Security Ramblings

I wrote a script to automatically connect to + download all the binary files on a HFS malware store.

How’s it work?

1) it grabs the latest data from the kippo input table using mysql 

2) it cleans it, formats it, and removes the duplicates

3) it checks to see what sites are new from the previous run (to avoid duplication)

4) it performs a check to confirm the site is ALIVE and an HFS site

5) it downloads the data to a folder called MalwareDump

I put it up on github if you’re interested.  

I read about canarytokens recently and I have to say I'm really impressed with how well this concept was explained and executed.  The blog post gives several real-world examples on how these can be used for agent-less monitoring and how file honeypots can\should be used as an intrusion detection technique.

I wanted to see if I could think of some new ways to use these capabilities.  I only came up with 2 so far and they are:

Idea 1: submit rigged documents to online submission systems and map internal systems (or partners and researchers)

Idea 2: hide a canary in your online resume so you know when someone reads it.  

Running with my first idea I decided to submit a canarytoken url to virustotal to see what systems "call out" to my canary.  I submitted the URL 4 days ago and so far I've gotten 6 hits.

Channel: HTTP Time   : 2015-09-18 15:37:58.487687 Memo   : VirusTotal? Source IP : 107.178.195.202 User-agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) AppEngine-Google; (+http://code.google.com/appengine; appid: s~virustotalcloud)

Channel: HTTP Time   : 2015-09-18 15:48:10.843181 Memo   : VirusTotal? Source IP : 5.39.93.201 User-agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2)

Channel: HTTP Time   : 2015-09-18 15:52:39.060050 Memo   : VirusTotal? Source IP : 46.166.190.155 User-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)

Channel: HTTP Time   : 2015-09-18 16:23:16.014606 Memo   : VirusTotal? Source IP : 178.43.119.74 User-agent: Mozilla/4.2 (compatible; MSIE 7.0; Windows NT 5.2; en-US)

Channel: HTTP Time   : 2015-09-18 19:56:00.069800 Memo   : VirusTotal? Source IP : 64.69.91.210 User-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)

Channel: HTTP Time   : 2015-09-19 01:48:47.152568 Memo   : VirusTotal? Source IP : 91.121.83.118 User-agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

At this point I don’t know if these are internal systems that virustotal passes off to, partners, or people who scan virustotal for new samples (I guess we’ll call these people researches?) but either way it’s an interesting idea to play with.

Who or Where are these people located? [ 107.178.195.202 ] Mountain View, United States 202.195.178.107.gae.googleusercontent.com Google Inc. / GOOGLE-CLOUD [ 178.43.119.74 ] Krak?w, Poland agep74.neoplus.adsl.tpnet.pl neostrada / TPNET / NEOSTRADA-ADSL [ 46.166.190.155 ] Netherlands VPN services from Private Internet Access / MNT-NFORCE / LONDON_TRUST_MEDIA [ 5.39.93.201 ] France ns3280114.ovh.net OVH SAS / OVH-MNT / OVH [ 64.69.91.210 ] New York, United States Peer 1 Network (USA) Inc. / PEER1-GVLAN-01 [ 91.121.83.118 ] France ns352473.ovh.net OVH SAS / OVH-MNT / OVH 

Not an idea I came up with, but I came across a blog post that details how to set up a custom CNAME record using Route 53 on the AWS Gun for Hire blog.  This technique can be used to create more realistic looking links, increasing the likelihood of it being clicked.  You can read the blog post here --> http://awsgunforhire.com/all-articles/2015/9/16/using-route53-with-canarytokensorg-to-better-disguise-your-honeypot

In the same vain, you can always use a link shortner to help conceal the canarytokens url. 

Source: http://203.157.163.13:8080/data/3%E0%B8%99%E0%B8%B3%E0%B9%80%E0%B8%AA%E0%B8%99%E0%B8%AD%E0%B8%AB%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9B%E0%B8%A3%E0%B8%B0%E0%B8%8A%E0%B8%B8%E0%B8%A1%E0%B9%80%E0%B8%AD%E0%B8%A3%E0%B8%B2%E0%B8%A7%E0%B8%B1%E0%B8%93/

PDF 

DOCX

link: pastebin with cleaner formatting

Lifetime stats for cowrie instance Instance 48346f78279788a3b8d190724dd8c356

Unique values (61392 connections):  - usernames   5343  - passwords   19265  - sources     1678

