Elvis Wiki - User contributions [en]

SIEM Wazuh Setup

2025-01-19T16:53:58Z

AVujisic: Wazuh Documentation

= Wazuh =
Wazuh is an open-source Security Information and Event Management (SIEM) platform designed to detect and monitor security incidents across IT infrastructures. It provides features such as threat detection, vulnerability management, and compliance monitoring to help organizations strengthen their cybersecurity posture.

= Setting Up Wazuh Components =
This guide provides step-by-step instructions to set up the three main components of Wazuh: Wazuh Manager, Wazuh Indexer, and Wazuh Dashboard. These components are deployed on separate virtual machines. This guide uses Debian 12 as the operating system. Official Wazuh documentation recommends Ubuntu with a 64-bit Intel or AMD Linux processor. This article is based on Wazuh version 4.9.

== Prerequisites ==
Before proceeding with the installation, ensure the following prerequisites are met:
* VLANs and firewall rules have been configured to control communication between the servers and clients.
* Virtual machines (VMs) have been properly set up in Hyper-V with the following minimum specifications:
{| class="wikitable"
! Component !! vCPUs !! RAM !! Storage
|-
| Wazuh Manager || 2 || 2 GB || 15 GB
|-
| Wazuh Indexer || 2 || 4 GB || 150 GB
|-
| Wazuh Dashboard || 2 || 4 GB || 15 GB
|}

== Wazuh Indexer Setup ==
1. Download the installation script and configuration file:
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
curl -sO https://packages.wazuh.com/4.9/config.yml

2. Edit the config.yml file to include the appropriate DNS names and IP addresses.

3. Generate the configuration files:
sudo bash wazuh-install.sh --generate-config-files

4. Copy the generated .tar file to the Wazuh Manager and Dashboard machines:
scp wazuh-install-files.tar <user>@<manager-ip>:~/wazuh/
scp wazuh-install-files.tar <user>@<dashboard-ip>:~/wazuh/

5. Allow necessary ports on the Indexer:
sudo ufw allow 9200
sudo ufw allow 9300
sudo ufw allow 55000

6. Install and start the Indexer cluster:
sudo bash wazuh-install.sh --wazuh-indexer wazuh-indexer
sudo bash wazuh-install.sh --start-cluster

7. Get username and password for Dashboard:
tar -axf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O | grep -P "\'admin\'" -A 1

== Wazuh Manager Setup ==
1. Download the installation script:
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh

2. Install the Wazuh Manager:
sudo bash wazuh-install.sh --wazuh-server wazuh-manager

3. Allow the required ports:
sudo ufw allow 55000 # Wazuh API
sudo ufw allow 1514/tcp # Event log
sudo ufw allow from <firewall-ip> proto tcp to any port 514 # Syslog
sudo ufw allow 1515 # Endpoint deployment

== Wazuh Dashboard Setup ==

1. Download the installation script:
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh

2. Install the Wazuh Dashboard:
sudo bash wazuh-install.sh --wazuh-dashboard wazuh

3. Allow port 443 for secure access:
sudo ufw allow 443

4. Access the Dashboard via its IP address or DNS name in a web browser

== Testing the installation ==
To verify that the setup is successful, use the following command on each component:
curl -k -u admin:<password> https://<component-ip>:9200

= Configuration =
The configuration of Wazuh is managed centrally through the /var/ossec/etc/ossec.conf file on the Wazuh Manager. This file defines key settings for agents, alerts, and integrations.

