New DemonBot Discovered

By
Pascal Geenens
-
97
10045

Are you using Hadoop for data analytics? If so, know that a new bot is targeting Hadoop clusters with the intention of performing DDoS attacks powered by the strength of cloud infrastructure servers. Hadoop is an open source distributed processing framework that manages storage and data processing for big data applications running in clustered systems.

Radware Threat Research Center is monitoring and tracking a malicious agent that is leveraging a Hadoop YARN unauthenticated remote command execution in order to infect Hadoop clusters with an unsophisticated new bot that identifies itself as DemonBot.

DemonBot spreads only via central servers and does not expose worm-like behavior exhibited by Mirai based bots. As of today, Radware is tracking over 70 active exploit servers that are actively spreading DemonBot and are exploiting servers at an aggregated rate of over 1 Million exploits per day. Note that though we did not find any evidence that DemonBot is actively targeting IoT devices at this time, Demonbot is not limited to x86 Hadoop servers and is binary compatible with most known IoT devices, following the Mirai build principles.

It is not the first time that cloud infrastructure servers have been targeted. Earlier this month Security Researcher Ankit Anubhav discovered a hacker leveraging the same Hadoop Yarn bug in a Sora botnet variant. Hadoop clusters typically are very capable and stable platforms and can individually account for much larger volumes of DDoS traffic compared to IoT devices. The DDoS attack vectors supported by DemonBot are UDP and TCP floods.

Hadoop YARN Exploits

Radware Research has been tracking malicious actors exploiting a Hadoop YARN unauthenticated remote command execution for which proof of concept code was first published here in March of this year. YARN, Yet Another Resource Negotiator, is a prerequisite for Enterprise Hadoop and provides cluster resource management allowing multiple data processing engines to handle data stored in a single platform. YARN exposes a REST API which allows remote applications to submit new applications to the cluster. The exploit requires two steps:

Our deception network recorded repeated attempts for /ws/v1/cluster/apps/new-application, slowly starting end of September and growing to over 1 million attempts per day for most of October.

The number of unique IPs from where the requests originated grew from a few servers to over 70 servers this week.

Older exploits from servers that are offline by now were referencing a well-known Mirai variant Owari, infamous because of the weak password used by the hackers for securing their command and control database:

Recently, however, we found Owari to be replaced by a new bot:

This new ‘bash’ binary was added to the server on Sunday Oct 21st. The same server also hosts the typical shell script we came to expect from multiplatform IoT malwares:

While the botnet comes with all the typical indicators of Yet-Another-Mirai-Botnet, a closer look at the binaries revealed to be different enough to continue the investigation.

DemonBot v1 – © Self-Rep-NeTiS

The reversing of the unstripped ‘bash’ binary revealed some unfamiliar function names and an atypical string which provided a unique fingerprint for the botnet code:

Searching through pastebin archives soon revealed a unique match on a document that was pasted on Sept 29th by an actor going by the alias of Self-Rep-NeTiS. The paste contained the full source code for a botnet which the actor dubbed ‘DemonBot’. Further searches through the archives revealed the source code for the Command and Control server DemonCNC and the Python Build script for the multi-platform bots.

Both DemonBot.c and DemonCNC.c had an identical signature:

DemonCNC

The DemonBot Command and Control service is a self-contained C program that is supposed to run on a central command and control server and it provides two services:

  • A bot command and control listener service – allowing bots to register and listen for new commands form the C2
  • A remote access CLI allowing botnet admins and potential ‘customers’ to control the activity of the botnet

Starting the C2 service requires 3 arguments: a bot listener port, the number of threads and a port for the remote access CLI.

Credentials for remote users are stored in a plain text file ‘login.txt’ in the format “username password” using one line per credential pair.

Upon connecting to the remote access CLI (port 8025 in our demo setup) using telnet, the botnet greets us and asks for a username followed by a password prompt. If the provided credentials match one of the lines in the login.txt file, the user is given access to the bot control interface.

The HELP command reveals the botnet commands which will be discussed below in the section about DemonBot itself.

DemonBot

DemonBot is the program that is supposed to be running on infected servers and will connect into the command and control server and listens for new commands.

When a new DemonBot is started, it connects to the C2 server which is hardcoded with IP and port. If no port was specified for the C2 server the default port 6982 is used. The C2 connection is plain text TCP.

