Original Issue Date:- December 12, 2022
Virus Type:- Malware botnet Severity:- High
It has been observed that a newly surfaced malware botnet named ‘Zerobot’ written in Google’s open-source programming language Golang, is targeting vulnerabilities in the variety of devices including application delivery services, firewalls, routers and DVR/cameras etc. Zerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device, downloads script named "zero," which could allow itself to self-propagate. The malware is at modification phase and has been recently updated with string obfuscation, copy file module and propagation exploit module that make it harder to detect and gives it a higher capability to infect more devices. It may allow remote attackers to gain access of vulnerable systems and its Anti-Kill module prevents victims from disrupting the Zerobot program.
Infection Mechanism: The new Golang-based malware botnet is designed to target a wide range of CPU architectures such as i386, amd64, arm, arm64, mips, mips64, mips64le, mipsle, ppc64, ppc64le, riscv64, and s390x. Zerobot targets several vulnerabilities to gain access to a device and then downloads a script for further propagation. Zerobot gets its name from a propagation script that's used to retrieve the malicious payload after gaining access to a host depending on its microarchitecture implementation (e.g., "zero.arm64").
Zerobot, upon initialization in the compromised machine, establishes contact with a remote command-and-control (C2) server and awaits further instructions that allow it to run arbitrary commands and launch DDoS attacks for different network protocols like TCP, UDP, TLS, HTTP, and ICMP. Zerobot includes 21 exploits. In addition to some IoT vulnerabilities, it includes Spring4Shell, phpAdmin, F5 Big, etc., to increase its success rate. The malware also uses an "anti-kill" module designed to prevent terminating or killing its process.
Zerobot uses the following exploits to breach its targets:
- CVE-2014-08361: miniigd SOAP service in Realtek SDK
- CVE-2017-17106: Zivif PR115-204-P-RS webcams
- CVE-2017-17215: Huawei HG523 router
- CVE-2018-12613: phpMyAdmin
- CVE-2020-10987: Tenda AC15 AC1900 router
- CVE-2020-25506: D-Link DNS-320 NAS
- CVE-2021-35395: Realtek Jungle SDK
- CVE-2021-36260: Hikvision product
- CVE-2021-46422: Telesquare SDT-CW3B1 router
- CVE-2022-01388: F5 BIG-IP
- CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)
- CVE-2022-25075: TOTOLink A3000RU router
- CVE-2022-26186: TOTOLink N600R router
- CVE-2022-26210: TOTOLink A830R router
- CVE-2022-30525: Zyxel USG Flex 100(W) firewall
- CVE-2022-34538: MEGApix IP cameras
- CVE-2022-37061: FLIX AX8 thermal sensor cameras
Indicators of Infection
Best practices and remedial measures:
- It is recommended to keep the software up to date with latest security updates
- Install the latest firmware and use a properly configured firewall.
- Ensure minimal exposure to the Internet on Linux servers and IoT devices Monitor network traffic, outbound port scans, and unreasonable bandwidth usage.
- It is advised to carry out timely patching of internet-connected devices to avoid becoming a victim of Zerobot
Additional measures for securing IOT devices:
- Restrict Web Management Interface access of IoT devices to authorized users only and change default username/passwords
- Always change Default login credentials before deployment in production.
- Change default credentials at device startup and ensure that passwords meet the minimum complexity.
- Disable Universal Plug and Play (UPnP) on IoT devices unless absolutely required
- Users should be aware of the installed devices and their capabilities. If a device comes with a default password or an open Wi-Fi connection, users should change the password and only allow it to operate on a home network with a secured Wi-Fi router
- Control access to the devices with Access List
- Configure devices to "lock" or log out and require a user to re-authenticate if left unattended
- Implement account lockout policies to reduce the risk of brute forcing attacks
- Identify systems with default passwords and implement abovementioned measures. Some the systems that need to examined are Routers, switches, web applications and administrative web interfaces, ICS systems, Telnet and SSH interfaces
- Telnet and SSH should be disabled on device if there is no requirement of remote management
- Configure VPN and SSH to access device if remote access is required.
- Configure certificate based authentication for telnet client for remote management of devices
- Implement Egress and Ingress filtering at router level.
- Report suspicious entries in Routers to your Internet Service Provider/CERT-In
- Keep up to date Antivirus on the computer system.
- Keep up-to-date on patches and fixes on the IoT devices, operating system and applications.
- Unnecessary port and services should be stopped and closed.
- Logging must be enabled on the device to log all the activities.
- Enable and monitor perimeter device logs to detect scan attempts towards critical devices/systems.