== Rules ==
To create new rules or override existing ones, the desired rules should be added to the local_rules.xml file located in /var/ossec/etc/rules/. When overriding a rule, the overwrite attribute must be set to "yes." For example, to change the priority of a specific rule, the rule can be copied, modified, and saved in this file:

1. Open /var/ossec/etc/rules/local_rules.xml in editor:
nano /var/ossec/etc/rules/local_rules.xml

2. Create the custom rule in xml format and set rule id between 100000 and 120000
<group name="custom_rules_example,">
<rule id="100010" level="3">
<program_name>example</program_name>
<description>User logged</description>
</rule>
</group>

3. Restart the Wazuh-manager service
sudo systemctl restart wazuh-manager

To overwrite rules add the overwrite=yes tag to the first line:
<rule id="100010" level="0" overwrite="yes">
<program_name>example</program_name>
<description>User logged</description>
</rule>

== Syslog ==
To integrate routers or firewalls with Wazuh, Syslog can be used for log forwarding.

1. Open /var/ossec/etc/ossec.conf in editor:
nano /var/ossec/etc/ossec.conf

2. Add another <remote> to the configuration and enter the device ip and the manager ip into the <allowed-ips> tag
<remote>
<connection>syslog</connection>
<port>514</port>
<protocol>udp</protocol>
<allowed-ips><DEVICE-IP></allowed-ips>
<allowed-ips><MANAGER-IP></allowed-ips>
</remote>

3. Restart the Wazuh-manager service
sudo systemctl restart wazuh-manager

4. Configure syslog on the device

5. Test configuration:
tail -f /var/ossec/logs/archives/archives.log

= Endpoint deployment =
Wazuh Agents are lightweight components installed on endpoints to collect security-related data, such as logs, file integrity monitoring, and intrusion detection events. They communicate with the Wazuh Manager, enabling centralized analysis and real-time response to potential threats.

1. Login to the Dashboard

2. Go to Agent Management -> Summary -> Deploy new agent

3. Choose your operating system and enter the Wazuh-Manager IP

4. Choose endpoint groups

5. Run the given script on the endpoint

= References =
* https://documentation.wazuh.com/current/index.html

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2025-01-19T16:53:09Z

AVujisic:

== UPnP ==
The Universal Plug and Play (UPnP) Device Architecture, formerly known as the DCP Framework, provides a comprehensive set of protocols for seamless communication between controllers, known as control points, and devices within a networked environment. These protocols include essential functions such as device discovery, description, control, event notification, and presentation.

== Setup ==
# Raspberry Pi as UPnP Client
# UPnP ready Router
# Internet access device (Mobile Phone)

== Implementation ==
# Enable UPnP on Router
# Connect Raspberry Pi with Router
# Check external IP (curl https://ipecho.net/plain ; echo)
# Check internal IP on Raspberry Pi (ifconfig)
# Install miniupnpc client on Raspberry Pi (sudo apt-get install miniupnpc)
# Set up port forwarding on Router via Raspberry Pi miniupnpc Client (upnpc- a <internalIpRaspberryPi> <internalPort> <externalPort> TCP)
# Set up index.html on Raspberry Pi and start http server in the same directory (python3 -m http.server <internalPort>)
# Access external IP and Port with any Browser from outside the network (http://<externalIP>:<externalPort>)

[[Category:Documentation]]

Experimental Evaluation of Browser-Based Cryptojacking Detection and Prevention Tools

2025-01-19T16:50:18Z

AVujisic:

BoNeSi: The DDoS Botnet Simulator

2024-12-15T12:02:59Z

AVujisic: Created page with "== Summary == BoNeSi is an Open-Source Tool developed by Deutsches Forschungszentrum fuer Kuenstliche Intelligenz. It is used to test DoS and DDoS attacks and analyze their impact. It supports different types of traffic like HTTP and ICMP. == Requirements == * Operating system: 2x Ubuntu 18.04 bionic amd64 [https://releases.ubuntu.com/ Ubuntu Download] * Packages: git, make, gcc, libpcap, apache2 == Installation Guide == === Step 1 === Install and start the Apache..."

== Summary ==

BoNeSi is an Open-Source Tool developed by Deutsches Forschungszentrum fuer Kuenstliche Intelligenz. It is used to test DoS and DDoS attacks and analyze their impact. It supports different types of traffic like HTTP and ICMP.