Once successfully connected, DemonBot sends information about the infected device to the C2 server in the format:

Bot_ip

The public IP address of the device or server infected with DemonBot:

Port

Either 22 or 23 depending on the availability of python or perl and telnetd on the device/server:

Build

“Python Device”, “Perl Device”, “Telnet Device” or “Unknown” depending on the availability of a Python or Perl interpreter on the device server:

Arch

The architecture, determined at build time and depending on the executing binary on the compromised platform – supported values for Arch are: x86_64 | x86_32 | Arm4 | Arm5 | Arm6 | Arm7 | Mips | Mipsel | Sh4 (SuperH) | Ppc (PowerPC) | spc (Sparc) | M68k | Arc

OS

Limited identification of the host OS running the bot based on package installer configuration files. Value is either “Debian Based Device”, “REHL Based Device” or “Unknown OS”

Malicious payloads

The bot supports the following commands:

If multiple IPs are passed in the argument in a comma-separated list, an individual attack process is forked for each IP.

The <spoofit> argument works as a netmask. If spoofit is set to 32, there is no spoofing of the bot’s source IP. If spoofit is set to a number less than 32, a random IP is generated within the bot_ip/<spoofit> network every <pollinterval> packets:

Fixed payload used by the STD UDP attack:

IOC

8805830c7d28707123f96cf458c1aa41  wget
1bd637c0444328563c995d6497e2d5be  tftp
a89f377fcb66b88166987ae1ab82ca61  sshd
8b0b5a6ee30def363712e32b0878a7cb  sh
86741291adc03a7d6ff3413617db73f5  pftp
3e6d58bd8f10a6320185743d6d010c4f  openssh
fc4a4608009cc24a757824ff56fd8b91  ntpd
d80d081c40be94937a164c791b660b1f  ftp
b878de32a9142c19f1fface9a8d588fb  cron
46a255e78d6bd3e97456b98aa4ea0228  bash
53f6451a939f9f744ab689168cc1e21a  apache2
41edaeb0b52c5c7c835c4196d5fd7123  [cpu]

 

Read the “IoT Attack Handbook – A Field Guide to Understanding IoT Attacks from the Mirai Botnet and its Modern Variants” to learn more.

Download Now

Previous articleThe Delta Airlines Security Breach: A Case Study in How to Respond to a Data Breach
Next articleThe Million-Dollar Question of Cyber-Risk: Invest Now or Pay Later?
Pascal Geenens
Recognized Cyber Security and Emerging Technology thought leader with 20+ years of experience in Information Technology As the EMEA Cyber Security Evangelist for Radware, Pascal helps execute the company's thought leadership on today’s security threat landscape. Pascal brings over two decades of experience in many aspects of Information Technology and holds a degree in Civil Engineering from the Free University of Brussels. As part of the Radware Security Research team Pascal develops and maintains the IoT honeypots and actively researches IoT malware. Pascal discovered and reported on BrickerBot, did extensive research on Hajime and follows closely new developments of threats in the IoT space and the applications of AI in cyber security and hacking. Prior to Radware, Pascal was a consulting engineer for Juniper working with the largest EMEA cloud and service providers on their SDN/NFV and data center automation strategies. As an independent consultant, Pascal got skilled in several programming languages and designed industrial sensor networks, automated and developed PLC systems, and lead security infrastructure and software auditing projects. At the start of his career, he was a support engineer for IBM's Parallel System Support Program on AIX and a regular teacher and presenter at global IBM conferences on the topics of AIX kernel development and Perl scripting.

RELATED ARTICLESMORE FROM AUTHOR

97 COMMENTS

  3. […] D’abord repéré à ses balbutiements dans les données d’un honeypot par un chercheur de NewSky Security, le botnet a mûri et s’est développé entre-temps. Alors qu’au départ, le botnet se composait de quelques serveurs de commande et de contrôle Radware explique maintenant que le botnet s’est développé à plus de 70 serveurs dans une alerte publiée aujourd’hui. […]

  29. […] Hadoop YARN漏洞的利用相对简单，这个命令注入漏洞允许攻击者执行任意shell命令。上个月，另一家网络安全公司Radware就曾发现，这个漏洞被用于安装DemonBot DDoS僵尸病毒。在很多方面，这个漏洞与Netcout 在物联网设备中发现的其他漏洞类似。例如，CVE-2014-8361（存在于Realtek的UPnP SOAP接口中的一个漏洞）也可以通过向具有特定参数的特殊端口发送HTTP请求来诱导shell命令的执行来利用，而该漏洞也曾被用于提供Mirai变种。 […]

