|
|
| |
| Home - Virus Alerts |  |
 |
VIRUS ALERTS
Mozi IoT Botnet
Original Issue Date:November 12, 2020
Virus Type: IoT Botnet
It has been reported that a new malware named Mozi is affecting IoT devices globally. Affected IoT devices are being assembled into an IoT botnet which could be employed by botnet owner for launching distributed denial-of-service (DDoS) attacks, data exfiltration and payload execution.
According to the reports, Mozi malware is comprised of source code from Gafgyt, Mirai, and IoT Reaper; malware families which are targeting IoT devices. Mozi could compromise embedded Linux device with an exposed telnet. It mainly targets home routers and DVRs which are either unpatched, loosely configured or have weak/default telnet credentials. The infected devices form a peer-to-peer (P2P) botnet and uses a distributed hash table (DHT) to communicate with other infected host systems.
The overall network structure is shown in the following figure:
The infection process comprises the follows:
- Current Bot node randomly uses a local port to start the http service to provide sample downloads or receives the sample download address in the Config file issued by the Botnet owner/Master.
- Current Bot node logs in to the target device (which has weak password) and writes the downloader file in echo mode. Later execute it and downloads the sample file from the sample download address provided by the current Bot node. Another way for infecting is by exploiting vulnerability at target, and then obtain a sample file from the sample download address provided by the current Bot node.
- Run the Mozi Bot sample on the infected target device sample file name Mozi.m or Mozi.a join the Mozi P2P network to become the new Mozi Bot node and continue to infect other new devices.
The vulnerabilities exploited by Mozi Botnet are shown as:
IOC (Sample MD5):
- eda730498b3d0a97066807a2d98909f3
- 849b165f28ae8b1cebe0c7430f44aff3
IOC (File Hash):
- File Name, File Hash
- mozi.m, 4dde761681684d7edad4e5e1ffdb940b
- 5738f1bc69e78d234dd04e2fbfcfb4b86403fc9117b133cf1bb7cda67e7aef0a, 86d42d968d3d12c36722e16c78e49ffb
- mozi.a, 9a111588a7db15b796421bd13a949cd4
- 83441d77abb6cf328e77e372dc17c607fb9c4a261722ae80d83708ae3865053d, dd4b6f3216709e193ed9f06c37bcc3890
Countermeasures and Best practices for prevention:
Users and administrators are advised to take the following preventive measures to protect their devices:
- Users are advised to update their devices with patches as & when released by respective OEM of devices
- If devices found infected, it is recommended to reset device firmware or restore it from trusted backup.
- Monitor or block UDP traffic from the device to Bit Torrent DHT bootstrap nodes
- Block outgoing TCP traffic with destination ports 22, 23, 2323, 80, 81, 5555, 7574, 8080, 8443, 37215, 49152, and 52869, if not in use.
References
https://www.darkreading.com/iot/new-malware-family-assembles-iot-botnet--/d/d-id/1337578
https://blog.netlab.360.com/mozi-another-botnet-using-dht/
https://www.internet-sicherheit.de/research/botnetze/iot-botnetze/mozi/
https://threatpost.com/mozi-botnet-majority-iot-traffic/159337/
https://securityintelligence.com/posts/botnet-attack-mozi-mozied-into-town/
https://www.cyberswachhtakendra.gov.in/alerts/mirai.html
https://www.cyberswachhtakendra.gov.in/alerts/IOT_Botnets_Targeting_Vulnerable_IP_cameras.html
https://www.cyberswachhtakendra.gov.in/alerts/IOTReaper.html
https://www.cyberswachhtakendra.gov.in/alerts/BrickerBot_IoT_Malware.html
https://www.cyberswachhtakendra.gov.in/alerts/MoziloTBotnet.html
|
Disclaimer
|
| |
The information provided herein is on "as is" basis, without warranty of any kind.
|
| |
|
Contact Information
|
| |
Email:info@cert-in.org.in
Phone: +91-11-22902657
|
| |
|
Postal Address
|
| |
| Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|
|
| |
| |
| |
|
| |
|