== Requirements ==

* Operating system: 2x Ubuntu 18.04 bionic amd64 [https://releases.ubuntu.com/ Ubuntu Download]
* Packages: git, make, gcc, libpcap, apache2

== Installation Guide ==

=== Step 1 ===

Install and start the Apache web server on the target machine

sudo apt-get update
sudo apt-get install apache2
sudo systemctl start apache2

=== Step 2 ===

Install the following packages on the attacker machine

sudo apt-get update
sudo apt-get install libpcap-dev build-essential git automake

=== Step 3 ===

Clone the Github repository [https://github.com/Markus-Go/bonesi Github BoNeSi]

git clone https://github.com/Markus-Go/bonesi.git

=== Step 4 ===

Change to the directory and compile

cd bonesi
./configure
make
make install

=== Step 5 ===

There are many ways how to use BoNeSi.

The first one is to flood the web server with TCP requests:

./src/bonesi -p tcp -d eth0 <TARGET:80>

Another way is to flood the target with ip spoofed request.

The file 50k-bots is a text file which contains random generated IP addresses which are used to flood the target:

./src/bonesi -p tcp -i 50k-bots -d eth0 <TARGET:80>

== References ==

* https://github.com/Markus-Go/bonesi

[[Category:Documentation]]

IoT Malware

2024-12-15T00:45:48Z

AVujisic:

== Internet of Things (IoT) Malware: Theoretical Foundations and Types ==

=== Overview ===
The Internet of Things (IoT) refers to the network of interconnected devices capable of collecting, exchanging, and analyzing data. Coined by Kevin Ashton in 1999, the concept has grown significantly over the years. By 2008, the number of connected devices surpassed the world population, reaching over 8 billion. IoT devices are employed in various sectors, including smart homes, healthcare, transportation, agriculture, and more. However, the convenience offered by these devices often overshadows their security risks. <ref name="RE1">Fotios Chantzis, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>

=== Types of Connected Devices in IoT ===

==== Applications ====
# '''Smart Homes and Cities''': Enhance life quality through energy efficiency and convenience but pose security risks due to processing sensitive data.
# '''Wearables for Health Monitoring''': Collect personal health data, necessitating stringent protection measures.
# '''Transport and Logistics''': Use RFID toll sensors and tracking for supply chain efficiency.
# '''Automotive Industry''': Sensors and autonomous driving technologies introduce new data security and privacy challenges.
# '''Medical and Healthcare''': Require robust security to protect sensitive patient data.
# '''Aviation and Telecommunications''': Demand reliable and secure IoT solutions to prevent catastrophic failures.
# '''Agriculture and Livestock Management''': Benefit from IoT for efficiency but need protection against environmental factors and cyber threats. <ref name=”RE2”>"5 Key IoT Applications in Smart Cities" - available under: https://www.iotforall.com/5-key-iot-applications-in-smart-cities/ - Retrieved 2023-12-17.</ref>

==== Wireless Protocols ====
# '''Cellular (GSM, GPRS, 3G, 4G, LTE, 5G)''': Ideal for applications requiring mobility and remote connectivity.<ref name="RE1">Fotios Chantzis, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>
# '''Wi-Fi (IEEE 802.11)''': Suitable for building-based IoT applications, like smart home devices.
# '''Zigbee''': A low-energy protocol, perfect for energy-efficient applications like smart home sensors.
# '''Z-Wave''': Similar to Zigbee but operates on slightly different frequencies, commonly used in home automation.
# '''Bluetooth (including Low Energy)''': Best for short-range, low-energy applications like wearables and health monitors.
# '''6LoWPAN''': Facilitates IPv6 packet transmission over low-energy wireless networks, useful for devices with limited computing resources. <ref name=”RE3”>"Top 10 IoT Segments in 2020 – Based on 1,600 Real IoT Projects" - available under: https://iot-analytics.com/top-10-iot-segments-2020/ - Retrieved 2023-12-17.</ref>

==== Communication Protocols ====
# '''MQTT (Message Queuing Telemetry Transport)''': Lightweight, efficient for devices with limited resources or low-bandwidth networks.
# '''XMPP (Extensible Messaging and Presence Protocol)''': Initially developed for instant messaging, adaptable for various IoT applications.
# '''DDS (Data Distribution Service for Real-Time Systems)''': Focused on real-time data exchange, used in critical systems like aviation or healthcare.
# '''AMQP (Advanced Message Queuing Protocol)''': Ensures reliable, secure messaging, suitable for enterprise-level and complex IoT systems.

=== Security Concerns in IoT ===

==== Priorities ====
# '''Availability''': Crucial for time-sensitive functions in medical or industrial applications.<ref name=”RE4”>"Number of Connected IoT Devices" - available under: https://iot-analytics.com/number-connected-iot-devices - Retrieved 2023-12-23.</ref>
# '''Integrity''': Vital to avoid malfunctions and misinterpretations in critical decision-making scenarios.
# '''Confidentiality''': Important but often considered less critical than availability and integrity.<ref name=”RE5”>"IoT Security: Threats and Solutions Report 2020" - available under: https://iot-analytics.com/iot-security-threats-and-solutions-report-2020/ - Retrieved 2023-12-23.</ref>

==== Challenges ====
# '''Vulnerability Management''': Many IoT devices lack the capability for regular updates, leaving known security gaps unpatched.<ref name="RE1">Fotios Chantzis, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>
# '''Limited Resources''': Small form factors and low power consumption restrict computing capabilities, complicating the implementation of complex security measures like advanced encryption.
# '''User Interface Limitations''': Lack of comprehensive user interfaces leads to a lower awareness of security settings and risks.
# '''Protocol Limitations''': Some IoT protocols do not inherently support encryption or authentication, making devices vulnerable to attacks like Man-in-the-Middle.
# '''Weak Password Protection''': Hard-coded and default passwords are major security loopholes. Mirai and Reaper malware exploited these vulnerabilities to create large-scale botnets. Manufacturers should implement secure default settings and robust authentication mechanisms, like two-factor authentication and digital certificates.
# '''Lack of Regular Patches and Updates''': IoT devices become vulnerable over time if not regularly updated. Satori malware exploited this by targeting specific WiFi routers. Manufacturers should provide regular security updates, and network managers should ensure secure update mechanisms, including encrypted exchanges for authenticity.
# '''Insecure Interfaces''': Many vulnerabilities stem from insecure web, application API, cloud, and mobile interfaces. Common issues include insufficient authentication and weak encryption. Solutions include robust device authentication and digital certificates to ensure secure data transfer.
# '''Insufficient Data Protection''': IoT devices often lack secure data storage and network segregation. This can lead to breaches like the 2017 casino attack through a thermostat. Cryptography is crucial for protecting data in motion and at rest.
# '''Poor IoT Device Management''': A study revealed that up to 15% of devices in networks were unknown or unauthorized, and many used unsupported legacy operating systems. IoT device management platforms can significantly reduce vulnerabilities by providing lifecycle management capabilities.
# '''The IoT Skills Gap''': Addressing IoT security requires skilled personnel. Companies face challenges in hiring new talents and must rely on training and upskilling existing teams to handle IoT security effectively.

== IoT Malware: In-Depth Analysis and Types ==

=== Evolution and Threat Landscape ===
Over time, malware has evolved significantly in complexity and destructive potential, posing a threat to a wide range of devices. This section delves into various malware types defined by their functions and behaviors, including worms, Trojans, viruses, spyware, ransomware, rootkits, and backdoors. Notably, IoT malware often combines elements from different malware categories. However, it's important to note that malware categorization is not always clear-cut. A common characteristic of this malware is its reliance on botnets for distribution, command execution, control, and monitoring of infected systems.