  33. May I simply just say what a relief to discover someone that actually knows what they are talking about online. You actually know how to bring an issue to light and make it important. A lot more people ought to look at this and understand this side of the story. It’s surprising you aren’t more popular given that you definitely possess the gift. Learn to hack with https://hackingblogs.com/

  34. Optional, aber empfehlenswert, ist die Verwendung eines schwammartigen Dauerfilters, der Katzenhaare, Staub, Futterreste oder Katzenstreukrümel aufnimmt. Dadurch https://zukunft-hannover.de/ muss der Brunnen nicht so oft gereinigt werden. Meist kann man diese separat bestellen oder den Katzenbrunnen gleich zusammen mit einem solchen Filter kaufen.

  36. Hmm it appears like your website ate my first comment (it was extremely long) so I guess I’ll just sum it up what I submitted and say, I’m thoroughly
    enjoying your blog. I as well am an aspiring blog writer but I’m still new to everything.
    Do you have any tips and hints for first-time blog writers?

    I’d really appreciate it.

  38. Farklı boyutlarda hazırlanmış olan kraft poşet modelleriyle firmanızın logosunu ya da adres bilgilerini şık bir poşet şekilde sunabilirsiniz. Müşterilerinize naylon poşet sunmak yerine kağıt çanta kullandığınızda ise kurumsal yapınızı çok daha fazla ön plana çıkarır ve daha çok müşteri kitlesine ulaşabilirsiniz.

  40. Özel tasarıma sahip olan kağıt poşetler modelleriyle firmanızı çok daha üst seviyeye çıkararak hizmet kalitenizi yükseltebilirsiniz. Firmamız Türkiye’nin her yerine en uygun fiyat garantisiyle hizmet verirken tasarım desteğimiz ve hızlı teslimatımızla kaliteli kağıt çantalar sunuyoruz.

  42. I really appreciated this post. Pada kesempatan kali ini saya ingin merekomendasikan situs yang bernama SundulPoker dimana situs ini merupakan situs IDN Poker terbaik dan terpercaya tahun 2019 dengan beragam fasilitas dan bonus yang mudah didapatkan para pemainnya.

  45. I really appreciated this post. Pada kesempatan kali ini saya ingin merekomendasikan situs yang bernama Audy88 dimana situs ini merupakan situs Judi Bola Terpercaya dan terpercaya tahun 2019 dengan beragam fasilitas dan bonus yang mudah didapatkan para pemainnya.

  47. Excellent items from you, man. I’ve consider your stuff
    prior to and you’re just extremely fantastic.
    I actually like what you have acquired here, certainly like what
    you’re saying and the way during which you say it.
    You’re making it entertaining and you still take care of to stay it wise.
    I can’t wait to learn far more from you. That is really a wonderful site.

  55. Thinking it is only an abnormality you are trying to turn the PS3 back on, but just as the green light comes on, the truth
    is a fast flash of an yellow light and then it starts blinking red.
    There is now something about the Wii for each sort of gamer, from your casual gamer (Super Smash Bro.
    Also that it is not all-around any hot device, for example a DVD player, TV set, etc.

  58. But when you learn to play the lotto and begin winning the lottery, you
    should first identify exactly what the common mistakes manufactured
    by most players are, to be able to avoid them in any way costs.
    Most effective for free reward casino’ is generally a reputable present
    and plenty of trustworthy Online casinos present some type of reward without strings connected.
    Mostly, women wear lingerie to impress their partners to make the atmosphere spicy, further their confidence level also rises to another extent.

  59. Wonderful beat ! I would like to apprentice while you amend your website,
    how could i subscribe for a blog site? The account aided me a acceptable deal.
    I had been tiny bit acquainted of this your broadcast provided bright clear idea

  73. Aftеr gawa ssa ϲomputer diretso saa classroom kuha
    ngg bag tapos diretso ѕɑ ｃar tapos uwi tapos sa sobra ka gutomm nag
    tɑke out sɑ mcdo tapos sa caｒ na nagkain tapos pag uwi
    rest ⅼang kadali tapos trabaho ulit

  75. May I simply say what a relief to uncover a person that really understands what they’re talking about on the web.
    You actually understand how to bring a problem to light and make it
    important. A lot more people should check this out and understand this
    side of the story. I was surprised you aren’t more popular because you most certainly have the gift.

  77. I got this website from my friend who shared with mee concerning thyis web site and at the moment this time I am browsing tbis web site and reading very informative articles or reviews
    at this place.

