On May 24, a report was published by security researchers upon the discovery of a group who had infected more than 500,000 home and small-enterprise routers in at least 54 countries with their malware VPNFilter. This malware can attack, collect research, steal key credentials, monitor SCADA protocols, and install a kill command to destroy your device via your infected router. These attacks have been happening since 2016, however there has been a spike in infections in recent weeks, mostly in Ukraine. This has prompted the researchers to publish their report early due to its high threat and vulnerability level to the identified systems involved.
From observations from the researchers, they’ve noticed that VPNFilter’s infection goes through 3 stages:
Stage 1
Infected router enables the deployment and spread of the malware by locating target servers with downloadable images from Photobucket.com, extracting an IP address, and recognize several types of CPU architectures running on Busybox and Linux-based firmware. Redundant command and control mechanisms identify and adapt, such that if the Photobucket download fails, Stage 1 will download from ToKnowAll.com. It also listens for a trigger packet from the attackers, checking for the IP from api.ipify.org and stores it for later use. In this stage, the core malware code survives in infected systems even when rebooted.
Stage 2
It deploys intelligence collection such as file collection, command execution, device management and data exfiltration. It also deploys self-destruct capabilities. It can assess the network value the server holds, especially if the system holds potential interest to the threat actors. The actors can then decide if they can use the network to continue gathering data or use the system to propagate through the connections. The self-destruct function in this stage overwrites critical portions of the device for a reboot directive, destroying the firmware once attackers trigger the built-in kill command and leaving the device unrecoverable.
Stage 3
This stage contains modules that act as plugins for Stage 2. One packet acts as a sniffer for collecting data and intercepting traffic, such as website credentials theft and Modbus SCADA protocols, while another plugin allows for automated communication to ToR. Other plugins that have yet to be identified were observed to be included in this stage.
According to the researchers, you should take the following steps to help protect your systems from VPNFilter:
- Reset your routers to restore its factory default settings. Rebooting stops Stages 2 and 3 from running on infected devices, at least until Stage 1 reinstalls both processes
- Update the router’s firmware immediately once the manufacturers release the patch
For Trend Micro Smart Home Network users, you can be assured protection from this threat with the following rules implemented:
- 1054456 WEB Linksys Unauthenticated Remote Code Execution -1 (OSVDB-103321)
- 1054457 WEB Linksys Unauthenticated Remote Code Execution -2 (OSVDB-103321)
- 1055170 EXPLOIT Generic Arbitrary Command Execution -1
- 1056614 WEB Cisco Linksys E1500/E2500 apply.cgi Remote Command Injection -1 (BID-57760)
- 1058664 WEB Cisco Linksys E1500 and E2500 Router Directory Traversal Vulnerability (BID-57760)
- 1058665 WEB Cisco Linksys E1500 and E2500 Router Password Change Vulnerability (BID-57760)
- 1058980 WEB Cross-site Scripting -14
- 1059209 WEB Cisco Linksys E1500 and E2500 Router OS Command Injection Vulnerability (BID-57760)
- 1059253 WEB Netgear DGN1000 And Netgear DGN2200 Security Bypass Vulnerability (BID-60281)
- 1059264 WEB QNAP VioStor NVR and QNAP NAS Remote Code Execution Vulnerability (CVE-2013-0143)
- 1059672 WEB Cisco Linksys E1500/E2500 apply.cgi Remote Command Injection -2 (BID-57760)
- 1132723 WEB GD Library libgd gd_gd2.c Heap Buffer Overflow -1 (CVE-2016-3074)
- 1133310 WEB Netgear R7000 Command Injection -1.1 (CVE-2016-6277)
- 1133463 SSDP Simple Service Discovery Protocol Reflection Denial of Service Vulnerability
- 1133464 WEB Netgear WNDR1000v4 Router Remote Authentication Bypass
- 1133572 WEB Shell Spawning Attempt via telnetd -1.b
- 1133802 WEB Netgear NETGEAR DGN2200 dnslookup.cgi Remote Command Injection (CVE-2017-6334)
- 1133908 EXPLOIT QNAP Transcode Server Command Execution
- 1134566 NETBIOS MikroTik RouterOS SMB Buffer Overflow -1 (CVE-2018-7445)
- 1134567 NETBIOS MikroTik RouterOS SMB Buffer Overflow -2 (CVE-2018-7445)
If you have further inquiries on the above malware, you may contact us at 893-9515 and we will be happy to answer them!