#  SSH client versions                           Count -------------------------------------------------------------- 1  SSH-2.0-libssh-0.1                            40981 2  SSH-2.0-PUTTY                                 4757 3  SSH-2.0-libssh2_1.4.1                         3615 4  SSH-2.0-JSCH-0.1.44                           2584 5  SSH-2.0-libssh2_1.4.2                         1806 6  SSH-2.0-OpenSSH_4.3                           1508 7  SSH-2.0-libssh-0.5.2                          1456 8  SSH-2.0-libssh2_1.6.0                         747 9  SSH-2.0-libssh2_1.4.3                         577 10 SSH-2.0-libssh2_1.2.8                         484 11 SSH-2.0-libssh-0.6.0                          340 12 SSH-2.0-PuTTY_Local:_May_14_2009_21:12:18     308 13 SSH-2.0-JSCH-0.1.51                           113 14 SSH-2.0-Granados-1.0                          99 15 SSH-2.0-OpenSSH_4.2                           94 16 SSH-2.0-1.91 sshlib: Bitvise SSH Client (Tunn 92 17 SSH-2.0-Renci.SshNet.SshClient.0.0.1          78 18 SSH-2.0-PuTTY_Snapshot_2014_01_23             62 19 SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2         57 20 SSH-2.0-libssh-0.4.8                          48 21 SSH-2.0-PuTTY_Release_0.64                    41 22 SSH-2.0-libssh-0.2                            35 23 SSH-2.0-libssh-0.6.1                          35 24 SSH-2.0-libssh-0.5.5                          33 25 SSH-2.0-PuTTY_Release_0.63                    32 26 SSH-2.0-ChilkatSSH_2.0.0                      22 27 SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2       21 28 SSH-2.0-ZGrab ZGrab SSH Survey                18 29 SSH-2.0-ssh2js0.2.14                          18 30 SSH-2.0-OpenSSH_5.3                           16 31 SSH-2.0-paramiko_1.15.2                       15 32 SSH-2.0-paramiko_1.14.0                       13 33 SSH-2.0-paramiko_1.15.1                       10 34 SSH-2.0-Nutty-Release-0.55.6                  8 35 SSH-2.0-MEDUSA_1.0                            7 36 SSH-2.0-OpenSSH_6.7p1 Ubuntu-5ubuntu1         6 37 SSH-2.0-libssh-0.11                           6 38 SSH-2.0-PuTTY_Release_0.62                    6 39 SSH-2.0-libssh-0.6.3                          6 40 SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7.1       5 41 SSH-2.0-OpenSSH_5.5p1 Debian-6                5 42 SSH-2.0-PuTTY_Release_0.60                    4 43 SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu3         4 44 SSH-2.0-OpenSSH_4.3p2                         3 45 SSH-2.0-PuTTY_Release_0.61                    3 46 SSH-2.0-OpenSSH_5.3p1                         3 47 SSH-2.0-WinSCP_release_5.5                    2 48 SSH-2.0-WinSCP_release_5.1.5                  2 49 SSH-2.0-OpenSSH_5.1p1 Debian-5                2 50 SSH-2.0-PuTTY_Release_0.65                    2 51 SSH-2.0-libssh2_1.4.2 PHP                     2 52 SSH-2.0-vngx-jsch-0.9-1.44                    2 53 SSH-2.0-phpseclib_0.3 (mcrypt, gmp)           2 54 SSH-2.0-WinSCP_release_5.5.1                  2 55 SSH-2.0-OpenSSH_6.2p2 Ubuntu-6                1 56 SSH-2.0-libssh_6.2                            1 57 SSH-2.0-OpenSSH-keyscan                       1 58 SSH-2.0-OpenSSH_6.6p1 Ubuntu-2ubuntu1         1 59 SSH-2.0-paramiko_1.7.5                        1 60 SSH-1.99-3.2.9 SSH Secure Shell for Windows   1 61 SSH-2.0-libssh-0.5.0                          1 62 SSH-2.0-PuTTY_Release_0.59                    1 63 SSH-2.0-OpenSSH_5.2p1                         1 64 SSH-2.0-paramiko_1.10.1                       1 65 SSH-2.0-PuTTY_Release_0.58                    1 66 SSH-2.0-nsssh2_4.0.0032 NetSarang Computer, I 1 67 SSH-2.0-PuTTY_Release_0.62cn                  1 68 SSH-2.0-OpenSSH_6.6.1                         1 69 SSH-2.0-libssh-0.7.0                          1 70 SSH-2.0-libssh2_1.4.4_DEV                     1 71 SSH-2.0-PuTTY_Release_0.61cn                  1

#  Top 10 usernames                              Count -------------------------------------------------------------- 1  root                                          28681 2  admin                                         8576 3  test                                          974 4  ubnt                                          949 5  DUP admin                                     829 6  oracle                                        791 7  user                                          693 8  guest                                         656 9  nagios                                        453 10 postgres                                      451

#  Top 10 passwords                              Count -------------------------------------------------------------- 1  admin                                         4116 2                                                2727 3  default                                       2047 4  123456                                        1823 5  password                                      1465 6  ubnt                                          1063 7  root                                          919 8  a                                             873 9  1234                                          733 10 12345                                         731

#  Top 10 'user / pass' combos                   Count -------------------------------------------------------------- 1  admin / admin                                 3041 2  admin /                                       2311 3  admin / default                               1807 4  root / admin                                  969 5  ubnt / ubnt                                   933 6  root / root                                   702 7  test / test                                   337 8  guest / guest                                 290 9  pi / raspberry                                258 10 root / 12345                                  203

Affected Product:

Thomson CableHome Gateway <<MODEL: DWG849>> Cable Modem Gateway

NOTE: The model DWG850-4 is open to the same attack but doesn't come with the remote administration enabled (no web interface, no telnet)

Severity Rating:

Important

Impact:

Username and password for the user interface as well as wireless network keys can be disclosed through SNMP.  

At the time of posting this there are 61,505 results on Shodan for this model. By default there are 2 open ports: 161 (snmp), 8080 (web administration)

The default password of 4GIt3M has been set on every unit I've tested so far

Description:

The Thomson CableHome Gateway DWG849 Cable Modem Gateway product specifications include SNMP v2 & v3 under Network Management. The management information bases (MIBs) of various device subsystems on the DWG849 allows local\remote network users to discover user interface credentials and wireless network key values through simple SNMP requests for the value of these variables. Given the security authentication in SNMPv1 and SNMPv2c do not offer sufficient protection, this increases the risk that the values can be disclosed through SNMP using the default read-only community "private".

Object Identifiers (OIDs):

Make, Model, Software Version: 1.3.6.1.2.1.1.1.0 1.3.6.1.2.1.1.3.0

Web Interface Username \ Password (DEFAULT: admin \ Uq-4GIt3M) 1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0

SSID and KEY 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32 1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32

Guest Network OIDs Other OIDs of interest include 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.33  1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.34  1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.35

[POC] snmpget -t15 -v 2c -c private [host] 1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32 1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32