A new Tsunami botnet is using a vulnerability in the Fiberhome AN5506 fiber router to spread
<!--kg-card-begin: markdown--><p><em>Author: <a href="https://twitter.com/_O_owl">Yanlong Ma</a>,  <a href="https://twitter.com/zom3y3">Genshen Ye</a>, <a href="https://twitter.com/SethKingHi">Ye Jin</a></em></p>
<h3 id="background">Background</h3>
<p>On January 29, 2021,360netlab Threat Detection System spotted that attackers were using a new remote command execution vulnerability<a href="https://www.exploit-db.com/exploits/42947">[1]</a> in the AN5506 fiber router of Fiberhome Communication Technology Co. to spread Tsunami botnet samples.</p>
<p>Previously, we have disclosed another security incident about Fiberhome's routers <a href="__GHOST_URL__/some-fiberhome-routers-are-being-utilized-as-ssh-tunneling-proxy-nodes-2/">[2]</a>.</p>
<h3 id="timeline">Timeline</h3>
<pre><code>On February 3, 2021, we emailed Fiberhome and reported the vulnerability details and the PoC.
On February 7, 2021, Fiberhome replied that the vulnerability was fixed at the end of 2017.
</code></pre>
<h3 id="vulnerabilityanalysis">Vulnerability Analysis</h3>
<p>Vulnerability Type: Remote command execution vulnerability requiring authorization<br>
Vulnerability Description: The webs program of the AN5506 fiber router does not filter for dangerous characters in the ping_ip field when processing setPing requests, i.e., splicing ping or traceroute commands, resulting in a remote command execution vulnerability.<br>
<a href="__GHOST_URL__/content/images/2021/02/image-20210129174720173.png"><img src="__GHOST_URL__/content/images/2021/02/image-20210129174720173.png" class="kg-image"/></a></p>
<h3 id="tsunamibotnet">Tsunami botnet</h3>
<p>This specfic Tsunami botnet Bot sample (327aba0f852b5ba34c03032e19fa8dae) targets the AN5506 fiber router. There is nothing special about this sample, and we will only briefly analyze it.</p>
<ul>
<li>
<p>Random IP generation algorithm<br>
<a href="__GHOST_URL__/content/images/2021/02/ip_gen-3.PNG"><img src="__GHOST_URL__/content/images/2021/02/ip_gen-3.PNG" class="kg-image"/></a></p>
</li>
<li>
<p>Vulnerability Exploitation<br>
<a href="__GHOST_URL__/content/images/2021/02/exp_payload.png"><img src="__GHOST_URL__/content/images/2021/02/exp_payload.png" class="kg-image"/></a></p>
</li>
<li>
<p>The primary function of the sample is to launch DDoS attack with the following specific types of attack commands.<br>
<a href="__GHOST_URL__/content/images/2021/02/atk_meth-2.PNG"><img src="__GHOST_URL__/content/images/2021/02/atk_meth-2.PNG" class="kg-image"/></a></p>
</li>
</ul>
<h3 id="vulnerabilityimpactscope">Vulnerability Impact Scope</h3>
<p>360 FirmwareTotal system shows the following device models are affected.</p>
<pre><code>AN5506-01-A
AN5506-01A2G
AN5506-01-B
AN5506-02-B
AN5506-04-A5
AN5506-04-B5
AN5506-04-F
AN5506-04-G2G
</code></pre>
<p>360 Quake Cyberspace Mapping System found the specific distribution of Fiberhome AN5506 routers by mapping the assets of the whole network as shown in the figure below.<br>
<a href="__GHOST_URL__/content/images/2021/02/AN5506.png"><img src="__GHOST_URL__/content/images/2021/02/AN5506.png" class="kg-image"/></a></p>
<h3 id="recommendations">Recommendations</h3>
<p>We recommend users of Fiberhome AN5506 router to check and update the firmware system.<br>
We also recommend readers to monitor and block the related IPs and URLs in the IoC section.</p>
<h3 id="contactus">Contact us</h3>
<p>Interested readers can contact us on <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> or via email <strong>netlab[at]360.cn</strong> .</p>
<h3 id="ioc">IoC</h3>
<p>IP:</p>
<pre><code>43.225.100.90       	Hong Kong           	ASN4594             	Internet Solutions Limited
</code></pre>
<p>C2:</p>
<pre><code>43.225.100.90:443
</code></pre>
<p>URL:</p>
<pre><code>http://43.225.100.90/i486
http://43.225.100.90/powerpc
http://43.225.100.90/i586
http://43.225.100.90/mips64
http://43.225.100.90/i686
http://43.225.100.90/armv6l
http://43.225.100.90/sh4
http://43.225.100.90/x86
http://43.225.100.90/sparc
http://43.225.100.90/armv7l
http://43.225.100.90/mipsel
http://43.225.100.90/armv5l
</code></pre>
<p>MD5:</p>
<pre><code>0f0273ff0989f43e99dd475149e2185d
000ab901bc99669194c586a2c0fa9bb0
1ab3c1291f65da0aa3e6ef885e631317
1f9240939bad6a9a61191508916ee06d
327aba0f852b5ba34c03032e19fa8dae
2128ed685f800e102149961e9f1b56a3
76189718c600fe425806eac90de9cff5
d063e649af418991b593e026920c7f1f
ec361d389ce02ea0ada7136e65efaa03
f0bf954c24ca78420cb66f81de728323
f57fbac2db64f5c358473014f97396a4
f43589884f899300916977b90e38862b
fa5dcf103384d520c6eb07969548af80
</code></pre>
<!--kg-card-end: markdown-->
Author: Yanlong Ma, Genshen Ye, Ye Jin



Background


On January 29, 2021,360netlab Threat Detection System spotted that attackers were using a new remote command execution vulnerability[1] in the AN5506 fiber router of Fiberhome Communication Technology Co. to spread Tsunami botnet samples.


Previously, we have disclosed another security incident about Fiberhome's routers [2].



Timeline


On February 3, 2021, we emailed Fiberhome and reported the vulnerability details and the PoC.
On February 7, 2021, Fiberhome replied that the vulnerability was fixed at the end of 2017.




Vulnerability Analysis


Vulnerability Type: Remote command execution vulnerability requiring authorization

Vulnerability Description: The webs program of the AN5506 fiber router does not filter for dangerous characters in the ping_ip field when processing setPing requests, i.e., splicing ping or traceroute commands, resulting in a remote command execution vulnerability.





Tsunami botnet


This specfic Tsunami botnet Bot sample (327aba0f852b5ba34c03032e19fa8dae) targets the AN5506 fiber router. There is nothing special about this sample, and we will only briefly analyze it.


 * 
   
   
   Random IP generation algorithm
   
   
   

 * 
   
   
   Vulnerability Exploitation
   
   
   

 * 
   
   
   The primary function of the sample is to launch DDoS attack with the following specific types of attack commands.
   
   
   



Vulnerability Impact Scope


360 FirmwareTotal system shows the following device models are affected.


AN5506-01-A
AN5506-01A2G
AN5506-01-B
AN5506-02-B
AN5506-04-A5
AN5506-04-B5
AN5506-04-F
AN5506-04-G2G



360 Quake Cyberspace Mapping System found the specific distribution of Fiberhome AN5506 routers by mapping the assets of the whole network as shown in the figure below.





Recommendations


We recommend users of Fiberhome AN5506 router to check and update the firmware system.

We also recommend readers to monitor and block the related IPs and URLs in the IoC section.



Contact us


Interested readers can contact us on twitter or via email netlab[at]360.cn .



IoC


IP:


43.225.100.90       	Hong Kong           	ASN4594             	Internet Solutions Limited



C2:


43.225.100.90:443



URL:


http://43.225.100.90/i486
http://43.225.100.90/powerpc
http://43.225.100.90/i586
http://43.225.100.90/mips64
http://43.225.100.90/i686
http://43.225.100.90/armv6l
http://43.225.100.90/sh4
http://43.225.100.90/x86
http://43.225.100.90/sparc
http://43.225.100.90/armv7l
http://43.225.100.90/mipsel
http://43.225.100.90/armv5l



MD5:


0f0273ff0989f43e99dd475149e2185d
000ab901bc99669194c586a2c0fa9bb0
1ab3c1291f65da0aa3e6ef885e631317
1f9240939bad6a9a61191508916ee06d
327aba0f852b5ba34c03032e19fa8dae
2128ed685f800e102149961e9f1b56a3
76189718c600fe425806eac90de9cff5
d063e649af418991b593e026920c7f1f
ec361d389ce02ea0ada7136e65efaa03
f0bf954c24ca78420cb66f81de728323
f57fbac2db64f5c358473014f97396a4
f43589884f899300916977b90e38862b
fa5dcf103384d520c6eb07969548af80


