Rewterz Threat Alert – Home and Small Office Wireless Routers Exploited to Attack Gaming Servers

Severity

Medium

Analysis Summary

 An updated Gafgyt variant is found attempting to infect IoT devices; specifically small office/home wireless routers of known commercial brands like Zyxel, Huawei, and Realtek. The variant uses remote code execution exploits to gain access and recruit routers into botnets to attack gaming servers – most notably those running the Valve Source engine – and cause a Denial of Service (DoS). This variant also competes against similar botnets, which are frequently sold on Instagram. According to Shodan scans, there are more than 32,000 WiFi routers potentially vulnerable to these exploits around the world. Following flaws are being exploited to drop this variant.

CVE-2017-18368 – ZYXEL P660HN-T1A 
CVE-2017-17215 – Huawei HG532 
CVE-2014-8361 – Realtek RTL81XX Chipset 

It uses three “scanners” that attempt to exploit known remote code execution vulnerabilities present on the routers mentioned above. These scanners replace the typical dictionary attack commonly found in other IoT botnets.

The exploits were crafted to work as binary droppers, which pull the corresponding binary from a malicious server depending on the type of device it is trying to infect.

Once the malware is running on a compromised device, it connects to a C2 server, which is the same as the binary dropper server, and sends the device information to join the botnet. Once the device joins the botnet, it starts receiving commands to perform various types of DoS attacks.

Impact

• Remote Code Execution
• Unauthorized Access
• Denial of Service

Affected Vendors

• Zyxel
• Huawei
• Realtek

Affected Products

Wireless Routers

Indicators of Compromise

MD5

• fb93601f8d4e0228276edff1c6fe635d
• f1c099d65bf94e009f5e65238caac468

SH256

• 04463cd1a961f7cd1b77fe6c9e9f5e18b34633f303949a0bb07282dedcd8e9dc
• 676813ee73d382c08765a75204be8bab6bea730ff0073de10765091a8decdf07

SHA1

• 5b0abd3c12611136fa9378ffc0c76d533cd3a385
• b5fe93481949f81ba6b76e22be7165dfeb88a963

Source IP

185.172.110[.]224

URL

• hxxp[:]//185[.]172[.]110[.]224/arm7
• hxxp[:]//185.172.110[.]224[:]993/
• hxxp[:]//185[.]172[.]110[.]224/mips

Remediation

• Block the threat indicators at their respective controls.
• Only use updated versions of wireless routers.