BCMPUPnP_Hunter: A 100k Botnet Turns Home Routers to Email Spammers

guest · Nov 7, 2018

BCMPUPnP_Hunter: A 100k Botnet Turns Home Routers to Email Spammers
November 7, 2018
https://blog.netlab.360.com/bcmpupnp_hunter-a-100k-botnet-turns-home-routers-to-email-spammers-en/

Since September 2018, 360Netlab Scanmon has detected multiple scan spikes on TCP port 5431, each time the system logged more than 100k scan sources, a pretty large number compared with most other botnets we have covered before.

We had to tweak and customize our honeypot quite a few times, then finally in Oct, we got it right and successfully tricked the botnet to send us the sample (we call it BCMUPnP_Hunter).
[...] The target of infection is mainly router equipment with BroadCom UPnP feature enabled.
Main Sample
The main sample includes BroadCom UPnP vulnerability probe and a proxy access network module, it can parse four instruction codes from C2
[...] BCMUPnP_Hunter is used to proxy traffic to the following servers [...]

servers are all well-known mail service providers, including Outlook, Hotmail, Yahoo! Mail; [...] it appears that the attacker is abusing the email service of these servers;
Click to expand...

itman · Nov 7, 2018

Rapidly Growing Router Botnet Takes Advantage of 5-Year-Old Flaw

“The interaction between the botnet and the potential target takes multiple steps, it starts with TCP port 5431 destination scan, then moving on to check target’s UDP port 1900 and wait for the target to send the proper vulnerable URL,” the team explained. “After getting the proper URL, it takes another four packet exchanges for the attacker to figure out where the shellcode’s execution start address in memory is, so a right exploit payload can be crafted and fed to the target.”

A closer look at the scans show that 116 different types of devices have been infected, including router models from ADB, Broadcom, D-Link, Digicom, Linksys/Cisco, NetComm, UTStarcom, ZyXEL and others.

To protect against botnet infection, users should update their routers to the latest firmware versions.
Click to expand...

https://threatpost.com/rapidly-growing-router-botnet-takes-advantage-of-5-year-old-flaw/138869/

Log in or Sign up

BCMPUPnP_Hunter: A 100k Botnet Turns Home Routers to Email Spammers

guest Guest

itman Registered Member

Log in or Sign up

BCMPUPnP_Hunter: A 100k Botnet Turns Home Routers to Email Spammers

guest Guest

itman Registered Member

Useful Searches