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"*Author: [Yanlong Ma](https://twitter.com/_O_owl),  [Genshen Ye](https://twitter.com/zom3y3), [Ye Jin](https://twitter.com/SethKingHi)*\n\n### Background\nOn January 29, 2021,360netlab Threat Detection System spotted that attackers were using a new remote command execution vulnerability[[1]](https://www.exploit-db.com/exploits/42947) in the AN5506 fiber router of Fiberhome Communication Technology Co. to spread Tsunami botnet samples.\n\nPreviously, we have disclosed another security incident about Fiberhome's routers [[2]](__GHOST_URL__/some-fiberhome-routers-are-being-utilized-as-ssh-tunneling-proxy-nodes-2/).\n\n### Timeline\n```\nOn February 3, 2021, we emailed Fiberhome and reported the vulnerability details and the PoC.\nOn February 7, 2021, Fiberhome replied that the vulnerability was fixed at the end of 2017.\n```\n\n### Vulnerability Analysis\nVulnerability Type: Remote command execution vulnerability requiring authorization\nVulnerability Description: The webs program of the AN5506 fiber router does not filter for dangerous characters in the ping_ip field when processing setPing requests, i.e., splicing ping or traceroute commands, resulting in a remote command execution vulnerability.\n<a href=\"__GHOST_URL__/content/images/2021/02/image-20210129174720173.png\"><img src=\"__GHOST_URL__/content/images/2021/02/image-20210129174720173.png\" class=\"kg-image\"/></a>\n\n### Tsunami botnet\nThis specfic Tsunami botnet Bot sample (327aba0f852b5ba34c03032e19fa8dae) targets the AN5506 fiber router. There is nothing special about this sample, and we will only briefly analyze it.\n\n- Random IP generation algorithm\n<a href=\"__GHOST_URL__/content/images/2021/02/ip_gen-3.PNG\"><img src=\"__GHOST_URL__/content/images/2021/02/ip_gen-3.PNG\" class=\"kg-image\"/></a>\n\n- Vulnerability Exploitation\n<a href=\"__GHOST_URL__/content/images/2021/02/exp_payload.png\"><img src=\"__GHOST_URL__/content/images/2021/02/exp_payload.png\" class=\"kg-image\"/></a>\n\n- The primary function of the sample is to launch DDoS attack with the following specific types of attack commands.\n<a href=\"__GHOST_URL__/content/images/2021/02/atk_meth-2.PNG\"><img src=\"__GHOST_URL__/content/images/2021/02/atk_meth-2.PNG\" class=\"kg-image\"/></a>\n\n\n### Vulnerability Impact Scope\n360 FirmwareTotal system shows the following device models are affected.\n```\nAN5506-01-A\nAN5506-01A2G\nAN5506-01-B\nAN5506-02-B\nAN5506-04-A5\nAN5506-04-B5\nAN5506-04-F\nAN5506-04-G2G\n```\n\n360 Quake Cyberspace Mapping System found the specific distribution of Fiberhome AN5506 routers by mapping the assets of the whole network as shown in the figure below.\n<a href=\"__GHOST_URL__/content/images/2021/02/AN5506.png\"><img src=\"__GHOST_URL__/content/images/2021/02/AN5506.png\" class=\"kg-image\"/></a>\n\n\n### Recommendations\nWe recommend users of Fiberhome AN5506 router to check and update the firmware system.\nWe also recommend readers to monitor and block the related IPs and URLs in the IoC section.\n\n### Contact us\nInterested readers can contact us on [**twitter**](https://twitter.com/360Netlab) or via email **netlab[at]360.cn** .\n\n\n### IoC\nIP:\n```\n43.225.100.90       \tHong Kong           \tASN4594             \tInternet Solutions Limited\n```\n\nC2:\n```\n43.225.100.90:443\n```\n\nURL:\n```\nhttp://43.225.100.90/i486\nhttp://43.225.100.90/powerpc\nhttp://43.225.100.90/i586\nhttp://43.225.100.90/mips64\nhttp://43.225.100.90/i686\nhttp://43.225.100.90/armv6l\nhttp://43.225.100.90/sh4\nhttp://43.225.100.90/x86\nhttp://43.225.100.90/sparc\nhttp://43.225.100.90/armv7l\nhttp://43.225.100.90/mipsel\nhttp://43.225.100.90/armv5l\n```\n\nMD5:\n```\n0f0273ff0989f43e99dd475149e2185d\n000ab901bc99669194c586a2c0fa9bb0\n1ab3c1291f65da0aa3e6ef885e631317\n1f9240939bad6a9a61191508916ee06d\n327aba0f852b5ba34c03032e19fa8dae\n2128ed685f800e102149961e9f1b56a3\n76189718c600fe425806eac90de9cff5\nd063e649af418991b593e026920c7f1f\nec361d389ce02ea0ada7136e65efaa03\nf0bf954c24ca78420cb66f81de728323\nf57fbac2db64f5c358473014f97396a4\nf43589884f899300916977b90e38862b\nfa5dcf103384d520c6eb07969548af80\n```\n"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}