  78. แจกเครดิตฟรี เต็มๆตรงนี้เว็บของพวกเราเพียงแค่นั้น
    สำหรับท่านที่พอใจการหารายได้ออนไลน์ในแบบที่ท่านอยากได้
    ในแบบเกมส์ออนไลน์ คาสิโน ซึ่งจะช่วยให้คุณสนุกสนานกับการหาเงินออนไลน์บนโทรศัพท์มือถือ แล้วก็หารายได้ออนไลน์ ได้จริงเพียงแต่จากเว็บไซต์ของเราแค่นั้น
    สำหรับคนที่อยากหาเงินออนไลน์ ขอแนะนำเว็บที่ให้บริการการแทงบอล คาสิโน บอล ที่พร้อมให้ท่านได้สนุกแน่ๆ อีกทั้งการพนันบอลที่ได้โอกาสแทงฝั่งชนะ ได้มากกว่าการแทงหวยซะอีก การเล่นเกมส์รูเล็ตหมุนวงล้อให้ได้แจ็คพ๊อต
    โบนัส ที่จะทำให้คุณได้เงินมากกว่าเดิม รวมทั้งบันเทิงใจไปกับมัน รวมถึงการเล่นบาค้างราที่ยังคงมีความน่าดึงดูดใจนิรันดร สำหรับเพื่อการเสี่ยงดวง

  79. Right here is the perfect website for anyone who
    would like to find out about this topic. You know so much its almost
    hard to argue with you (not that I really will need to…HaHa).

    You certainly put a fresh spin on a topic that
    has been written about for years. Wonderful
    stuff, just wonderful!

  83. El mosaico normativo propuesto se completa con la Ley Orgánica 5/1985 de 19 de Junio, del Régimen Electoral General de la que hay que destacar el último párrafo del Art.
    327 califica a las funciones de las Juntas Directivas, y concretamente
    a la que nos ocupa, como “obligaciones” especiales (“especialmente”).

    327-2ª, a la práctica documental, facultad esta que,
    en principio, es de las respectivas Juntas Directivas, en el ámbito territorial
    de su competencia, y con carácter general, para todo el territorio del Estado,
    del Consejo. Te ofrecemos Programa Ashtanga Yoga Mysore tradicional con Diagnóstico corporal gratuito para avanzar en tu práctica.
    Este diagnóstico te ofrece claridad de los bloqueos que estas transitando y que
    se ven reflejados en tu cuerpo físico. Dadas las limitadas pretensiones de este trabajito
    no se va a hablar aquí de otros servicios
    jurídicos como el de asistencia al detenido y los forenses de guardia.
    Además con nuestro buscador buscador de servicios podrás encontrar
    bares, restaurantes, tiendas, farmacias o gasolineras entre otros servicios
    cerca de Calle del Notario y Académico Enric Taulet. NOTARIO.
    NOTARÍA. NOTARIO EN VALENCIA. NOTARIOS VALENCIA. SERVICIOS NOTARIALES.
    En su intervención, Francisco Cantos ha felicitado a los nuevos notarios por su gran esfuerzo y también a sus
    familiares y amigos por el apoyo decisivo que han realizado
    a lo largo de la oposición. http://notariaescriva.com

  84. Right here iss thhe perfect webpage for anyone who would like to fiind out about thi topic.
    Yoou understand so much its almost tough to argue with you
    (notthat I really would want to?HaHa). You definitelyy put a brand new spin on a
    subject that has been discussed for years. Wonderful
    stuff, just great!

  90. I intended to post you this bit of remark to be able to say thanks a lot once
    again with your precious advice you have
    documented in this case. This is simply remarkably generous of people like you to deliver
    without restraint precisely what many of us could have sold as an ebook in making some cash
    for themselves, most importantly now that you could have done it in case you wanted.
    Those techniques as well acted as the fantastic way to fully grasp someone else have the identical eagerness similar to my
    very own to see somewhat more in terms of this condition. I know
    there are thousands of more enjoyable occasions ahead for folks who
    read through your site.

  91. Once you have their email list of all the companies
    in the area that offer video production services, you should start
    checking what they’ve got to offer. With these show tunes,
    the lyrics in the songs are general yet they still fit into the general narrative
    of the production. His landscape photographs in white and black cover every base possible with regards to greys, blacks, and whites, and they are quite powerful because of it.

LEAVE A REPLY

Please enter your comment!
Please enter your name here