Malware Turns Home Routers Into Proxies For Chinese State-Sponsored Hackers (arstechnica.com) 28
An anonymous reader quotes a report from Ars Technica: Researchers on Tuesday unveiled a major discovery -- malicious firmware that can wrangle a wide range of residential and small office routers into a network that stealthily relays traffic to command-and-control servers maintained by Chinese state-sponsored hackers. A firmware implant, revealed in a write-up from Check Point Research, contains a full-featured backdoor that allows attackers to establish communications and file transfers with infected devices, remotely issue commands, and upload, download, and delete files. The implant came in the form of firmware images for TP-Link routers. The well-written C++ code, however, took pains to implement its functionality in a "firmware-agnostic" manner, meaning it would be trivial to modify it to run on other router models.
The main purpose of the malware appears to relay traffic between an infected target and the attackers' command and control servers in a way that obscures the origins and destinations of the communication. With further analysis, Check Point Research eventually discovered that the control infrastructure was operated by hackers tied to Mustang Panda, an advanced persistent threat actor that both the Avast and ESET security firms say works on behalf of the Chinese government.
The researchers discovered the implant while investigating a series of targeted attacks against European foreign affairs entities. The chief component is a backdoor with the internal name Horse Shell. The three main functions of Horse Shell are: a remote shell for executing commands on the infected device; file transfer for uploading and downloading files to and from the infected device; and the exchange of data between two devices using SOCKS5, a protocol for proxying TCP connections to an arbitrary IP address and providing a means for UDP packets to be forwarded. The SOCKS5 functionality seems to be the ultimate purpose of the implant. By creating a chain of infected devices that establish encrypted connections with only the closest two nodes (one in each direction), it's difficult for anyone who stumbles upon one of them to learn the origin or ultimate destination or the true purpose of the infection. As Check Point researchers wrote: "Learning from history, router implants are often installed on arbitrary devices with no particular interest, with the aim to create a chain of nodes between the main infections and real command and control," Check Point researchers wrote in a shorter write-up. "In other words, infecting a home router does not mean that the homeowner was specifically targeted, but rather that they are only a means to a goal."
The main purpose of the malware appears to relay traffic between an infected target and the attackers' command and control servers in a way that obscures the origins and destinations of the communication. With further analysis, Check Point Research eventually discovered that the control infrastructure was operated by hackers tied to Mustang Panda, an advanced persistent threat actor that both the Avast and ESET security firms say works on behalf of the Chinese government.
The researchers discovered the implant while investigating a series of targeted attacks against European foreign affairs entities. The chief component is a backdoor with the internal name Horse Shell. The three main functions of Horse Shell are: a remote shell for executing commands on the infected device; file transfer for uploading and downloading files to and from the infected device; and the exchange of data between two devices using SOCKS5, a protocol for proxying TCP connections to an arbitrary IP address and providing a means for UDP packets to be forwarded. The SOCKS5 functionality seems to be the ultimate purpose of the implant. By creating a chain of infected devices that establish encrypted connections with only the closest two nodes (one in each direction), it's difficult for anyone who stumbles upon one of them to learn the origin or ultimate destination or the true purpose of the infection. As Check Point researchers wrote: "Learning from history, router implants are often installed on arbitrary devices with no particular interest, with the aim to create a chain of nodes between the main infections and real command and control," Check Point researchers wrote in a shorter write-up. "In other words, infecting a home router does not mean that the homeowner was specifically targeted, but rather that they are only a means to a goal."
China (Score:2, Insightful)
Is anyone surprised that a Chinese router is compromised by Chinese hackers? Its almost as if the product was purpose built for it, then sold cheaply in places they want to hack. This is exactly why Huawei cannot play in the US. China is going to alienate itself from others this way.
Here's a thought (Score:3, Insightful)
Re: (Score:3)
They can't tell you what they don't know. TFA states the deployment method is so far unknown, which leaves the usual suspects (user stupidity, exploiting known vulnerabilities, etc.).
Re: Here's a thought (Score:2)
Remember when your best friend got the subseven backdoor on their machine? No one knows how itâ(TM)s just there now you have to deal with it.
Same here, kee your shit protected and youâ(TM)ll be fine. Otherwise keep an eye out for rogue traffic
Re: (Score:2)
"The implant came in the form of firmware images for TP-Link routers" in TFS told me all I needed to know, in that I am running openwrt on another brand of router so it has nothing at all to do with me.
The clever thing is to take the same or similar tack, and check for openwrt or similar compatibility before buying. Then roll your own custom images, stay up to date, and allow as little through as possible. You will have reasonable surety that you're not the one compromised pretty much no matter what the pro
Re: (Score:2)
Basically it's the same as the NSA network hardware implants. Requires physical access to install the firmware. They intercept the hardware during shipping or just sell it themselves through a fake retail company, and the customer has no idea what they bought isn't an unmolested Cisco/TP Link router.
It's difficult to remove because it is in the device's boot code, which is not changed by firmware updates. If you are concerned then the best option is to lift the flash memory chip from your router and program
Re: (Score:2)
Check connections to the domain m.cremessage[.]com
Check the admin panel UI for the modified "Upgrade Firmware"
Check for the presence of the files /vat/udhcp.cnf, /var/udhcp, and .remote_shell.log
Check the outgoing packets from the router to see if they match the yara signatures in the post
Be sure to follow proactive mitigations like patching the version of the router, and using strong passwords
Re: (Score:2)
Updating an existing DD-WRT image on a TP-Link router requires a different type of image than the initial TP-Link style image...
I enjoy taunting Chinese intelligence. (Score:5, Interesting)
Re: (Score:2)
You know, speaking as a systems engineer with 30 years experience and some software and protocol credits to my name:
That's pretty dumb giving out that much info on a server. Revise: it's willfully stupid.
I'm going to wager that your server is the only (or maybe one of ten) servers on the internet that regurgitate banned Chinese phrases in Kanji.
So unless your server is a honeypot... you're an idiot.
Re: (Score:2)
Yep, pretty much. Big ego does not for good skills make. An actually competent person would make that box give out as little as possible and probably also restrict IPs it even responds to at all.
Re: (Score:1)
Big ego does not for good skills make
Oh? Like NBA players, code gods like Carmack, MMA fighters, or pop-stars right? Oh wait... I guess you are full of shit. Big skills and big egos often end up in the same person. Of course, saying that you're full of shit because you cannot root-exploit a box with nothing but an IP stack and OpenSSH 7.9 isn't egotistical. It's just a simple fact. I mean if we are talking about you personally, I doubt you could perform a Konami-code on a console, much less put together an effective exploit for OpenSSH zero-da
Re: (Score:2)
You think there cannot be exploits in a network stack or in OpenSSH? Well, talk about extreme cluelessness. Well done!
But you just nicely illustrated how utterly incompetent big-ego assholes routinely are. Thanks!
Re: (Score:1)
You think there cannot be exploits in a network stack or in OpenSSH?
Yeah, I'm just absolutely quaking over here. After 15 years of watching people a lot smarter than you fail, I'd say that's built up some confidence.
Re: (Score:2)
Well, you are lucky nobody cares enough about you to actually invest the effort. Incidentally, I am not on the attacker side, no idea why you think I would be. Probably just more demonstration of a complete lack of insight.
Re: (Score:1)
Re: I enjoy taunting Chinese intelligence. (Score:2)
Oh... I didn't realize you were running without a kernel
Now I get it. @rolleyes@
So at least somebody can write good code (Score:2)
Another field where China is apparently beginning to leave large parts of the world behind.
Peopl are watching traffic (Score:1)
This is why (Score:2)
I can already see replies of "yeah, but it's running a Chinese designed and manufactured CPU!". True. But I'd be astounded if I found a CPU chip able to open back doors in my operating system on its own. There's