=== Classification of IoT Malware ===

==== Worms ====
Self-propagating malware that spreads autonomously within IoT devices. Examples include Mirai, Darlloz, Brickerbot, and Gitpaste-12. Notably, Hajime, a WhiteHat malware, can counteract other malware, offering a unique perspective on IoT malware functionality. <ref name=”RE6”>"A survey of IoT malware and detection methods based on static features" - available under: https://www.sciencedirect.com/science/article/pii/S2405959520300503 - Retrieved 2023-12-23.</ref>

==== Trojans ====
Trojans disguise themselves as harmless but contain hidden malicious functions. Unlike viruses, they cannot replicate themselves. An example is ProxyM, known for DDoS attacks and email spamming.

==== Viruses ====
Viruses attack IoT devices by self-replicating. The Silex virus, for instance, causes permanent DoS attacks, demonstrating the severe impact of IoT viruses.

==== Spyware ====
Spyware in IoT allows for the covert surveillance of data through infected devices. SpyCon is an instance of spyware that monitors user activities through smart home devices and mobile phones.

==== Ransomware ====
This malware type takes devices hostage and demands a ransom for their release.

==== Backdoor ====
Backdoors in IoT devices are hidden access mechanisms, often introduced by manufacturers, posing significant security risks. Examples include Tsunami and Bashlite.

=== IoT Malware Spread Mechanisms ===

==== Command-and-Control (C&C) ====
A centralized structure that commands bots via communication protocols like Internet Relay Chat or Hypertext Transfer Protocol. Its simplicity makes it common, but its central server is also a vulnerability. Examples include Mirai, Aidra, and Okane. <ref name="Victor2023">Victor, P., Lashkari, A.H., Lu, R. et al. "IoT malware: An attribute-based taxonomy, detection mechanisms and challenges." Peer-to-Peer Netw. Appl. 16, 1380–1431 (2023). Available at: https://doi.org/10.1007/s12083-023-01478-w - Retrieved 2024-01-05.</ref>

==== Peer-to-Peer (P2P) ====
A decentralized architecture where each bot acts as both server and client, making network disruption challenging. An example of P2P-based IoT malware is the Hajime worm.

=== Characteristics and Functionality of IoT Malware ===

Malware targets unauthorized access or compromise of IoT devices. Common methods include malvertising, phishing emails, infected USB drives, and fake software installations.

==== Attack Methods ====
* '''DDoS Attacks''': Overload resources to make them inaccessible. Examples: Mirai, Kaiji. <ref name="CENSIS2024">"Cyber security common attack methods" - available under: http://web.archive.org/web/20231129081357/https://censis.org.uk/what-we-do/sensing-imaging-iot/internet-of-things-iot/cyber-security-common-attack-methods/ - Retrieved 2024-01-05.</ref>
* '''Coin Mining''': Malware like Fritzfrog and Satori use compromised IoT devices for cryptocurrency mining.
* '''Spamming''': ProxyM uses infected devices for spamming.
* '''Data Exfiltration''': Malware like Mozi executes unauthorized data transfers.
* '''PDoS Attacks''': Permanently damage hardware, e.g., Brickerbot.
* '''DNS Spoofing''': Change DNS entries to redirect traffic to harmful sites.
* '''Command Injection''': Exploit vulnerable web interfaces or applications to execute commands on IoT devices.
* '''Payload Execution''': Malware remains dormant until activated.
* '''Ransomware''': Encrypts device files and demands ransom.
* '''Industrial Espionage''': Targets industrial operations, often focusing on SCADA systems.
* '''Website Hacking''': Unauthorized access to websites for data theft or malware placement.
* '''Click Fraud''': Manipulates online marketing by generating fake clicks.
* '''Other Attack Types''': Includes less common types like White-Hat attacks and unauthorized data downloading or removal.

