www.trendmicro.com
Open in
urlscan Pro
23.56.162.160
Public Scan
Submitted URL: https://t.co/a9wDSZNTOW
Effective URL: https://www.trendmicro.com/en_id/research/18/e/gpon-vulnerabilities-exploited-for-mexico-based-mirai-like-scanning-activiti...
Submission: On November 11 via api from IN — Scanned from US
Effective URL: https://www.trendmicro.com/en_id/research/18/e/gpon-vulnerabilities-exploited-for-mexico-based-mirai-like-scanning-activiti...
Submission: On November 11 via api from IN — Scanned from US
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with easy-to-use solutions designed for your growing
business
Learn more
* Platform
* Vision One Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* AI Companion
* Trend Vision One Companion
Your generative AI cybersecurity assistant
Learn more
* Attack Surface Management
* Attack Surface Management
Stop breaches before they happen
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Attack Surface Risk Management for Cloud
* Attack Surface Risk Management for Cloud
Cloud asset discovery, vulnerability prioritization, Cloud Security
Posture Management, and Attack Surface Management all in one
Learn more
* XDR for Cloud
* XDR for Cloud
Extend visibility to the cloud and streamline SOC investigations
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Security
* File Security
Protect application workflow and cloud storage against advanced threats
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* XDR for Endpoint
* XDR for Endpoint
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* XDR for Network
* XDR for Network
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* 5G Network Security
* 5G Network Security
Learn more
* Email Security
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Email and Collaboration Security
* Trend Vision One™
Email and Collaboration Security
Stop phishing, ransomware, and targeted attacks on any email service
including Microsoft 365 and Google Workspace
Learn more
* OT Security
* OT Security
* OT Security
Learn about solutions for ICS / OT security.
Learn more
* XDR for OT
* XDR for OT
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Industrial Network Security
* Industrial Network Security
Industrial Network Security
* Threat Insights
* Threat Insights
See threats coming from miles away
Learn more
* Identity Security
* Identity Security
End-to-end identity security from identity posture management to
detection and response
Learn more
* All Products, Services, and Trials
* All Products, Services, and Trials
Learn more
* On-Premises Data Sovereignty
* On-Premises Data Sovereignty
Prevent, detect, respond and protect without compromising data
sovereignty
Learn more
* Research
* Research
* Research
* Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Partner Competencies
* Partner Competencies
Stand out to customers with competency endorsements that showcase your
expertise
Learn more
* Partner Successes
* Partner Successes
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Partners
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Find Alliance Partners
* Find Alliance Partners
Learn more
* Partner Resources
* Partner Resources
* Partner Resources
Discover resources designed to accelerate your business’s growth and
enhance your capabilities as a Trend Micro partner
Learn more
* Partner Portal Login
* Partner Portal Login
Login
* Trend Campus
* Trend Campus
Accelerate your learning with Trend Campus, an easy-to-use education
platform that offers personalized technical guidance
Learn more
* Co-Selling
* Co-Selling
Access collaborative services designed to help you showcase the value
of Trend Vision One™ and grow your business
Learn more
* Become a Partner
* Become a Partner
Learn more
* Distributors
* Distributors
Learn more
* Find Partners
* Find Partners
Locate a partner from whom you can purchase Trend Micro solutions
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Compare Trend Micro
* Compare Trend Micro
* Compare Trend Micro
See how Trend outperforms the competition
Let's go
* vs. Crowdstrike
* Trend Micro vs. Crowdstrike
Crowdstrike provides effective cybersecurity through its cloud-native
platform, but its pricing may stretch budgets, especially for
organizations seeking cost-effective scalability through a true single
platform
Let's go
* vs. Microsoft
* Trend Micro vs. Microsoft
Microsoft offers a foundational layer of protection, yet it often
requires supplemental solutions to fully address customers' security
problems
Let's go
* vs. Palo Alto Networks
* Trend Micro vs. Palo Alto Networks
Palo Alto Networks delivers advanced cybersecurity solutions, but
navigating its comprehensive suite can be complex and unlocking all
capabilities requires significant investment
Let's go
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Formula E Racing
* Formula E Racing
Learn more
* Connect With Us
* Connect With Us
* Connect With Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
3 Alerts
Back
Unread
All
* Silent Threat: Red Team Tool EDRSilencer Disrupting Endpoint Security
Solutions
close
Learn more
* Gartner 2024 CNAPP Market Guide Insights for Leaders
close
Get insights
* 5 AI Security Takeaways featuring Forrester
close
Learn key strategies
Folio (0)
Support
* Business Support Portal
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* AI Security
* Trend Micro vs. Competition
* Cyber Risk Assessments
* What Is?
* Threat Encyclopedia
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Vision One
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affiliate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Exploits & Vulnerabilities
GPON BUGS EXPLOITED FOR MIRAI-LIKE SCANNING ACTIVITIES
We recently found similar Mirai-like scanning activity from Mexico with some
being done via the exploitation of CVE-2018-10561 and CVE-2018-10562, two
vulnerabilities that are specific to Gigabit Passive Optical Network
(GPON)-based home routers.
By: IoT Reputation Service Team, Smart Home Network Team May 21, 2018 Read
time: 3 min (904 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
In April, we discussed our findings on increased activity originating from China
targeting network devices in Brazil that mimicked the Mirai botnet’s scanning
technique. We recently found similar Mirai-like scanning activity from Mexico.
The difference in these attacks, however, is that some of the detected activity
is being done via the exploitation of CVE-2018-10561 and CVE-2018-10562, two
vulnerabilities that are specific to Gigabit Passive Optical Network
(GPON)-based home routers. These two vulnerabilities can be exploited to allow
remote code execution (RCE) on the affected device.
Activity detected in Mexico
From 12:00 p.m. UTC on May 8 to 12:00 a.m. UTC on May 10, we detected an influx
of activity coming from 3,845 IP addresses located in Mexico. Unlike the
previous activity, the targets for this new scanning procedure are distributed.
However, based on the username and password combinations we found in our data,
we concluded that the target devices still consist of home routers or IP cameras
that use default passwords.
Figure 1. Mirai-like scanning activity from Mexico
Figure 2. The Mirai-like behavior is based on MASUTA, a variant of Mirai
Figure 3. Attack on GPON routers exploiting the CVE-2018-10561 and
CVE-2018-10562 vulnerabilities
Routers and Cameras as the main targets
According to the monitored traffic, the attack mainly targets routers and
cameras, which are being compromised via default usernames and passwords. The
large number of users that still use default credentials make botnet attacks
especially effective, as they make easy targets for attackers. The top 30
most-commonly used username and password pairs during this attack operation are
listed below:
Figure 4. The 30 most commonly used username-password pairs. The numbers on the
left-most column indicate the counts for each
Where are the attackers coming from?
We discovered that the Autonomous System Numbers (ASN) of the IP addresses used
by most of this operation's attackers is ASN 8151. This ASN is from one of the
largest telecommunications companies in Mexico. In addition, based on the WHOIS
info of the IP addresses, most of them are owned by the same company based in
Mexico. The Attackers’ TCP ports 22, 23, 80, 443, 8080 and UDP port 5060 were
observed during the attack. Only 40% of the attackers open one of the observed
ports, as shown in the figure below:
Figure 5. 40% of the attackers open one of the observed ports
Based on our data, 32% of the open-port attackers support the Session Initiation
Protocol (SIP), a common function for home routers and IP cameras. This means
that about 500 attacker devices enable the SIP function. Examples of this are
open ports 5060 and 5061, which are both associated with the SIP protocol.
Figure 6. 32% of the open-port attackers support SIP
Roughly 300 attacker devices enable HTTP services. The device identification
results of these devices can be seen below:
Figure 7. The distribution of HTTP-enabled attacker devices
Identifying the attacker devices is generally difficult because the related
information is limited. However, we can surmise that some of the bots consist of
compromised routers and cameras. The attacks use a malware downloading script to
download four malware variants (Detected as ELF_MIRAI.AUTJ) for different
architectures, namely ARM, ARMv7, MIPS and MIPS little-endian. These four are
common architectures used for both embedded and IoT devices.
Figure 8. The malware downloading script
The collected malware samples come in the following file formats:
Executable Architecture Instruction Set ELF 32-bit LSB MIPS MIPS-I version 1
(SYSV) ELF 32-bit MSB MIPS MIPS-I version 1 (SYSV) ELF 32-bit LSB ARM version 1
ELF 32-bit LSB ARM EABI4 version 1 (SYSV)
The use of default usernames and passwords has long been a security headache
when it comes to IoT-based attacks. Many users stick with the default
credentials because they are unaware that it could compromise security down the
line. However, as proven in this blog, and demonstrated in previous attacks
targeting IoT devices, attackers often use exploited devices with default
credentials as a primary infection vector. We recommend that users change the
credentials of their devices — preferably, passwords that include at least 15
characters with a mix of uppercase and lowercase letters, numbers, and special
characters — as soon as possible.
Given that the attacks also abuse vulnerabilities, users should also patch their
device firmware to the latest versions, as these often come with security
updates that address exploitable vulnerabilities. The use of firewalls and
intrusion detection and prevention systems can also help prevent attackers from
accessing a device or network.
Finally, users can look into employing security solutions that can monitor
internet traffic, identify potential attacks, and block any suspicious
activities on devices connected to the network. Our IoT Reputation Service
(IoTRS), provided by the cloud-based Trend Micro™ Smart Protection
Network™ infrastructure and integrated into several Trend Micro IoT security
solutions, has updated its real-time block list to offer relevant safeguards
against this threat and other malicious web accesses and aberrant behaviors
associated with smart devices, including home routers, DVRs, and networked
security cameras.
Trend Micro Home Network Security users are protected from this threat via these
intrusion prevention rules:
* 1134610, WEB Dasan GPON Routers Command Injection -1.1 (CVE-2018-10561)
* 1134611, WEB Dasan GPON Routers Command Injection -1.2 (CVE-2018-10561)
Trend Micro™ IoT Security for Surveillance Cameras™ (TMIS-CAM) users are
protected from this threat via the IoTRS service.
Indicators of Compromise
ELF_MIRAI.AUTJ:
* SHA256: 05d24ac0bd8ec951f4f1f27cdc398513c6703314c64e5688fdaeec143a4da48a
* SHA256: 2f09eaa066cc68b76c7803e2e6f36573acbe3971faae4ef0c9b2512719b29efb
* SHA256: 575d5a25cff7c6dc3b970cfc441be19bd4d2429ffa892d078f53773c9d391100
* SHA256: 1824dc38b2a16406e62732be5a6e9521c459d70a55db4b315d1d35315ee299ec
Tags
IoT | Research | Exploits & Vulnerabilities | Articles, News, Reports | Network
AUTHORS
* IoT Reputation Service Team
Threats Analysts
* Smart Home Network Team
Threats Analysts
Contact Us
Subscribe
RELATED ARTICLES
* Trend Micro and Japanese Partners Reveal Hidden Connections Among SEO Malware
Operations
* Breaking Down Earth Estries' Persistent TTPs in Prolonged Cyber Operations
* Analyzing How TeamTNT Used Compromised Docker Hub Accounts
See all articles
Experience our unified platform for free
* Claim your 30-day trial
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* Find a Partner
*
*
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Country Headquarters
Trend Micro - Indonesia (ID)
The Plaza Office Tower,
21st Floor
Jl. MH. Thamrin Kav. 28-30
Jakarta 10350 - Indonesia
Phone: +6221 2992 2177
Select a country / region
Indonesia expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
Copyright ©2024 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
✓
Thanks for sharing!
AddToAny
More…
BDOW!