Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/12/2018
09:00 AM
Andrey Shalnev
Andrey Shalnev
Partner Perspectives
50%
50%

How Attackers Can Exploit rTorrent with Monero Cryptocurrency Miner

As cryptomining campaigns become more profitable, cybercriminals are becoming more creative about finding new ways to extend their operations.

rTorrent is a Unix-based torrent client that is implemented in C++. rTorrent optionally supports XML-RPC to allow control by other external programs. XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. ruTorrent is an example of a web-based front-end that controls the rTorrent client using XML-RPC communication.

Unlike communicating with the uTorrent client, the rTorrent client doesn’t require any authentication and supports a method for direct shell command execution. While this functionality was not meant to be publicly accessible, some threat actors decided to test their luck on the Internet by looking for misconfigured rTorrent clients exposed to the web.

The campaign spotted by F5 researchers consists of two steps: reconnaissance and exploitation. The reconnaissance is performed using POST requests to an XML-RPC endpoint. The attacker tries to invoke the "download_list" method (provides the list of downloaded torrents) as an indication of an installed rTorrent client.

The request is sent to the "/RPC2" URL (as would be the case for common XML-RPC communication) but the endpoint URL is defined by the torrent client user in the web server configuration and could be configured to other values.

If there is a running rTorrent instance, it responds with a "200 OK" status code, and a list of hashes of the download list files. Then, once the result is positive, the attacker initiates the exploitation by sending another POST request that calls the "execute" method, which allows the attacker to run arbitrary shell commands on the host.

Payload Analysis
The attacker executes the bash (Unix shell) command with a base64 encoded payload. The payload is decoded using a Unix built-in base64 command and is executed by piping it to another bash to create a crontab task executed every hour. The task downloads a file from the attacker’s server and pipes its content directly to bash, which results in the execution of the script without saving it on the hard drive.

The bash script sets up some environment variables and prevents logging of any output from the running script. It also changes the memory page’s size to 128, likely to increase the performance of the mining process.

Removing Competitors
The script tries to stop other miners from running (competitors or older versions of its own miners) if they are present. It has quite a comprehensive list of miner process identifiers, from common miner program names like "miner" and "xmr" to specific file names such as "wnTKYg", "imWBR" and "ddg", that are related to another mining campaign. It also searches for common miner program arguments such as“stratum”(mining protocol) and miners that pretend to be ssh deamon (for example, sshd).

Downloading Malware from the Hidden Network
The malware sleeps for random periods (likely an evasion technique) and then downloads the mining malware with the correct OS architecture (x64 or x32). Interestingly, the file is served from a Tor network using the Tor2Web "gateway" service to make detection and shutdown of the attacker’s website more difficult. Tor2Web allows Tor hidden services to be accessed from a standard browser without being connected to the Tor network. This technique has been used by attackers for several years.

Zealot Connection?
Looking more closely, the malware download request contain a custom user-agent header with the value of "-". Interestingly, the same unique user-agent was also used in the Zealot campaign, leading us to speculate that both campaigns are executed by the same threat actor.

The user-agent is a bit unique as attackers typically use a legitimate browser user-agent to better masquerade their traffic, or a user agent that includes a default HTTP library name (for example, "python-requests/2.18.4"). In this case, the user-agent doubles as a deception technique to trick researchers or scanners that access the server with their Internet browser or tool and get a “403 Forbidden” response instead of the real content. This technique is being used more frequently by sophisticated attackers nowadays.

The downloaded malware is a Monero (XMR) crypto-currency miner. Currently, the executable is barely detected by anti-virus agents.  At the time of this writing, only 3 of 59 anti-virus agents detected it as malicious.

Mining Monero (XMR) Currency
The mining pool and Monero wallet addresses is in the malware file strings.

The mining addresses are: 45e9rBtQwSXfdLn6avycd1bMp6RJTsNfwdPrMPWbz8crBXzPeGPLM6t8QE3s6JS5LNJUGMGmibF9yZhjVoCbUvz989EsT6h

44Sqc2Zcgz7ROLQcGRXtFsMbwNQIX5HExWMxD9tfxXRDBBiu2pf2j6VhvjD6i7D8MLNYzn73efgxEIwfweVG626MIdl2uxC

Looking at the mining addresses we can see that the attacker has gained approximately $3,900 from this campaign for one of the addresses. The attacker’s current hash rate will produce the attacker about $43 per day. Currently, the second address doesn’t have a balance.

As crypto-mining campaigns become more profitable than other cybercrime business models, attackers are becoming more creative and finding new ways to extend their operations. In this example, we are seeing crypto criminals moving into an interesting attack vector target: misconfigured BitTorrent clients. As a protection, rTorrent users are advised to make sure that their clients are not accepting connections from the outside world, and that the listening sockets are bound to the localhost. Or, better yet, avoid XML-RPC functionality that is not shipped with the default installation. It’s worth noting that the author of rTorrent explicitly recommends not using the RPC functionality over TCP sockets.

Get the latest application threat intelligence from F5 Labs.

F5 makes apps go-faster, smarter, and safer. With solutions for the cloud and the data center, F5 technology provides unparalleled visibility and control, allowing customers to secure their users, applications, and data. For more information, visit www.f5.com. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: camera, camera everywhere, not a single news to rely on
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-16873
PUBLISHED: 2018-12-14
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, b...
CVE-2018-16874
PUBLISHED: 2018-12-14
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in mod...
CVE-2018-16875
PUBLISHED: 2018-12-14
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are ...
CVE-2018-14623
PUBLISHED: 2018-12-14
A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulne...
CVE-2018-18093
PUBLISHED: 2018-12-14
Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access via local access.