==== Attack Vectors ====
IoT malware targets various vulnerabilities, including network, human, and software surfaces. In IoT, distinctions are made between network and device level, service level, firmware level, and device level.

* '''Network and Network Devices''': Vulnerabilities in IoT networks and firewalls.<ref name="TrendMicro2024">"The IoT Attack Surface: Threats and Security Solutions" - available under: https://www.trendmicro.com/vinfo/mx/security/news/internet-of-things/the-iot-attack-surface-threats-and-security-solutions - Retrieved 2024-01-05.</ref>
* '''Services''': Vulnerabilities in Software as a Service and Server as a Service offerings.
* '''Firmware''': Central to device communication and often a target of PDoS attacks.
* '''Devices''': Specific device components can be targeted, including ports, storage media, RAM, and hardware.

==== Device Access Mechanisms ====
IoT devices can be accessed via intranet or internet, offering various mechanisms for malware to exploit.

* '''Brute-Force Attacks''': Continuous input of login credentials to gain access.
* '''CVE Exploits''': Utilization of public security vulnerabilities.
* '''Targeted Access Mechanisms''': Specific targeting of devices based on geography, industry, etc.

==== IoT Malware Characteristics ====
* '''Virtual Environment Detection''': Determines if running in a virtual environment to avoid detection.<ref name="TrendMicro2024">"The IoT Attack Surface: Threats and Security Solutions" - available under: https://www.trendmicro.com/vinfo/mx/security/news/internet-of-things/the-iot-attack-surface-threats-and-security-solutions - Retrieved 2024-01-05.</ref>
* '''Surviving Reboots''': Copies itself to startup directories.
* '''Stealth''': Hides presence to avoid detection.
* '''Transforming Device Functions''': Converts devices into networks, honeypots, or proxy servers.
* '''Reboot Prevention''': Avoids device restart to prevent malware removal.
* '''Port Closure''': Closes unused ports to reduce vulnerabilities.
* '''Creating New Variants''': Developers release source codes for creating new variants.
* '''Service Provision''': Some malware offers DDoS-for-hire or ransomware services.
* '''Packet Size''': Malicious network traffic can exhibit unusual packet sizes.
* '''Architecture Detection''': Sends payloads matching the device's architecture.
* '''Periodic Command Execution''': Similar to CRON jobs, executes specific commands at intervals.
* '''Binary File Removal''': Removes binary files to remain in RAM and avoid detection.
* '''Name Theft and Assignment''': Steals or assigns random names to processes for concealment.
* '''UPX Header Manipulation''': Uses fake UPX headers to hinder analysis.

=== Prominent Examples of Successful IoT Malware ===

* '''Mirai''': Mirai is a well-known malware that specifically targets IoT devices operating on the Linux system. It gains access through Telnet ports (23 or 2323) via brute-force attacks. This malware converts the infected devices into bots for a botnet, used predominantly for large-scale DDoS attacks. Mirai has a wide target range, affecting devices across multiple architectures such as ARM, MIPS, and X86. Historically significant, Mirai was responsible for notable disruptions, including the attacks on journalist Brian Krebs's website and the DNS provider Dyn in 2016. The release of its source code on Hackforums by an individual known as Anna-senpai led to a surge in IoT botnet activities. Mirai's unique characteristics include monopolizing infected devices, obscuring its process name, employing a specialized CB server for device infection, and using advanced SYN scanning technology. It is capable of executing a variety of attack methods including UDP floods, DNS water torture, and SYN floods. For detection, ISPs can identify bot devices and CNC servers by scrutinizing network traffic for specific patterns. Defense against Mirai involves a strategy where a defensive program continuously connects to port 48101, causing any infecting Mirai instance to self-terminate. <ref name="CISecurity2024">"The Mirai Botnet: Threats and Mitigations" - available under: https://www.cisecurity.org/insights/blog/the-mirai-botnet-threats-and-mitigations - Retrieved 2024-01-05.</ref>

