Researchers Develop Exploit for the Latest F5 BIG-IP Vulnerability, USB-based Wormable Malware Targets Windows Installer, Attackers Use Event Logs to Hide Fileless Malware, Unpatched DNS Bug Puts Millions of Routers, IoT Devices at Risk

Bullet points of key topics + chapter markers[00:32] Researchers Develop Exploit for the Latest F5 BIG-IP Vulnerability[04:11] USB-based Wormable Malware Targets Windows Installer[10:25] Attackers Use Event Logs to Hide Fileless Malware[17:26] Unpatched DNS Bug Puts Millions of Routers, IoT Devices at Risk

LINKS

https://thehackernews.com/2022/05/researchers-develop-rce-exploit-for.html

https://threatpost.com/usb-malware-targets-windows-installer/179521/

https://threatpost.com/attackers-use-event-logs-to-hide-fileless-malware/179484/

https://threatpost.com/dns-bug-millions-routers-iot-risk/179478/

NOTES

Researchers Develop Exploit for the Latest F5 BIG-IP Vulnerability * CVE-2022-1388 (CVSS score: 9.8) + relates to an iControl REST authentication bypass + successfully exploited - leads to an opportunity for remote code execution - allowing an attacker to gain initial access and take control of an affected system. * deploying cryptocurrency miners * dropping web shells * impacted versions of BIG-IP products + 16.1.0 - 16.1.2 + 15.1.0 - 15.1.5 + 14.1.0 - 14.1.4 + 13.1.0 - 13.1.4 - Danger * 12.1.0 - 12.1.6 * 11.6.1 - 11.6.5 + will not receive security updates + should consider upgrading to a newer version or apply the workarounds - Block iControl REST access through the self IP address - Block iControl REST access through the management interface, and - Modify the BIG-IP httpd configuration * Security researcher Kevin Beaumont has warned of active exploitation attempts detected in the wild, while simultaneously alerting the availability of a public proof-of-concept (PoC) for the code execution flaw.

USB-based Wormable Malware Targets Windows Installer * Wormable malware dubbed Raspberry Robin + active since September + but most activity seen since January + uses USB drives to get onto Windows machines - then uses Microsoft Standard Installer - legitimate processes to install malicious files * Attack + The worm appears as a shortcut LNK file masquerading as a legitimate folder on the infected USB device + The worm updates the UserAssist registry entry and records the execution of a ROT13-ciphered value referencing an LNK file when deciphered - Example: researchers observed the value q:\CSNB.yax being deciphered to d:\recovery.lnk + It uses cmd.exe to read and execute a file stored on the infected external drive + cmd.exe typically launches explorer.exe and msiexec.exe - extensively uses mixed-case letters in its commands,” most likely to avoid detection + msiexec.exe , to attempt external network communication to a malicious domain for command and control purposes - launch a legitimate Windows utility, fodhelper.exe, which in turn spawns rundll32.exe to execute a malicious command - elevated administrative privileges without requiring a User Account Control prompt + Once the worm spreads via a USB drive to someone’s machine - msiexec.exe to call out to its infrastructure * often comprised of QNAP devices * uses HTTP requests that contain a victim’s user and device names * use TOR exit nodes as additional command and control (C&C) infrastructure - Eventually installs malicious dynamic link library (DLL) files found on the infected USB. + Researchers have not yet figured out how or where Raspberry Robin infects external drives + They also don’t know why Raspberry Robin installs a malicious DLL - believe it may be to attempt to establish persistence on an infected system * though there is not enough evidence to make this conclusive + Unknown Threat Actor Group

Attackers Use Event Logs to Hide Fileless Malware * malicious campaign utilizing a never-before-seen technique for quietly planting fileless malware on target machines + technique involves injecting shellcode directly into Windows event logs - allows adversaries to use the Windows event logs as a cover for malicious late stage trojans + attackers use - a series of injection tools and anti-detection techniques to deliver the malware payload. - At least two commercial products - plus several types of last-stage RAT and anti-detection wrappers - advanced tactics + the most innovative part of this campaign * First seen in February + Activity has been increasing during the last month. + Unattributed currently + New code not seen before * Attack Method + drive targets to a legitimate website - enticing the target to download a compressed .RAR file * boobytrapped with Cobalt Strike and SilentBreak + vehicle for delivering shellcode + separate anti-detection AES decryptors * the digital certificate for the Cobalt Strike module varies. + 15 different stagers from wrappers to last stagers were signed + Next leverage Cobalt Strike and SilentBreak - to “inject code into any process” - can inject additional modules into Windows system processes or trusted applications - Next layer of the infection chain decrypts, maps into memory, and launches the code * The ability to inject malware into the system’s memory classifies it as fileless * leaving behind no artifacts on the local hard drive, making it easy to sidestep traditional signature-based security and forensics tools - technique, where attackers hide their activities in a computer’s random-access memory and use native Windows tools such as PowerShell and Windows Management Instrumentation (WMI), isn’t new. * What is: is how the encrypted shellcode containing the malicious payload is embedded into Windows event logs. To avoid detection, the code “is divided into 8 KB blocks and saved in the binary part of event logs - drops wer.dll * is a loader * wouldn’t do any harm without the shellcode hidden in Windows event logs - The dropper searches the event logs for records * with category 0x4142 (“AB” in ASCII) and having the Key Management Service as a source. * If none is found, the 8KB chunks of shellcode are written into the information logging messages + Next, a launcher is dropped - into the Windows Tasks directory - a separate thread combines all the aforementioned 8KB pieces into a complete shellcode and runs it - Dropper modules also patch Windows native API functions * related to event tracing (ETW) and anti-malware scan interface (AMSI), to make the infection process stealthier.

Unpatched DNS Bug Puts Millions of Routers, IoT Devices at Risk * An unpatched Domain Name System (DNS) bug + Created in a popular standard C library + allow attackers to mount DNS poisoning attacks against millions of IoT devices and routers to potentially take control of them + all versions of uClibc and uClibc-ng, popular C standard libraries found in numerous IoT products + flaw is caused by the predictability of transaction IDs included in the DNS requests generated by the library - may allow attackers to perform DNS poisoning attacks against the target device * DNS poisoning attack + AKA DNS spoofing and DNS cache poisoning + deceives a DNS client into accepting a forged response + forces a program to perform network communications with an arbitrarily defined endpoint instead of the legitimate one * Numerous Affected Devices + Linksys, Netgear and Axis, + Linux distributions such as Embedded Gentoo - use uClibe + uClibc-ng - fork specifically designed for OpenWRT - common OS for routers deployed throughout various critical infrastructure sectors * successful DNS poisoning attack + they also can perform a subsequent man-in-the-middle attack + they can re-route network communications to a server under their control * The attacker could then steal and/or manipulate information transmitted by users and perform other attacks against those devices to completely compromise them