Thursday, March 28, 2024

Mirai Based Botnet Moobot Exploit Hikvision Vulnerability

Fortinet has recently discovered a malware called Moobot, which was widely distributed through a security vulnerability in a number of Hikvision surveillance or security cameras. Moobot is a variant of the well-known botnet malware Mirai. 

When a victim device is infected, it turns the device into a member of its botnet army, accepts instructions from the threat actors, and launches Distributed Denial of Service (DDoS) attacks against specific targets.

Infection Process

Moobot exploited a vulnerability CVE-2021-36260 in the webserver of Hikvision’s various surveillance cameras to invade. 

A specially crafted message of malicious commands sent to Hikvision devices with this vulnerability, that can yield this vulnerability and inject malicious code for infection.

According to the Fortinet report, The method of attacking Hikvision products is very simple, and it does not even need to pass any login verification procedures, as long as a special attack message is sent to the target device to succeed.

After Moobot got infected, it modify some common commands, such as the “reboot” command used to restart the device, so that the administrator cannot restart the hacked device.

Apart from this, the Moobot features several common elements of Satori, it’s also a variant of Mirai botnet, and in the summer of 2020, the author of Satori got arrested.

Here are the similarities of Moobot with Satori:-

  • Using a separate downloader.
  • The forking of the “/usr/sbin*” process.
  • Overwriting the legitimate “macHelper” file with the Moobot executable.

Floods used

Incorporating the compromised device into a DDoS swarm is the primary goal of Moobot, and in this proceeding to attack the C2 sends several floods with the target IP address and port number.

Here are the floods used by Moobot:-

  • UDP flood
  • ACK flood
  • ACK+PUSH flood
  • SYN flood

However, the vulnerability CVE-2021-36260 has been already fixed in the new version of Hikvision’s firmware launched in September 2021.

But, here, most IoT product owners will hardly update the product, in short, there are still a large number of unpatched products that will be there on the market, which will make it a perfect target for hackers.

While the experts recommended users frequently check whether the products they own have the security updates available or not. Also make sure that the products are updated with the latest version, to avoid becoming the targets of attackers and tools utilized by the hackers to launch attacks.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles