Mirai-Based Worm Targets Devices via New Attack Vector

A Mirai-based worm leverages a recently disclosed attack vector to hijack routers and modems. Researchers determined that a large number of devices around the world could be vulnerable to attacks.

Numerous devices have been infected by Mirai and many others could easily get compromised. The malware is responsible for some of the largest distributed denial-of-service (DDoS) attacks in history and it has been increasingly used by malicious actors after its source code was leaked.

Researchers at BadCyber were recently contacted by an individual in Poland who discovered that his Zyxel AMG1202-T10B gateway had been rebooting every 15-20 minutes. An analysis revealed that hackers managed to remotely execute malicious commands on the device by injecting them into the network time protocol (NTP) server name field. The value of the NTP server name is parsed as a command without being validated, leading to an RCE vulnerability.

The malicious code was inserted into the NTP server name field via the TR-064 protocol, which allows ISPs to manage devices on their networks. The problem is that some devices are configured to accept TR-064 commands from the Internet, allowing attackers to abuse the feature for malicious activities.

Researchers warned earlier this month that TR-064 commands can be sent to D1000 modems provided by Ireland-based ISP Eir. An attacker can send commands to instruct the modem to open port 80 on the firewall, which allows remote access to the device’s web administration interface. It’s worth noting that D1000 modems are also manufactured by Zyxel.

A Shodan search showed that tens of thousands of D1000 modems are affected. BadCyber conducted its own search and found more than 5 million devices exposing the TR-064 service, with a majority located in Brazil, India, the UK and various other European countries.

The SANS Institute’s Internet Storm Center has also observed attack attempts on port 7547, the port used by TR-064. The organization identified roughly 41 million devices with the 7547 port open and its honeypots receive a request every 5-10 minutes. According to SANS, Speedport routers provided by Deutsche Telekom in Germany might also be vulnerable and it’s possible that these attacks are responsible for the recent Internet disruptions suffered by nearly one million of the company’s customers.

The worm found by BadCyber uses parts of Mirai’s source code and a proof-of-concept (PoC) exploit made available when the TR-064 issue was disclosed in early November. The malware is designed to scan for vulnerable devices, including with MIPS and ARM architectures. Once a device is infected, the threat prevents further access from the outside by killing the Telnet service and closing the port used by TR-064.

Related: This Web-based Tool Checks if Your Network Is Exposed to Mirai

Related: Mirai Botnet Infects Devices in 164 Countries

Related: Mirai Used STOMP Floods in Recent DDoS Attacks