loading a CoinHive<\/a> miner.<\/p>\n

The error page can be dropped in two locations: “webproxy\/error.html<\/a>” or “flash\/webproxy\/error.html<\/a>” .<\/p>\n

\"\"<\/a><\/p>\n

Such a page is displayed to users whenever they try to view a URL to which the access is denied. But the malicious script configured in the router in such a way that basically any HTTP request leads to the error. Yet, the error page is crafted to spoof the original traffic, displaying the requested page as an iframe. So, users may browse most of the web as usual, without noticing the change. Example:<\/p>\n

\"\"<\/a><\/p>\n

The CoinHive miner is embedded, so during the time this time their machines are used for mining purposes.<\/p>\n

Mitigations<\/h3>\n

MikroTik users are urged to patch their routers as soon as possible and should assume that their authentication credentials have been compromised if they are running an outdated version. MikroTik’s download page<\/a> explains how to perform an upgrade to RouterOS.<\/p>\n

Awareness that these vulnerabilities exist and are easy to exploit is important considering that patching a router is not something many people are used to doing. However, in many cases users will not be able to do so unless their Internet Service Provider does it for them upstream.<\/p>\n

With this latest social engineering scheme, we saw how criminals are trying to infect regular users and leverage their computer to scan the Internet for vulnerable routers. This technique is clever because such an effort requires time and resources to be efficient.<\/p>\n

Malwarebytes business customers and Premium consumer users are protected from this threat, as our anti-malware engine detects and blocks this fake browser update in real time:<\/p>\n

\"\"<\/a><\/p>\n

Malwarebytes Endpoint Protection blocks the malicious executable disguised as a browser update.<\/p>\n<\/div>\n

Indicators of compromise<\/h3>\n

Sample hash<\/p>\n

57EB8C673FC6A351B8C15310E507233860876BA813ED6AC633E9AF329A0BBAA0<\/pre>\n
Coinhive site keys<\/p>\n
oiKAGEslcNfjfgxTMrxKGMJvh436ypIM  5zHUikiwJT4MLzQ9PLbU11gEz8TLCcYx  5ROof564mEBQsYzCqee0M2LplLBEApCv  qKoXV8jXlcUaIt0LGcMJIHw7yLJEyyVO  ZsyeL0FvutbhhdLTVEYe3WOnyd3BU1fK  ByMzv397Mzjcm4Tvr3dOzD6toK0LOqgf  joy1MQSiGgGHos78FarfEGIuM5Ig7l8h  ryZ1Dl4QYuDlQBMchMFviBXPL1E1bbGs  jh0GD0ZETDOfypDbwjTNWXWIuvUlwtsF  BcdFFhSoV7WkHiz9nLmIbHgil0BHI0Ma<\/pre>\n
The post Fake browser update seeks to compromise more MikroTik routers<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: Malwarebytes Labs| Date: Fri, 12 Oct 2018 15:00:06 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Threat actors are social engineering users with a fake update that, once installed, will scan the Internet in an attempt to exploit vulnerable MikroTik routers.<\/p>\n
Categories: <\/p>\n