New CDRThief malware steals VoIP metadata from Linux softswitches

guest · Sep 10, 2020

New CDRThief malware steals VoIP metadata from Linux softswitches
September 10, 2020
https://www.bleepingcomputer.com/ne...steals-voip-metadata-from-linux-softswitches/

Malware researchers discovered a new threat that they named CDRThief targeting a specific Voice over IP system to steal call data records (CDR) from telephone exchange equipment.
Clear purpose
A softswitch is a software solution acting as a VoIP server that manages traffic (audio/video/text) in a telecommunication network. It is a central element that ensures a connection between both internal and external lines.

CDRThief’s purpose is to compromise VOS2009/3000 softswitches and steal call metadata from internal MySQL databases, such as IP addresses of the callers, phone numbers, start time and duration of the call, its route, and type.
Click to expand...

Dev knows its target
Analyzing the malware, researchers at ESET found it attempted to obfuscate malicious functionality using the Corrected Block TEA (XXTEA) cipher and then running Base64 encoding on suspicious-looking links.

From the functions of the malware, the researchers determined that CDRThief’s interest is in tables containing logs of system events, information about VoIP gateways, and call metadata.

“Based on the described functionality, we can say that the malware’s primary focus is on collecting data from the database. Unlike other backdoors, Linux/CDRThief does not have support for shell command execution or exfiltrating specific files from the compromised softswitch’s disk. However, these functions could be introduced in an updated version” - ESET
Click to expand...

ESET: Who is calling? CDRThief targets Linux VoIP softswitches

ESET researchers have discovered and analyzed malware that targets Voice over IP (VoIP) softswitches
Click to expand...

Log in or Sign up

New CDRThief malware steals VoIP metadata from Linux softswitches

guest Guest

Log in or Sign up

New CDRThief malware steals VoIP metadata from Linux softswitches

guest Guest

Useful Searches