* '''IoTReaper (Reaper)''': First reported by the IT analyst yegenshen at Netlab 360 in October 2017, IoTReaper, also known as Reaper, is a botnet targeting IoT devices. Differing from Mirai, Reaper exploits specific vulnerabilities rather than using default passwords. By November 2017, it had infected about 28,000 devices, with millions more potentially vulnerable. The malware uses exploits from nine IoT devices, including routers and cameras from D-Link, Netgear, and others. Notably agile, its authors quickly integrate new vulnerabilities into the botnet. Reaper operates on a LUA scripting environment, enhancing its capability for complex attacks. The botnet's architecture includes a downloader, controller, reporter, and loader for different operations. Although its full intent was unknown as of late 2017, the botnet's potential for large-scale attacks and facilitating other malware types was significant. Reaper's success in evading common IT security measures highlights the need for deep packet inspection and real-time anomaly detection for effective defense. <ref name="TrendMicroBotnet2024">"New Rapidly Growing IoT Botnet Reaper" - available under: https://success.trendmicro.com/dcx/s/solution/1118928-new-rapidly-growing-iot-botnet-reaper?language=en_US&sfdcIFrameOrigin=null - Retrieved 2024-01-05.</ref> <ref name="SecurityArtwork2024">"Linux.IotReaper Analysis" - available under: https://www.securityartwork.es/2018/02/14/linux-iotreaper-analysis/ - Retrieved 2024-01-05.</ref>

* '''Hajime''': First observed in October 2016 by RapidityNetworks, Hajime is an IoT worm that creates a vast peer-to-peer botnet, which had reached nearly 300,000 devices by April 2017. Its purpose remains unclear, as it has not been used for malicious activities. Hajime is known for its evolving capabilities, using methods like TR-069 exploitation, Telnet default password attacks, and Arris cable modem attacks. It targets a wide range of IoT devices and continuously updates its attack vectors, making it a sophisticated and adaptable threat. The worm has an architecture detection mechanism to ensure the appropriate binary is used for different device architectures, and it employs smart password bruteforcing for specific brands and devices. Despite its size and capabilities, Hajime has notably avoided attacking certain networks and regions. <ref name="Radware2024">"Rise of Botnets: Mirai & Hajime" - available under: https://www.radware.com/security/ddos-threats-attacks/ddos-attack-types/rise-of-botnets-mirai-hajime/ - Retrieved 2024-01-05.</ref> <ref name="Securelist2024">"Hajime – the mysterious evolving botnet" - available under: https://securelist.com/hajime-the-mysterious-evolving-botnet/78160/ - Retrieved 2024-01-05.</ref>

* '''Echobot''': Emerging in mid-May, Echobot is a Mirai variant initially identified by Palo Alto Networks and subsequently analyzed by Akamai. It doesn't alter the original Mirai source code but adds numerous modules. Initially, Echobot targeted 18 vulnerabilities, rapidly evolving to exploit 26, and then over 50. This variant is known for its broad targeting of IoT devices and enterprise applications, including vulnerabilities in products like Oracle WebLogic and VMware SD-WAN. Its exploit selection includes a range of vulnerabilities, both old and new, without preference for age. Security researcher Carlos Brendel noted that Echobot's exploit list provides insight into the most attacked devices and vulnerabilities, as it includes the most effective exploits for botnet propagation. Echobot's architecture is designed to cover a wide range of processor architectures, making it a significant threat to a diverse array of systems. <ref name="NHSDigital2024">"Cyber Alerts 2019 CC-3101" - available under: https://digital.nhs.uk/cyber-alerts/2019/cc-3101 - Retrieved 2024-01-05.</ref> <ref name="F5Labs2024">"Echobot Malware Now Up to 71 Exploits - Targeting SCADA" - available under: https://www.f5.com/labs/articles/threat-intelligence/echobot-malware-now-up-to-71-exploits--targeting-scada - Retrieved 2024-01-05.</ref>

