Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/19/2018
09:00 AM
Andrey Shalnev
Andrey Shalnev
Partner Perspectives
50%
50%

Researchers Discover Second rTorrent Vulnerability Campaign

This time attackers appears to have spoofed the Recording Industry Association of America (RIAA) and New York University (NYU) user-agents.

F5 threat researchers have discovered a second campaign targeting an earlier rTorrent configuration error, this time to disguise threat actors’ activities with user-agents that appear to be legitimate from the Recording Industry Association of America (RIAA) and New York University (NYU) user-agents.

  • The campaign (running in January) appears to have spoofed RIAA and NYU user-agents.
  • F5 researchers do not believe either of these user-agents are legitimately from RIAA or NYU because of the origin of returning IP addresses and other attacks seen from those addresses as well. 
  • The sending server for the RIAA user-agent is a proxy server in the Netherlands set up with the hosting company Hostkey B.V. Activity from the same IP address includes scans of ports commonly used by Torrent software, and scans for Intel AMT ports.
  • The sending servers for the NYU user-agent resolve to various hosting companies around the world from which malicious activity has been seen previously, including SSH brute force scans.

Why the RIAA?

The RIAA helps members protect copyrighted works from piracy. It’s also widely known that BitTorrent is a file sharing protocol that is primarily used to illegally share software, movies, music, and other protected works—the very same materials RIAA exists to protect. In 2001, the RIAA tried to fight piracy of copyrighted works by filing lawsuits against offenders. It even drafted an amendment to proposed legislation (the USA Act of 2001) that would have allowed the RIAA to hack distributors’ computers to delete stolen content from their file systems and indemnified them from any responsibility for damage caused to distributors’ computers.

We reference this historical proposed legislation (which, by the way, was never signed into law) because the RIAA user-agent “RIAALABS” appears in the configuration snapshot of the January campaign, shown in Figure 1.

 

Figure 1: RIAA Labs user agent

The HTTP POST request targets rTorrent’s XML-RPC interface and tries to invoke a “system.client_version” method on the frequently used path “/RPC2”. Upon successful execution of this method, it returns the rTorrent version number as shown in Figure 2.

Figure 2: Campaign collects torrent client version

New York University?

The NYU campaign was spotted just one day after the RIAA campaign. As with the RIAA campaign, we cannot be sure who is behind this campaign. NYU started a Torrent tracking project in 2015, so this spoofed user-agent could be trying to disguise itself as that project. Again, this campaign tries to query the XML-RPC interface to get the Torrent client version.

Origins of these Campaigns

There is no obvious connection between the source of these two campaigns except the timeframe. The RIAA campaign originates from a single IP address: 5.39.223.136. The NYU campaign uses three different IP addresses: 185.130.104.198, 62.210.152.47, and 203.24.188.242. All of the IP addresses are owned by hosting companies.

RIAA Campaign

F5 and our data partner Loryka checked our systems to see if the originating IP address (5.39.223.136) for the RIAA campaign had shown up as malicious over the past five years. The first time we saw it engaging in malicious activity was June 1, 2017. Other scanning activity from this IP address includes destination ports 16992, likely looking for Intel AMT-vulnerable systems, and various TCP ports commonly used by torrent software (see torrent invite site). Because of this additional malicious traffic, we do not believe this is the actual RIAA, rather a spoofed user agent. 

NYU Campaign

All of the originating IP addresses for the NYU campaign (185.130.104.198, 62.210.152.47, and 203.24.188.242) are also launching SSH brute force attacks. Because of these additional attacks, we assume these are threat actors spoofing an NYU user agent.

For now, it’s unclear what happens once a vulnerable host is found. The misconfiguration vulnerability enables attackers to invoke methods on a victim’s machine that can provide a great deal of information about the shared materials on the host. (If, for example, the goal was to delete stolen, copyrighted material), or execute their own code and use the system to mine crypto-currency like we found in the February Monero campaign. Since rTorrent is the defacto standard for threat actors attacking seedboxes, which could be great crypto-miners, we are not surprised to see attacks leveraging this rTorrent misconfiguration vulnerability to compromise hosts.

Since the IP address related to the RIAA user-agent has been engaging in other malicious activity, it’s highly unlikely this is the work of the RIAA. Rather, a threat actor is pretending to be the RIAA as a deceptive tactic, or perhaps just for their own amusement. Because this campaign was seen at least a month before the Monero crypto-mining campaign, it could have been the inspiration for cybercriminals.

Of course, it’s never okay to steal and share copyrighted works, but if you are using rTorrent for legitimate purposes, please see the misconfiguration remediation actions in our previous post. 

Get the latest application threat intelligence from F5 Labs.

 

F5 makes apps go-faster, smarter, and safer. With solutions for the cloud and the data center, F5 technology provides unparalleled visibility and control, allowing customers to secure their users, applications, and data. For more information, visit www.f5.com. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We are really excited about our new two tone authentication system!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29440
PUBLISHED: 2020-11-30
Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module (BCM). This allows an attacker (who is inside a vehicle, or is otherwise able to send data over the CAN bus) to start and drive the vehicle with a spoof...
CVE-2020-29441
PUBLISHED: 2020-11-30
An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. An unauthenticated attacker can upload arbitrary files. In some cases, this attack may consume the available database space (Denial of Service), corrupt legitimate data if files are being processed asynchronou...
CVE-2020-4127
PUBLISHED: 2020-11-30
HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system under another ID or use an intranet user's system to access internal systems from the internet. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 F...
CVE-2020-11867
PUBLISHED: 2020-11-30
Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there.
CVE-2020-16849
PUBLISHED: 2020-11-30
An issue was discovered on Canon MF237w 06.07 devices. An "Improper Handling of Length Parameter Inconsistency" issue in the IPv4/ICMPv4 component, when handling a packet sent by an unauthenticated network attacker, may expose Sensitive Information.