Categories: Malware

SambaCry Vulnerability used in Deploying Payloads Targeting IoT devices Particularly NAS

Attackers using the SambaCry vulnerability to target older versions of Samba(3.5.0) to upload and execute the malicious payload. SambaCry Vulnerability(CVE-2017-7494) have the similarities of SMB vulnerability exploited by WannaCry.

Security experts from TrendMicro detected a Malware ELF_SHELLBIND.A which is similar to the functionality of SambaCry and this is the first payload with SambaCry that doesn’t have Cryptocurrency miner.

ELF_SHELLBIND targets internet of things (IoT) devices—particularly the Network Attached Storage (NAS) devices favored by small to medium businesses. ELF_SHELLBIND also targets different architectures, such as MIPS, ARM, and PowerPC.

Also Read SambaCry Vulnerability used by Hackers to attack Linux Servers and Mine’s Cryptocurrency

Execution flow

An attacker can find devices that vulnerable to Samba through Shodan(port 445) and then they prepare a script to automatically append malicious file on every IP. Once they successfully uploaded the files then they are victims of ELF_SHELLBIND.

Then after uploading malicious,(.SO) file in shared folder attacker need to trick server by sending an IPC request to run the locally stored file. Once executed it calls to change_to_root_user to run as root user and connect to Command and Control (C&C) server in East Africa “169[.]239[.]128[.]123” over TCP, port 80.

Then attackers obtain the system IP address and communications established over port 61422 and then malware wants the attacker to enter password Hardcore in it, once an attacker enters password then it grants access.

Once connection established successfully attacker have the command shell open and can get full control over the server, malware executes whatever command it received.

Mitigations

OS patches have been released already and the users who update in regular basis have no problems. If you have Samba enabled then the manufacturers have not yet patched, then the devices are vulnerable.

Also Read CoinDash Suffered a Hacking Attack And Stolen $7 Million Worth Ethereum Cryptocurrency

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

12 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

12 hours ago

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…

15 hours ago

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities, including…

18 hours ago

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…

19 hours ago

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…

20 hours ago