* '''Gitpaste-12''': Detected by Juniper Threat Labs in October 2020, Gitpaste-12 is a sophisticated botnet that uses GitHub and Pastebin for hosting its components. Named for its use of 12 known vulnerabilities, Gitpaste-12 is designed to attack Linux servers and IoT devices, leveraging exploits in popular open-source components like Apache Struts and mongoDB. The malware sets up cron jobs for persistence and employs various methods, including a Monero cryptocurrency miner, brute-force attacks, and reverse shells. Gitpaste-12’s ability to use trusted sites for hosting and its varied attack vectors make it a significant threat. The malware's development indicates ongoing efforts to evolve its capabilities, highlighting the importance of vigilance in software supply chain security.<ref name="NHSDigital2024b">"Cyber Alerts 2020 CC-3663" - available under: https://digital.nhs.uk/cyber-alerts/2020/cc-3663 - Retrieved 2024-01-05.</ref> <ref name="BleepingComputer2024">"Gitpaste-12 Worm Botnet Returns with 30+ Vulnerability Exploits" - available under: https://www.bleepingcomputer.com/news/security/gitpaste-12-worm-botnet-returns-with-30-plus-vulnerability-exploits/ - Retrieved 2024-01-05.</ref>

* '''Linux.Wifatch''': Linux.Wifatch is an atypical Malware which protects routers from botnets and other threats. It spreads via Telnet with default passwords and forces the user to update and change the credentials. With possible altruistic motives, it is also said to be directed against state surveillance such as that of the NSA. Despite its protective nature, it remains a security risk as users lose control of their devices. Experts recommend removal and better protective measures such as firmware updates and secure passwords.<ref name="linux.wifatch2024">"Defending You From Other Malware" - available under: https://securityintelligence.com/news/linux-wifatch-the-router-virus-that-may-be-secretly-defending-you-from-other-malware/ - Retrieved 2024-12-15.</ref>

* '''Linux.Darlloz''': Linux.Darlloz is a worm that focuses on old Linux-Systems like routers and Set-Top-Boxes, especially those with Intel architecture. The worm exploits the PHP vulnerability CVE-2012-1823 to execute remote code and it spreads by using default Telnet credentials. Symantec researchers claims that there are malicious binaries for multiple architectures. Linux.Darlloz installed cpuminer to mine cryptocurrency like Dogecoin or Bitcoins.<ref name="linux.darlloz2024">"Linux.Darlloz worm attacks embedded systems" - available under: https://boingboing.net/2013/11/28/linux-darlloz-worm-attacks-emb.html - Retrieved 2024-12-15.</ref> <ref name="hackernews_linux.darlloz2024">"Linux Worm targets Internet-enabled Home appliances to Mine Cryptocurrencies" - available under: https://thehackernews.com/2014/03/linux-worm-targets-internet-enabled.html - Retrieved 2024-12-15.</ref>

* '''Remaiten''': Remaiten is a Linux-based malware targeting routers and potentially other IoT devices, notable for its ability to spread efficiently and kill competing malware. It brute-forces Telnet credentials, determines the target's architecture by executing commands that reveal system details, such as parsing environment variables, and deploys the appropriate payload based on the identified architecture. Remaiten uses IRC for command-and-control communication, reports infection statuses, and even includes functionality to eliminate rival bots. Its modular design supports various platforms, making it a significant threat to embedded devices running outdated or insecure software.<ref name="remaiten2024">"Meet Remaiten - a Linux bot on steroids targeting routers and potentially other IoT devices" - available under: https://www.welivesecurity.com/2016/03/30/meet-remaiten-a-linux-bot-on-steroids-targeting-routers-and-potentially-other-iot-devices/ - Retrieved 2024-12-15.</ref>

[[Category:Basic]]

IoT Malware

2024-12-15T00:33:42Z

AVujisic:

IoT Malware

2024-12-15T00:15:45Z

AVujisic: