Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT/Embedded Security

9/27/2018
09:35 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

VPNFilter Is 'Swiss Army Knife' of Malware

A report from Cisco Talos finds that the VPNFilter malware, which infected some 500,000 routers worldwide, is even more versatile than previously thought, thanks to seven additional third-stage modules.

The VPNFilter malware, which created a botnet that infected approximately 500,000 routers and other devices before being shut down by the FBI earlier this year, is even more versatile than previously believed, according to a new analysis.

It's enough that VPNFilter is now deemed the "Swiss army knife" of malware.

A September 26 report from Cisco Talos found an additional seven third-stage modules that could add new functionality to the malware and expand its capabilities to infect different devices and, more importantly, spread through networks to help facilitate attacks.

Discovered earlier this year by the Secret Service of Ukraine, VPNFilter is a sophisticated piece of malware that attempted to create a massive bot network by taking advantage of routers and Network Attached Storage (NAS) devices that are used by small businesses, as well as home users.

Talos, along with Symantec, did the first in-depth research on the malware before the FBI took control of the Stage 1 servers used to initiate the attack. The US government believes that VPNFilter is the work of a Russian-backed group called Sofacy, which also goes by the names Fancy Bear and APT28. (See VPNFilter Malware Targets More Routers Than Originally Thought.)

While the botnet is disabled as of now, researchers have warned that it's possible to restart the malware, especially if owners of these devices have not rebooted their devices or ignored the FBI's warnings. Additionally, VPNFilter is extremely hard to detect if it made its way back into the wild. (See Talos: VPNFilter Malware Still Stands at the Ready.)

Since the initial reports of the malware surfaced in May, Talos researchers have continued to study the botnet, even though it's disabled. This led to Wednesday's blog post detailing the additional capabilities thanks to these seven third-stage modules.

"Cisco Talos recently discovered seven additional third-stage VPNFilter modules that add significant functionality to the malware, including an expanded ability to exploit endpoint devices from footholds on compromised network devices. The new functions also include data filtering and multiple encrypted tunneling capabilities to mask command and control (C2) and data exfiltration traffic," according to the post.

Specifically, research began studying a specific protocol found in MikroTik routers. These devices seemed of interest to the person or persons behind VPNFilter, and their operational goals. In addition, many of these devices were located in the Ukraine.

Through this part of the investigation, Talos found the seven third-stage modules, which include:

  • 'htpx' -- a module which redirects and inspects the contents of HTTP traffic transmitted through devices
  • 'ndbr' -- a multifunctional SSH utility
  • 'nm' -- a module which allows network mapping activities to be conducted from compromised devices
  • 'netfilter -- a denial-of-service utility
  • 'portforwarding' -- a module which allows the forwarding of network traffic to attacker-specified infrastructure
  • 'socks5proxy' -- a module which enables the establishment of a SOCK55 proxy on compromised devices
  • 'tcpvpn' -- a module which enables the establishment of a Reverse-TCP VPN on compromised devices

Taken together, these third-stage modules expanded the capabilities of VPNFilter and allowed the malware to map networks and exploit endpoints that were connected to compromised devices. They also allowed the malware to obfuscate or encrypt malicious traffic once inside that network.

There were also multiple tools for the attackers to find new devices, move laterally through the network and identify edge devices that might be of interest. Finally, it also gave the attackers the capability to distribute a whole network of proxies, which could be used for unrelated attacks, while masking the origin of the traffic.

When considering all this information, researchers believe that VPNFilter would not only give the attackers access to these various devices, but allow them to leverage a whole network for an attack. In addition, it would give them the ability to map that whole network and then hide the malicious traffic.

However, it's still not clear how the attackers gained access initially and what vulnerability they exploited.

"The sophisticated nature of this framework further illustrates the advanced capabilities of the threat actors making use of it, as well as the need for organizations to deploy robust defensive architectures to combat threats such as VPNFilter," according to the post.

To help counter some of these effects, Talos released a tool on GitHub called Winbox Protocol Dissector. It specifically looks for malicious traffic within MikroTik routers through the Winbox protocol.

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.